Welcome to the vFeed September 2026 edition of our Cybersecurity and Vulnerability Newsletter.
vFeed Threat Intelligence Newsletter — September 2026
Key Highlights During the Month
- CVE Volume Surges Past 14K: September 2026 recorded 14,289 new CVEs — up roughly 11% from August’s ~12,900, making it one of the heaviest disclosure months on record. At ~476 CVEs per day, the attack surface continues to expand at an unprecedented pace. Year-to-date, vFeed has correlated 127,451 vulnerabilities across 2026, tracking ~27% ahead of the same period in 2025 (19,662 CVEs recorded in September 2025 YTD comparison baseline reflects accelerated disclosure velocity throughout 2026).
- Critical Vulnerabilities at 1,302: Critical vulnerabilities (CVSS 9.0+) hit 1,302 in September — a sharp uptick driven by Oracle’s quarterly CPU, Adobe’s Campaign Classic cluster, and a wave of vm2 sandbox escapes. The month recorded 90+ perfect 10.0 CVSS scores, spanning Oracle Fusion Middleware takeovers, Cisco ISE pre-auth bypasses, HPE Networking Fabric Composer compromises, and nine vm2 npm sandbox escapes.
- Oracle Fusion Middleware Takeover Wave: Oracle’s September CPU shipped six scope-changing 10.0 CVEs across WebLogic (CVE-2026-83021), Access Manager (CVE-2026-71133), Platform Security for Java (CVE-2026-83020), Internet Directory (CVE-2026-83059), Forms (CVE-2026-83099), and Hyperion Financial Management (CVE-2026-87230) — all unauthenticated, network-reachable, and classified as full product takeover.
- Cisco ISE and HPE Networking Pre-Auth RCE Cluster: Cisco ISE/ISE-PIC was hit by four CVSS 10.0 pre-auth flaws (CVE-2026-20130, CVE-2026-20192, CVE-2026-76423, CVE-2026-76460), while HPE Networking Fabric Composer exposed CVE-2026-76657 and CVE-2026-76658 — both allowing unauthenticated administrative takeover of the orchestration plane.
- GitLab Repository API Exposes Server Files: CVE-2026-85706 (CVSS 10.0, EPSS 99.83th percentile) — an unauthenticated arbitrary file read in GitLab CE/EE’s commits API — was the single highest-EPSS vulnerability of the month, with mass exploitation telemetry climbing within days of disclosure.
Vulnerability Trends in September
| Metric | June ’26 | July ’26 | August ’26 | September ’26 | MoM |
|---|---|---|---|---|---|
| New CVEs | 11,840 | 12,210 | 12,874 | 14,289 | ⬆ 11.0% |
| Modified CVEs | 3,610 | 3,885 | 4,015 | 4,220 | ⬆ 5.1% |
| Critical (CVSS 9.0+) | 1,045 | 1,118 | 1,189 | 1,302 | ⬆ 9.5% |
| Perfect 10.0 scores | 62 | 71 | 78 | 92 | ⬆ 17.9% |
| CVSS4 scores recorded | 2,840 | 3,112 | 3,398 | 3,721 | ⬆ 9.5% |
| EPSS > 50th percentile | 3,105 | 3,240 | 3,418 | 3,702 | ⬆ 8.3% |
September broke three concurrent records: the highest raw CVE volume of 2026, the highest number of perfect-10 CVSS scores, and the first month to exceed 1,300 critical CVEs. The 17.9% jump in perfect-10 scores is primarily attributable to Oracle’s quarterly CPU, the Adobe Campaign Classic code-injection cluster, and the vm2 npm sandbox escape chain (nine 10.0 CVEs in a single advisory batch). CVSS4 adoption continues its steady climb as CNA tooling catches up, while EPSS high-percentile coverage grew in lockstep with real-world exploit publication — particularly across Netcore, D-Link, and Tenda router stacks.
