Week 39, 2026

21 September to 27 September 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.

CVEs published: 2,836
Critical: 243
High: 1,033
Added to KEV: 12

Critical 243High 1,033Medium 1,055Low 102Not scored 403All 2,836 in the list

Added to KEVAttackers use these now; patch them first

CVE-2026-88772
Memory overflow vulnerability leading to Remote Code Execution or Denial of Service
Citrix NetScaler · ADC
ExploitedCritical9.5
CVE-2026-88771
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
Citrix NetScaler · ADC
ExploitedCritical9.5
CVE-2026-65660
Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft · Microsoft SharePoint Enterprise Server 2016
ExploitedHigh8.8
CVE-2026-87902
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme…
WordPress · WordPress
ExploitedHigh8.1
CVE-2026-67279
SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS
Mikrotik · RouterOS
ExploitedMedium6.9
CVE-2026-5430
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
WSO2 · WSO2 Universal Gateway
ExploitedCritical10.0
CVE-2026-71362
Adobe Commerce | Incorrect Authorization (CWE-863)
Adobe · Adobe Commerce
ExploitedCritical9.1
CVE-2026-93616
Directory Traversal and File upload allows execution of arbitrary script on the Management Server
checkpoint · Quantum Security Management
ExploitedCritical9.8
CVE-2026-85102
Improper Certificate Validation in Quantum Security Gateway
checkpoint · Quantum Security Gateway
ExploitedCritical9.8
CVE-2026-93952
Security Advisory 0183
Arista Networks · VeloCloud Orchestrator (VCO) On-Prem
ExploitedCritical9.5
CVE-2026-94127
BIG-IP APM OAuth vulnerability
F5 · BIG-IP
ExploitedCritical9.3
CVE-2026-7273
A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based,…
Zyxel · GS1900-48HPv2 firmware
ExploitedHigh8.8

Most severe new CVEsBy CVSS score

CVE-2026-97359
HFS2 2.4.0 RCE via Multipart Upload Filename Template Injection
rejetto · hfs2
Critical10.0
CVE-2026-86708
Sensitive data exposure
Zohocorp · ManageEngine Applications Manager
Critical10.0
CVE-2026-61732
Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
BitterSecurity · Decepticon
Critical10.0
CVE-2026-75703
Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)
Adobe · Adobe Campaign Classic
Critical10.0
CVE-2026-84412
Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)
Adobe · Adobe Campaign Classic
Critical10.0
CVE-2026-75721
Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)
Adobe · Adobe Campaign Classic
Critical10.0
CVE-2026-75699
Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)
Adobe · Adobe Campaign Classic
Critical10.0
CVE-2026-73369
Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)
Adobe · Adobe Campaign Classic
Critical10.0
CVE-2026-89275
Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)
Adobe · Adobe Campaign Classic
Critical10.0
CVE-2026-100382
Unauthenticated remote code execution through wikitext in ExternalData
Wikimedia Foundation · Mediawiki - ExternalData Extension
Critical10.0

Week 39, 2026

Added to KEVAttackers use these now; patch them first

Most severe new CVEsBy CVSS score

Vendors with the most CVEs

Most common weaknesses