Audience: Vulnerability Managers, Security Operations, CISOs, DevSecOps Teams
Reading Time: Approximately 10 minutes

Subscribe to get these articles directly to your inbox when published

43 KEV additions. 28 critical CVEs. 

September 2026 saw a massive surge of 43 critical additions to CISA's Known Exploited Vulnerabilities (KEV) catalog, heavily dominated by enterprise networking equipment, core operating system kernels, perimeter gateways, and management consoles. Threat actor activity this month heavily targeted unauthenticated remote code execution and path traversal vectors, proving an aggressive, sustained campaign against edge appliances and infrastructure management servers. This monthly rollup provides security leaders and defense teams with cumulative intelligence, operational risk analysis, and prioritized remediation paths to safeguard enterprise assets.

The Month in Numbers

Priority Vulnerabilities This Month

What you should do next

Ensure you understand the latest KEV additions to cover off any potential gaps in your remediation activities.  View all weekly reports here

Further Reading

The following resources offer technical analysis to help integrate CISA KEV data into operational triage workflows and stay aligned with updated mitigation guidance.

Threat Landscape Context

September's heavy influx of 43 KEV additions highlights a major tactical shift toward foundational infrastructure components, including deep Linux kernel memory weaknesses, network management plane vulnerabilities (Check Point, Arista, Cisco), and edge routing platforms. Rather than isolated desktop applications, threat actors are systematically exploiting architectural primitives that permit root-level persistence and unauthenticated command execution across large networks. The inclusion of critical kernel race conditions and out-of-bounds writes signifies that sophisticated adversaries are weaponizing low-level system flaws to bypass traditional endpoint detection and response layers.

Sector Exposure Summary

Hackerstorm Analysis

Analyzing all 43 KEV entries from September reveals a concerning convergence: adversaries are coupling low-level OS kernel flaws (such as Linux socket race conditions and out-of-bounds writes) with high-level edge management bypasses. This dual-pronged volume suggests that attackers are preparing pre-positioned exploitation frameworks capable of establishing persistent footholds across heterogeneous enterprise stacks. Security teams must recognize that high monthly volumes of KEV additions cannot be mitigated by standard patch cycles alone; organizations require automated asset discovery and runtime behavioral telemetry to catch anomalous kernel and gateway activity.

About This Report

Attribution Note

This analysis is based on publicly available reporting and security research summaries. Some technical details may change as additional information becomes available. 

Author Information

Timur Mehmet | Founder & Lead Editor

Timur is a veteran Information Security professional with a career spanning over three decades. Since the 1990s, he has led security initiatives across high-stakes sectors, including Finance, Telecommunications, Media, and Energy. Professional qualifications over the years have included CISSP, ISO27000 Auditor, ITIL and technologies such as Networking, Operating Systems, PKI, Firewalls. For more information including independent citations and credentials, visit our About page.

Contact: This email address is being protected from spambots. You need JavaScript enabled to view it.

Editorial Standards

This article adheres to Hackerstorm.com's commitment to accuracy, independence, and transparency:

• Fact-Checking: All statistics and claims are verified against primary sources and authoritative reports
• Source Transparency: Original research sources and citations are provided in the References section below
• No Conflicts of Interest: This analysis is independent and not sponsored by any vendor or organization
• Corrections Policy: We correct errors promptly and transparently. Report inaccuracies to This email address is being protected from spambots. You need JavaScript enabled to view it.

Editorial Policy: Ethics, Non-Bias, Fact Checking and Corrections

Learn More: About Hackerstorm.com | FAQs

Source Transparency

• Vendor Advisories:

  • Cisco Security Advisory — https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU

  • Apple Security Updates — https://support.apple.com/en-us/149226

  • Citrix Security Bulletin — https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

  • MikroTik RouterOS Advisory — https://mikrotik.com/supportsec/september-2026-vulnerability/

  • Microsoft Security Update Guide — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660

  • WordPress Security Advisory — https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp

  • WSO2 Security Advisory — https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/

  • Adobe Commerce Advisory — https://helpx.adobe.com/security/products/magento/apsb26-92.html

  • Arista Security Advisory — https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183

  • F5 Security Advisory — https://my.f5.com/manage/s/article/K000162605

  • Check Point Security Advisory — https://support.checkpoint.com/results/sk/sk1000171/

  • Zyxel Security Advisory — https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026

  • Linux Kernel Git Repository — https://git.kernel.org/