Vulnerability Landscape
vFeed’s threat intelligence dataset now tracks over 165,000 known exploits reported from sources including GitHub, Metasploit, ExploitDB, and PacketStorm. In September, approximately 1,870 unique CVEs out of 14,289 (~13.1%) were published with one or more exploit proof-of-concepts available.
The top exploit sources for September:
| Exploit Source | Unique CVEs Covered |
|---|---|
| ExploitDB | 412 |
| GitHub PoC | 1,284 |
| Metasploit | 47 |
| Talos | 68 |
| Saint | 59 |
GitHub PoC repositories again dominated the exploit surface, driven by a flood of IoT router advisories (Netcore NR289-GE, Tenda CP3, D-Link DWR-M921/DIR-895L, Totolink A3002MU) where researchers routinely publish working command-injection proofs alongside the CVE. The vm2 sandbox escape cluster alone produced nine high-quality public PoCs within days of disclosure, and GitLab CVE-2026-85706 reached weaponized status with an EPSS percentile of 99.83 — the highest of the month.
September Patch Tuesday (September 9) addressed a broad set of DHCP, Kerberos, LDAP, and SMB denial-of-service primitives alongside several critical Azure/Microsoft 365 service-side flaws disclosed via NVD out-of-band.
- CVE-2026-70352 (CVSS 10.0) — Azure AI Language: missing authentication for critical function, unauthenticated privilege elevation over the network.
- CVE-2026-80098 (CVSS 10.0) — Copilot Studio: improper cryptographic signature verification allowing network-based privilege escalation.
- CVE-2026-83711 (CVSS 10.0) — Azure AD B2C: authorization bypass via user-controlled key.
- CVE-2026-69865 (CVSS 10.0) — Microsoft Container Registry: authorization bypass through user-controlled key.
- CVE-2026-69843 (CVSS 10.0) — Microsoft Fabric: authentication bypass by spoofing.
- CVE-2026-62874 (CVSS 10.0) — Azure Billing: insufficient data authenticity verification enabling network privilege escalation.
- CVE-2026-77484 / CVE-2026-65772 — SQL Server and Dynamics 365 deserialization-of-untrusted-data RCE (CVSS 8.8).
- A cluster of 25+ Windows DHCP, Kerberos, DNS, and SMB denial-of-service CVEs (CVSS 7.5) addressing out-of-bounds reads, null pointer dereferences, and type confusion in network-exposed services.
Linux Kernel
vFeed tracked 438 Linux kernel CVEs in September. The following upstream-coordinated vulnerabilities stood out this month:
| Name | CVE | Subsystem | Type | Key Risk |
|---|---|---|---|---|
| yast2-users shadow injection | CVE-2026-59680 | yast2-users (SUSE) | OS Command Injection | Root RCE triggered simply by viewing an LDAP user’s “Password Settings” tab |
| yast2-auth-client AD-join RCE | CVE-2026-59681 | yast2-auth-client | OS Command Injection | Root command execution via unescaped AD join parameters |
| log4j hotpatch newline injection | CVE-2026-85656 | Amazon Linux log4j-hotpatch | OS Command Injection | Local root via embedded newlines in Java executable paths |
| Monkey HTTP server NULL deref | CVE-2026-38999 | Monkey HTTP | NULL Pointer Deref | Remote DoS via crafted HTTP request |
| rpm tarball metacharacter injection | CVE-2026-84837 | rpmbuild | Command Injection | Build-user RCE via externally supplied artifact names in CI pipelines |
The yast2 cluster is especially notable: an admin merely browsing an Active Directory-federated user triggers unauthenticated root execution — a textbook example of command-injection via Ruby backticks on operator-controlled strings. The rpm rpmbuild -t* flaw deserves attention from CI/CD teams that ingest externally supplied source tarballs.
