Name: Prioritized vulnerability dataset – Week 4 of September 2026
Creator: defend.network
Published: 2026-09-28T07:00:00Z
License: https://creativecommons.org/licenses/by/4.0/

Analyst Guidance

This week's threat landscape is dominated by active exploitation of Microsoft SharePoint vulnerabilities by the China-linked Warlock ransomware group targeting critical infrastructure, government, and education sectors across Portuguese- and Spanish-speaking regions. Dell Container Storage Modules also present a critical authentication bypass (CVSS 10.0) affecting Kubernetes deployments. Organizations should prioritize patching SharePoint systems and Dell CSM instances immediately, as evidence of active exploitation exists for SharePoint and the Dell vulnerability enables unauthenticated administrative access.

CVE Details & Remediation

How to read this report

Verified facts — NVD & CISA KEV Partially verified — awaiting NVD enrichment AI analysis — synthesis, verify before acting

Actionable · Verified facts

NVD-published · CISA KEV cross-checked

🛡️CVE-2026-85706 – GitLab Community Edition And Enterprise Edition ✓ NVD

CVSS10 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS93% · P100

ActionPatch immediately

AffectedTechnology Energy Telecom

Remediation Steps

Apply the vendor security update for Gitlab as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-5430 – WSO2 Multiple Products ✓ NVD

CVSS10 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS1% · P46

ActionPatch immediately

Remediation Steps

Apply available patches from GitHub
Review GitHub repository access logs for unauthorized activity
Audit repository permissions and access controls
Monitor for credential compromise or token abuse

References:

🛡️CVE-2026-76460 – Cisco Identity Services Engine ✓ NVD

CVSS10 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS14% · P96

ActionPatch immediately

AffectedTechnology

Remediation Steps

Apply the vendor security update for Cisco Identity Services Engine as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-93952 – Arista VeloCloud Orchestrator ✓ NVD

CVSS10 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS1% · P63

ActionPatch immediately

Remediation Steps

Review VeloCloud Orchestrator instances configured with certificate-based Edge authentication
Restrict network access to the VCO management interface to trusted administrative networks
Monitor authentication logs for unauthorized privilege escalation attempts

References:

🛡️CVE-2026-20079 – Cisco Secure Firewall Management Center (FMC) And Security Cloud Control (SCC) Firewall Management ✓ NVD

CVSS10 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS88% · P100

ActionPatch immediately

AffectedGovernment Telecom Technology

Remediation Steps

Apply the vendor security update for Cisco Secure Firewall Management Center as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-75650 – Adobe Commerce And Magento ✓ NVD

CVSS10 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS4% · P90

ActionPatch immediately

Remediation Steps

Identify systems affected by CVE-2026-75650 using vulnerability scanning tools
Apply vendor patches according to the vendor's published security advisory
Verify patch installation across all affected systems

References:

🛡️CVE-2026-49869 – Kestra OSS ✓ NVD

CVSS10 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS2% · P81

ActionPatch immediately

AffectedTechnology Finance Healthcare

Remediation Steps

Apply the vendor security update for Kestra OSS as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-83548 – SonicWall SMA1000 Appliances ✓ NVD

CVSS10 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS9% · P95

ActionPatch immediately

Remediation Steps

Apply SonicWall security updates for SMA 1000 series VPN appliances as released by vendor
If patching cannot be completed immediately, isolate affected SMA 1000 appliances from untrusted networks
Monitor appliance logs for unusual SSRF or authentication bypass attempts
Enforce network access restrictions to administrative interfaces
Review and revoke any suspicious user sessions or API tokens created on affected appliances

References:

🛡️CVE-2026-84869 – ConnectWise ScreenConnect ✓ NVD

CVSS9.9 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS1% · P59

ActionPatch immediately

AffectedGovernment Technology Defense

Remediation Steps

Apply the vendor security update for Connectwise Screenconnect as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-102489 – Zammad GmbH Zammad ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ● New this week ★ Added to KEV this week

EPSS1% · P71

ActionPatch immediately

AffectedGovernment Education Telecom

Remediation Steps

Apply latest Microsoft security patches for SharePoint systems
Review SharePoint access logs for suspicious activity consistent with Warlock ransomware group tactics
Isolate affected SharePoint instances from networks during patch deployment if possible
Enable enhanced monitoring and alerting for SharePoint authentication and administrative actions

References:

🛡️CVE-2026-104286 – Fortinet FortiMail ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ● New this week ★ Added to KEV this week

EPSS2% · P82

ActionPatch immediately

Remediation Steps

Apply vendor patch for Fortrix to remediate known exploited vulnerability
Verify patch deployment across all affected instances
Monitor security logs for exploitation attempts post-patching

References:

🛡️CVE-2026-76504 – Cisco Catalyst SD-WAN Manager ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ● New this week ★ Added to KEV this week

EPSS2% · P75

ActionPatch immediately

AffectedTechnology Government Finance

Remediation Steps

Apply the vendor security update for Cisco Catalyst Sd-Wan Manager as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-35273 – Oracle PeopleSoft Enterprise PeopleTools ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ● New this week

EPSS9% · P95

ActionPatch immediately

AffectedTechnology Finance

Remediation Steps

Apply the vendor security update for Oracle Peoplesoft Enterprise Peopletools as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-88771 – Citrix NetScaler ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS1% · P63

ActionPatch immediately

AffectedTechnology Finance

Remediation Steps

Apply the vendor security update for Citrix Netscaler Application Delivery Controller as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-94127 – F5 BIG-IP APM ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS2% · P82

ActionPatch immediately

AffectedTechnology Retail

Remediation Steps

Apply the vendor security update for F5 BIG-IP APM as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-85102 – Check Point Multiple Products ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS8% · P94

ActionPatch immediately

AffectedGovernment Finance Technology

Remediation Steps

Apply the vendor security update for Check Point Security Gateway, Check Point Spark Firewall as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-93616 – Check Point Multiple Products ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS20% · P97

ActionPatch immediately

AffectedGovernment Technology

Remediation Steps

Apply the vendor security update for Check Point Security Management Server as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-86060 – MikroTik RouterOS ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS6% · P93

ActionPatch immediately

Remediation Steps

Apply the latest MikroTik RouterOS security update addressing argument-injection in login process
Restrict SSH access to trusted administrative networks
Review router authentication logs for unauthorized access attempts
Consider disabling SSH access from untrusted networks until patching is complete

References:

🛡️CVE-2025-39682 – Linux Kernel ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS3% · P86

ActionPatch immediately

Remediation Steps

Apply the latest Linux kernel security patches
Prioritize patching systems exposed to untrusted networks
Review system logs for signs of active exploitation
Test patches in non-production environments before deployment

References:

🛡️CVE-2026-76461 – Cisco Secure Email Gateway ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS28% · P98

ActionPatch immediately

AffectedTechnology Government

Remediation Steps

Apply the vendor security update for Cisco Asyncos as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-19490 – Citrix NetScaler ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS23% · P98

ActionPatch immediately

AffectedTechnology Finance

Remediation Steps

Apply the vendor security update for Citrix NetScaler as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2025-25249 – Fortinet Multiple Products ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS4% · P90

ActionPatch immediately

AffectedTechnology Finance

Remediation Steps

Apply the vendor security update for Fortinet Multiple Products as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-86218 – N-Able N-Central ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS13% · P96

ActionPatch immediately

Remediation Steps

Apply the vendor patch for N-able N-central immediately.
Verify patch deployment across all instances.
Monitor for indicators of compromise or suspicious authentication attempts.
Review access logs for unauthorized pre-authentication activities.

References:

🛡️CVE-2026-81578 – PaperCut NG/MF ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS85% · P100

ActionPatch immediately

AffectedEducation

Remediation Steps

Apply the vendor patch to address the authentication bypass flaw
Review access logs for evidence of unauthorized authentication or command execution
Conduct credential audit of accounts that may have been exposed
Restrict network access to PaperCut management interfaces

References:

🛡️CVE-2026-9586 – Sangoma Switchvox ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS19% · P97

ActionPatch immediately

AffectedTechnology

Remediation Steps

Apply the vendor security update for Sangoma Switchvox as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-82329 – JFrog Artifactory ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS14% · P96

ActionPatch immediately

AffectedTechnology Healthcare Finance

Remediation Steps

Apply the vendor security update for JFrog Artifactory as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-88772 – Citrix NetScaler ✓ NVD

CVSS9.5 NVD 4.0

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS1% · P69

ActionPatch immediately

AffectedTechnology Government

Remediation Steps

Apply the vendor security update for Citrix NetScaler ADC/Gateway as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-102490 – Zammad GmbH Zammad ✓ NVD

