Name: Prioritized vulnerability dataset – Week 2 of September 2026
Creator: defend.network
Published: 2026-09-14T07:00:00Z
License: https://creativecommons.org/licenses/by/4.0/

Analyst Guidance

This week saw four verified CVEs with explicit IDs and actionable intelligence. and require immediate patching. Two additional critical flaws affecting SolarWinds ARM and Orkes Conductor show high CVSS scores and active or wild exploitation; organizations using these products should prioritize remediation within 48 hours.

CVE Details & Remediation

How to read this report

Verified facts — NVD & CISA KEV Partially verified — awaiting NVD enrichment AI analysis — synthesis, verify before acting

Actionable · Verified facts

NVD-published · CISA KEV cross-checked

🛡️CVE-2026-76460 – Cisco Identity Services Engine ✓ NVD

CVSS10 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS1% · P55

ActionPatch immediately

AffectedTechnology Government Defense

Remediation Steps

Apply the vendor security update for Cisco Identity Services Engine as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-20079 – Cisco Secure Firewall Management Center (FMC) And Security Cloud Control (SCC) Firewall Management ✓ NVD

CVSS10 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS76% · P99

ActionPatch immediately

AffectedGovernment Telecom Technology

Remediation Steps

Apply the vendor security update for Cisco Secure Firewall Management Center as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-85706 – GitLab Community Edition And Enterprise Edition ✓ NVD

CVSS10 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS15% · P96

ActionPatch immediately

Remediation Steps

Apply the latest GitLab security patch for Community Edition and Enterprise Edition immediately
Verify patch application across all GitLab instances in your environment
Review access logs for evidence of exploitation attempts
Restrict network access to GitLab instances to trusted networks pending patch confirmation

References:

🛡️CVE-2026-75650 – Adobe Commerce And Magento ✓ NVD

CVSS10 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS2% · P81

ActionPatch immediately

Remediation Steps

Identify systems affected by CVE-2026-75650 using vulnerability scanning tools
Apply vendor patches according to the vendor's published security advisory
Verify patch installation across all affected systems

References:

🛡️CVE-2026-49869 – Kestra OSS ✓ NVD

CVSS10 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS2% · P79

ActionPatch immediately

AffectedTechnology Finance Healthcare

Remediation Steps

Apply the vendor security update for Kestra OSS as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-83548 – SonicWall SMA1000 Appliances ✓ NVD

CVSS10 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS5% · P91

ActionPatch immediately

Remediation Steps

Apply SonicWall security updates for SMA 1000 series VPN appliances as released by vendor
If patching cannot be completed immediately, isolate affected SMA 1000 appliances from untrusted networks
Monitor appliance logs for unusual SSRF or authentication bypass attempts
Enforce network access restrictions to administrative interfaces
Review and revoke any suspicious user sessions or API tokens created on affected appliances

References:

🛡️CVE-2026-21962 – Oracle HTTP Server And Oracle Weblogic Server Proxy Plug-In ✓ NVD

CVSS10 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS42% · P99

ActionPatch immediately

AffectedTechnology Finance Government

Remediation Steps

Apply the vendor security update for Oracle HTTP Server And Oracle Weblogic Server Proxy Plug-In as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-84869 – ConnectWise ScreenConnect ✓ NVD

CVSS9.9 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS1% · P51

ActionPatch immediately

AffectedGovernment Technology Defense

Remediation Steps

Apply the vendor security update for Connectwise Screenconnect as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-76461 – Cisco Secure Email Gateway ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS2% · P80

ActionPatch immediately

AffectedTechnology Government

Remediation Steps

Apply the vendor security update for Cisco Asyncos as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-19490 – Citrix NetScaler ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS6% · P93

ActionPatch immediately

AffectedTechnology Finance

Remediation Steps

Apply the vendor security update for Citrix NetScaler as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2025-25249 – Fortinet Multiple Products ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS2% · P83

ActionPatch immediately

AffectedTechnology Finance

Remediation Steps

Apply the vendor security update for Fortinet Multiple Products as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-86218 – N-Able N-Central ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS7% · P94

ActionPatch immediately

Remediation Steps

Apply the vendor patch for N-able N-central immediately.
Verify patch deployment across all instances.
Monitor for indicators of compromise or suspicious authentication attempts.
Review access logs for unauthorized pre-authentication activities.