WordPress — Authentication Bypass Dominates
284 CVEs in September, with 176 carrying known exploits — an exploit-to-disclosure ratio of ~62%. Critical highlights:
- CVE-2026-80099 (CVSS 8.8, EPSS 86.5th) — Multiple Newfold-bundled plugins (Bluehost, Hostgator, Web, Crazy Domains) ship a broken HMAC token comparison that collapses the salt to a public constant, allowing unauthenticated attackers to forge admin tokens and achieve full site takeover.
- CVE-2026-87902 (CVSS 8.1, EPSS 98.78th) — WordPress plugin arbitrary local
.phpinclude viaget_page_template(). - CVE-2026-84434 (CVSS 9.8, EPSS 89.99th) — Gravity Forms ≤3.1.0.4: unauthenticated arbitrary file upload via hidden file-upload fields bypassing extension validation.
- CVE-2026-14560 (CVSS 10.0) — teddy-bear-customize-addon: unauthenticated PHP upload and RCE.
- CVE-2026-4357 (CVSS 10.0) — Embed HTML5 Game plugin: unauthenticated PHP backdoor upload.
- CVE-2026-77770 (CVSS 10.0) — miniOrange 2FA: unauthenticated deletion of arbitrary site options, locking all administrators out of the dashboard.
- CVE-2026-83627 (CVSS 9.8) — Hummingbird caching plugin: unauthenticated RCE via a web-accessible debug log that fails to receive its PHP
die()header due to an unqualifiedclass_exists()check. - CVE-2026-78006 / CVE-2026-78159 (CVSS 9.8) — The Events Calendar: unauthenticated RCE via block-rendering of attacker-submitted comment content.
Cloud Vulnerabilities and Attack Chains
vFeed tracked 147 cloud-specific CVEs in September across Azure, AWS, GCP, Kubernetes, and container technologies. Notable disclosures:
- CVE-2026-70352 (Azure AI Language, 10.0) — missing auth on a critical API function.
- CVE-2026-80098 (Copilot Studio, 10.0) — improper signature verification.
- CVE-2026-83711 (Azure AD B2C, 10.0) — user-controlled key authorization bypass.
- CVE-2026-69865 (Microsoft Container Registry, 10.0) — authorization bypass over the network.
- CVE-2026-62874 (Azure Billing, 10.0) — data-authenticity bypass enabling privilege escalation.
- CVE-2026-85012 (AWS CodeCatalyst Blueprints, 8.0) — OS command injection via unquoted
[local] merge strategyowner field in.ownership-file; service-side already mitigated, but self-hosted blueprint pipelines must upgrade to ≥0.3.156. - CVE-2026-87911 (AWS Labs postgres-mcp-server, 9.6) — unauthenticated command execution via
COPY ... TO PROGRAMreaching the host of self-managed PostgreSQL servers through an MCP integration. - CVE-2026-86708 (ManageEngine Applications Manager, 10.0) — a Google Cloud service-account private key embedded in the installer, allowing unauthenticated impersonation of the service account.
- CVE-2026-80462 (Chef Automate, 10.0) — API gateway identity-validation bypass granting elevated access.
- CVE-2026-93952 (VMware VeloCloud Orchestrator, 10.0) — remote access to privileged internal functionality on on-prem VCO deployments.
The dominant attack-chain pattern this month is AI/MCP integration abuse: Azure AI Language, Copilot Studio, MaxKB (CVE-2026-77521), MCP Atlassian (CVE-2026-77244), MCP Context Forge (CVE-2026-53710), MySQL MCP Server (CVE-2026-59971), and MCP Gitlab (CVE-2026-61560) all shipped unauthenticated or weakly authenticated tool-execution surfaces. The common root cause is MCP servers binding to 0.0.0.0 without authentication and exposing shell-execution tools without approval gates — a design pattern that is rapidly becoming the new “exposed Elasticsearch” of 2026.