CVSS9.4 NVD 4.0

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ● New this week ★ Added to KEV this week

EPSS1% · P48

ActionPatch immediately

AffectedTechnology Government Finance

Remediation Steps

Apply the vendor security update for Zammad Ticketing System as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-71362 – Adobe Commerce And Magento ✓ NVD

CVSS9.1 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS88% · P100

ActionPatch immediately

AffectedTechnology Finance

Remediation Steps

Apply the vendor security update for Adobe Commerce as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-82078 – PaperCut NG/MF ✓ NVD

CVSS9.1 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS61% · P99

ActionPatch immediately

AffectedEducation

Remediation Steps

Apply the vendor patch to address the remote code execution vulnerability
Audit logs for malicious script execution or unauthorized commands
Verify integrity of system binaries and scripts on affected servers
Restrict inbound access to PaperCut services to trusted networks

References:

🛡️CVE-2026-73570 – Synacor Zimbra Collaboration Suite (ZCS) ✓ NVD

CVSS8.9 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ● New this week

EPSS12% · P96

ActionPatch immediately

AffectedTechnology Government Finance

Remediation Steps

Apply the vendor security update for Synacor Zimbra Collaboration Suite as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-86950 – Apple Multiple Products ✓ NVD

CVSS8.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ● New this week ★ Added to KEV this week

EPSS1% · P68

ActionPatch immediately

AffectedTechnology Finance

Remediation Steps

Apply the vendor security update for Apple iOS, iPadOS, macOS as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-65660 – Microsoft SharePoint ✓ NVD

CVSS8.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS2% · P81

ActionPatch immediately

Remediation Steps

Apply the latest Microsoft security patch
Prioritize patching across all affected systems
Monitor email systems and document processing for suspicious activity
Review recent file access and document modification logs

References:

🛡️CVE-2026-7273 – Zyxel GS1900 Series Switches ✓ NVD

CVSS8.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS3% · P84

ActionPatch immediately

AffectedGovernment Technology

Remediation Steps

Apply the vendor security update for Zyxel GS1900 Smart Managed Switches as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-53266 – Linux Kernel ✓ NVD

CVSS8.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS1% · P56

ActionPatch immediately

AffectedTechnology

Remediation Steps

Apply the vendor security update for Linux Kernel as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-58704 – Google Pixel ✓ NVD

CVSS8.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS1% · P46

ActionPatch immediately

AffectedTechnology Government Defense

Remediation Steps

Apply the vendor security update for Google Android as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-42016 – JFrog Artifactory ✓ NVD

CVSS8.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS9% · P95

ActionPatch immediately

Remediation Steps

Apply vendor security patch for incorrect authorization flaw
Reset credentials for administrative and service accounts post-patch
Review audit logs for unauthorized access or privilege escalation
Restrict Artifactory network access to trusted sources if patching is delayed

References:

🛡️CVE-2026-87491 – Google Chromium V8 ✓ NVD

CVSS8.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS3% · P87

ActionPatch immediately

AffectedTechnology Finance

Remediation Steps

Apply the vendor security update for Google Chromium V8 as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-85046 – Google Chromium V8 ✓ NVD

CVSS8.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS49% · P99

ActionPatch immediately

AffectedTechnology Retail Telecom

Remediation Steps

Apply the vendor security update for Google Chrome as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-67277 – MikroTik RouterOS ✓ NVD

CVSS8.2 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS2% · P74

ActionPatch immediately

Remediation Steps

Consult CISA KEV catalog and vendor advisory for affected product and version
Apply vendor patch to all affected systems
Verify patch deployment across your environment

References:

Editorial integrity

Verified facts (green zone): 40 CVE ID(s) verified verbatim against source articles; 40 published in NVD with full canonical data (vendor, product, CVSS, references); 40 confirmed exploited in CISA KEV.

AI-synthesized content (analyst summary, remediation step phrasing): generated by an AI model from 5 security feeds. Generic remediation guidance (apply patch, restrict network access, monitor logs) is best-practice and trusted; specific vendor steps and version numbers must be verified against the official advisories linked above. Verify before acting in production.

Adjustments before publication: 3 unverified claim(s) stripped or genericized.

Find an error? contact@defend.network

🤖 This vulnerability report was compiled by defend.network using AI-powered analysis of vulnerability databases, vendor advisories, and threat intelligence feeds. Always verify remediation steps through official vendor channels before implementing changes in production environments.