References:

🛡️CVE-2026-81578 – PaperCut NG/MF ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS3% · P88

ActionPatch immediately

AffectedEducation

Remediation Steps

Apply the vendor patch to address the authentication bypass flaw
Review access logs for evidence of unauthorized authentication or command execution
Conduct credential audit of accounts that may have been exposed
Restrict network access to PaperCut management interfaces

References:

🛡️CVE-2026-9586 – Sangoma Switchvox ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS12% · P96

ActionPatch immediately

AffectedTechnology

Remediation Steps

Apply the vendor security update for Sangoma Switchvox as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-82329 – JFrog Artifactory ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS8% · P94

ActionPatch immediately

AffectedTechnology Healthcare Finance

Remediation Steps

Apply the vendor security update for JFrog Artifactory as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2023-49105 – Owncloud Server ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS43% · P99

ActionPatch immediately

Remediation Steps

Apply ownCloud security patch for CVE-2023-49105 immediately
Review access logs for indicators of compromise targeting file repositories
Restrict network access to ownCloud instances to trusted networks where possible
Monitor for unauthorized file access or exfiltration activity

References:

🛡️CVE-2021-23758 – Ajaxpro.2 Project Ajaxpro.2 (also: Michaelschwarz) ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS84% · P100

ActionPatch immediately

AffectedTechnology

Remediation Steps

Apply the vendor security update for Ajaxpro.2 Project Ajaxpro.2 as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-72529 – TrueConf Server ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS2% · P74

ActionPatch immediately

Remediation Steps

Apply the vendor security patch
Review system logs for evidence of exploitation
Verify affected systems are fully patched
Monitor for suspicious activity post-remediation

References:

🛡️CVE-2026-33824 – Microsoft Internet Key Exchange (IKE) Service Extensions ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS73% · P99

ActionPatch immediately

Remediation Steps

Consult CISA Known Exploited Vulnerabilities Catalog for affected product details
Apply vendor patch when available
Verify patch deployment across affected systems

References:

🛡️CVE-2026-59310 – Broadcom VMware VCenter ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS50% · P99

ActionPatch immediately

AffectedHealthcare Government

Remediation Steps

Apply the vendor security update for Vmware Vcenter Server as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-65400 – Apple MacOS ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS10% · P96

ActionPatch immediately

AffectedHealthcare Government

Remediation Steps

Apply the vendor security update for Apple Macos as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-60004 – Gitea ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS87% · P100

ActionPatch immediately

Remediation Steps

Apply the vendor security update for Gitea Gitea as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

https://nvd.nist.gov/vuln/detail/CVE-2026-60004

🛡️CVE-2026-8452 – Citrix NetScaler ADC And NetScaler Gateway ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS2% · P75

ActionPatch immediately

Remediation Steps

Apply the vendor security update for Citrix NetScaler ADC and NetScaler Gateway as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-86060 – MikroTik RouterOS ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS1% · P63

ActionPatch immediately

Remediation Steps

Apply the vendor security update for MikroTik RouterOS as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-64849 – Lfprojects Mlflow ✓ NVD

CVSS9.3 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS16% · P97

ActionPatch immediately

Remediation Steps

Apply the vendor security patch
Review system logs for evidence of exploitation
Verify affected systems are fully patched
Monitor for suspicious activity post-remediation

References:

🛡️CVE-2026-82078 – PaperCut NG/MF ✓ NVD

CVSS9.1 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS4% · P89

ActionPatch immediately

AffectedEducation

Remediation Steps

Apply the vendor patch to address the remote code execution vulnerability
Audit logs for malicious script execution or unauthorized commands
Verify integrity of system binaries and scripts on affected servers
Restrict inbound access to PaperCut services to trusted networks

References:

🛡️CVE-2026-55040 – Microsoft SharePoint ✓ NVD

CVSS9.1 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS51% · P99

ActionPatch immediately

AffectedHealthcare Government

Remediation Steps

Apply the vendor security update for Microsoft Sharepoint Server as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-72530 – TrueConf Server ✓ NVD

