Flaws added in September 2026
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in September 2026. For the newest, see Exploited flaws.
In September 2026, CISA added 43 flaws to its list of vulnerabilities being used in attacks, 8 of them in things people have at home. Most came from Cisco (4), Citrix (3) and MikroTik (3).[1]
Most let an attacker take over the product, running their own code or taking full control. It was the most CISA added in any month of 2026.
List of flaws
Every flaw CISA added in September 2026, newest first, in plain English, each with an article of its own.[2]
Show
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-76504At work |
Cisco Catalyst SD-WAN Manager. Attackers can get into Cisco Catalyst SD-WAN Manager without a valid password. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-86950At home |
Apple devices. Opening a booby-trapped file can let an attacker run their own code through Apple devices. | At home |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-88772At work |
Citrix NetScaler. Attackers can run their own code on Citrix NetScaler. | At work |
CVE-2026-88771At work |
Citrix NetScaler. Attackers can run commands on Citrix NetScaler from anywhere, without logging in. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-87902At home |
WordPress Core. Attackers can run their own code on WordPress Core from anywhere, without logging in. | At home |
CVE-2026-67279At work |
MikroTik RouterOS. Attackers are using a flaw in MikroTik RouterOS. | At work |
CVE-2026-65660At work |
Microsoft SharePoint. Attackers can run their own code on Microsoft SharePoint. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-71362At work |
Adobe Commerce and Magento. Someone who already has a foothold can use Adobe Commerce and Magento to take full control of the machine. | At work |
CVE-2026-5430At work |
WSO2 products. Attackers can run their own code on WSO2 products. | At work |
4 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-94127At work |
F5 BIG-IP APM. Attackers can run their own code on F5 BIG-IP APM from anywhere, without logging in. | At work |
CVE-2026-93952At work |
Arista VeloCloud Orchestrator. Attackers are using a flaw in Arista VeloCloud Orchestrator. | At work |
CVE-2026-93616At work |
Check Point products. Attackers can read files on Check Point products that should be out of reach from anywhere, without logging in. | At work |
CVE-2026-85102At work |
Check Point products. Attackers can run their own code on Check Point products from anywhere, without logging in. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-7273At home |
Zyxel GS1900 Series Switches. Attackers can run commands on Zyxel GS1900 Series Switches from anywhere, without logging in. | At home |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-53266At work |
Linux Kernel. Attackers can corrupt memory in Linux Kernel, which they use to take it over. | At work |
CVE-2025-39964At work |
Linux Kernel. Attackers can corrupt memory in Linux Kernel, which they use to take it over. | At work |
CVE-2025-39682At work |
Linux Kernel. Attackers are using a flaw in Linux Kernel. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-87886At work |
Acronis Backup. Someone who already has a foothold can use Acronis Backup to take full control of the machine. | At work |
CVE-2026-76460At work |
Cisco Identity Services Engine. Attackers can get into Cisco Identity Services Engine without a valid password. | At work |
CVE-2026-58704At home |
Google Pixel. Someone who already has a foothold can use Google Pixel to take full control of the machine. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-76461At work |
Cisco Secure Email Gateway. Attackers can run commands on Cisco Secure Email Gateway from anywhere, without logging in. | At work |
4 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-85706At work |
GitLab Community Edition and Enterprise Edition. Attackers can get into GitLab Community Edition and Enterprise Edition without a valid password. | At work |
CVE-2026-84869At work |
ConnectWise ScreenConnect. Attackers can reach parts of ConnectWise ScreenConnect that should be locked to them. | At work |
CVE-2026-42018At work |
JFrog Artifactory. Attackers can get into JFrog Artifactory without a valid password. | At work |
CVE-2026-42016At work |
JFrog Artifactory. Someone who already has a foothold can use JFrog Artifactory to take full control of the machine. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-86060At work |
MikroTik RouterOS. Attackers can use MikroTik RouterOS to take full control of the machine from anywhere, without logging in. | At work |
CVE-2026-67277At work |
MikroTik RouterOS. Attackers can get into MikroTik RouterOS without a valid password. | At work |
4 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-87491At home |
Chrome and other Chromium browsers. A booby-trapped web page can run an attacker's code through Chrome and other Chromium browsers. | At home |
CVE-2026-20079At work |
Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management. Attackers can use Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management to take full control of the machine from anywhere, without logging in. | At work |
CVE-2026-19490At work |
Citrix NetScaler. Attackers can get into Citrix NetScaler without a valid password. | At work |
CVE-2025-25249At work |
Fortinet products. Attackers can corrupt memory in Fortinet products, which they use to take it over. | At work |
4 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-86218At work |
N-able N-central. Attackers can run their own code on N-able N-central from anywhere, without logging in. | At work |
CVE-2026-85880At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2026-81963At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2026-75650At work |
Adobe Commerce and Magento. Attackers can run their own code on Adobe Commerce and Magento. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-85046At home |
Chrome and other Chromium browsers. A booby-trapped web page can run an attacker's code through Chrome and other Chromium browsers. | At home |
7 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-9586At work |
Sangoma Switchvox. Attackers can run their own code on Sangoma Switchvox from anywhere, without logging in. | At work |
CVE-2026-83549At work |
SonicWall SMA1000 Appliances. Someone who already has a way in can use SonicWall SMA1000 Appliances to run their own code. | At work |
CVE-2026-83548At work |
SonicWall SMA1000 Appliances. Attackers can make SonicWall SMA1000 Appliances send requests into the network behind it from anywhere, without logging in. | At work |
CVE-2026-82329At work |
JFrog Artifactory. Attackers can get into JFrog Artifactory without a valid password. | At work |
CVE-2026-59822At work |
BerriAI LiteLLM. Attackers can get into BerriAI LiteLLM without a valid password. | At work |
CVE-2026-49869At work |
Kestra OSS. Attackers can run their own code on Kestra OSS from anywhere, without logging in. | At work |
CVE-2026-48710At work |
Kludex Starlette. Attackers can get into Kludex Starlette without a valid password. | At work |
Companies
The flaws were in 25 companies’ products; the most were in Cisco’s (4).
| Company | Flaws | Ransomware |
|---|---|---|
| Cisco | 4 | – |
| Citrix | 3 | – |
| 3 | – | |
| JFrog | 3 | – |
| Linux | 3 | – |
| Microsoft | 3 | – |
| MikroTik | 3 | – |
| Adobe | 2 | – |
| Check Point | 2 | – |
| SonicWall | 2 | – |
| Acronis | 1 | – |
| Apple | 1 | – |
| Arista | 1 | – |
| BerriAI | 1 | – |
| ConnectWise | 1 | – |
| 10 others | 10 |
Other months
Every month since CISA started the list; September 2026 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.