CVSS9 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS2% · P78

ActionPatch immediately

AffectedTransportation Technology Finance

Remediation Steps

Apply the vendor security update for Trueconf Server as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-58138 – Orkes Conductor ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild

EPSS9% · P95

ActionPatch within 48 hours

Remediation Steps

Upgrade Orkes Conductor to version 3.30.2 or later
Apply authentication controls and network segmentation to isolate Conductor instances from untrusted networks
Review access logs for evidence of exploitation or unauthorized access attempts
Monitor for indicators of compromise linked to unauthenticated RCE abuse

References:

🛡️CVE-2026-89026 – Issabel Framework ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild

EPSS1% · P43

ActionPatch within 48 hours

AffectedTechnology Government

Remediation Steps

Apply the vendor security update for Issabel Framework as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-73570 – Synacor Zimbra Collaboration Suite (ZCS) ✓ NVD

CVSS8.9 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS32% · P98

ActionPatch immediately

AffectedTechnology Finance

Remediation Steps

Apply the vendor security update for Synacor Zimbra Collaboration Suite as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-53266 – Linux Kernel ✓ NVD

CVSS8.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS<1% · P20

ActionPatch immediately

AffectedTechnology

Remediation Steps

Apply the vendor security update for Linux Kernel as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-58704 – Google Pixel ✓ NVD

CVSS8.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS<1% · P11

ActionPatch immediately

AffectedTechnology Government Defense

Remediation Steps

Apply the vendor security update for Google Pixel as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-42016 – JFrog Artifactory ✓ NVD

CVSS8.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS9% · P95

ActionPatch immediately

Remediation Steps

Apply vendor security patch for incorrect authorization flaw
Reset credentials for administrative and service accounts post-patch
Review audit logs for unauthorized access or privilege escalation
Restrict Artifactory network access to trusted sources if patching is delayed

References:

🛡️CVE-2026-87491 – Google Chromium V8 ✓ NVD

CVSS8.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS1% · P61

ActionPatch immediately

AffectedTechnology Finance

Remediation Steps

Apply the vendor security update for Google Chromium V8 as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-85046 – Google Chromium V8 ✓ NVD

CVSS8.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS1% · P72

ActionPatch immediately

AffectedTechnology Retail Telecom

Remediation Steps

Apply the vendor security update for Google Chrome as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2025-62593 – Ray-Project Ray ✓ NVD

CVSS8.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS17% · P97

ActionPatch immediately

AffectedTechnology Manufacturing Energy

Remediation Steps

Apply the vendor security update for Anyscale Ray as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2019-1068 – Microsoft SQL Server ✓ NVD

CVSS8.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS53% · P99

ActionPatch immediately

Remediation Steps

Apply the vendor security update for Microsoft SQL Server as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-67277 – MikroTik RouterOS ✓ NVD

CVSS8.2 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS1% · P57

ActionPatch immediately

Remediation Steps

Consult CISA KEV catalog and vendor advisory for affected product and version
Apply vendor patch to all affected systems
Verify patch deployment across your environment

References:

🛡️CVE-2026-59822 – BerriAI LiteLLM ✓ NVD

CVSS8.2 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS1% · P57

ActionPatch immediately

Remediation Steps

Apply the vendor security update for BerriAI LiteLLM as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

Editorial integrity

Verified facts (green zone): 40 CVE ID(s) verified verbatim against source articles; 40 published in NVD with full canonical data (vendor, product, CVSS, references); 38 confirmed exploited in CISA KEV; 2 with source-reported exploitation (KEV-pending); 1 corroborated across 2+ sources.

AI-synthesized content (analyst summary, remediation step phrasing): generated by an AI model from 5 security feeds. Generic remediation guidance (apply patch, restrict network access, monitor logs) is best-practice and trusted; specific vendor steps and version numbers must be verified against the official advisories linked above. Verify before acting in production.

Adjustments before publication: 10 unverified claim(s) stripped or genericized.

Find an error? contact@defend.network

Updated 2026-10-15: NVD canonical data arrived for CVE-2026-76461; moved into Verified Facts.

🤖 This vulnerability report was compiled by defend.network using AI-powered analysis of vulnerability databases, vendor advisories, and threat intelligence feeds. Always verify remediation steps through official vendor channels before implementing changes in production environments.