Top Weaknesses
Overall — All September CVEs
| CWE | Weakness | Count | % of Total |
|---|---|---|---|
| CWE-79 | Cross-site Scripting | 1,412 | 9.9% |
| CWE-89 | SQL Injection | 942 | 6.6% |
| CWE-78 | OS Command Injection | 878 | 6.1% |
| CWE-787 | Out-of-bounds Write | 721 | 5.0% |
| CWE-20 | Improper Input Validation | 684 | 4.8% |
| CWE-125 | Out-of-bounds Read | 591 | 4.1% |
| CWE-352 | Cross-Site Request Forgery | 487 | 3.4% |
| CWE-434 | Unrestricted File Upload | 441 | 3.1% |
| CWE-287 | Improper Authentication | 418 | 2.9% |
| CWE-22 | Path Traversal | 402 | 2.8% |
Critical Only (CVSS 9.0+)
| CWE | Weakness | Critical Count |
|---|---|---|
| CWE-78 | OS Command Injection | 231 |
| CWE-287 | Improper Authentication | 148 |
| CWE-94 | Code Injection | 112 |
| CWE-502 | Deserialization of Untrusted Data | 97 |
| CWE-434 | Unrestricted File Upload | 86 |
| CWE-306 | Missing Authentication for Critical Function | 74 |
| CWE-863 | Incorrect Authorization | 68 |
| CWE-77 | Command Injection | 61 |
| CWE-787 | Out-of-bounds Write | 54 |
| CWE-918 | Server-Side Request Forgery | 42 |
OS Command Injection remains the dominant critical-severity weakness, fueled by the Netcore, D-Link, Tenda, and Totolink router disclosure clusters. The second-tier story is the rise of CWE-306 (Missing Authentication for Critical Function) and CWE-863 (Incorrect Authorization) into the critical top-10 — reflecting the MCP/AI-gateway disclosure wave, Azure/Copilot service-side bugs, and the ongoing collapse of trust boundaries in orchestration planes like Cisco ISE and HPE Fabric Composer.
Hardware / IoT / Firmware
vFeed tracked 1,124 hardware, IoT, and firmware CVEs in September. Standout entries:
- CVE-2026-80155 (Lantronix SLC8000/SLC9000/EMG, 10.0) — unauthenticated path-traversal + session-cookie truncation bypass yielding RCE on serial-console servers.
- CVE-2026-88773 / CVE-2026-88772 / CVE-2026-88771 (Citrix NetScaler ADC/Gateway, 8.1–9.8) — HTTP request smuggling and unauthenticated RCE across 13.1 and 14.1 trains; patch immediately.
- CVE-2026-85103 (Check Point Quantum Security Gateway, 9.8, EPSS 89.3th) — heap overflow in VPN certificate ASN.1 decoding.
- CVE-2026-85102 (Check Point Quantum Security Gateway, 9.8, EPSS 94.4th) — improper certificate trust validation during VPN negotiation allowing unauthenticated RCE.
- CVE-2026-73453 / CVE-2026-73456 (Arista EOS P4Runtime / gNPSI, 10.0) — unauthenticated RCE on affected switches when the respective services are enabled.
- CVE-2026-86060 / CVE-2026-67276 / CVE-2026-67277 (MikroTik RouterOS, 8.1–9.8) — SSH policy-mask bypass, RSA exponent-one signature forgery, and btest kernel memory disclosure/crash.
- CVE-2026-86296 (D-Link DIR-822A, 10.0) — stack-based buffer overflow in udhcpcd, publicly exploited.
- CVE-2026-94127 (F5 BIG-IP APM OAuth Authorization Server, 9.8) — unauthenticated RCE in Appliance Mode when APM is configured as OAuth AS.
Enterprise network edge gear — Citrix, Check Point, F5, Arista, and MikroTik — accounted for the majority of the “pre-auth RCE on the gateway” surface this month. Combined with the Lantronix serial-console RCE and the deluge of consumer router command-injections (Netcore, D-Link, Tenda, Totolink, Comfast, Gigatech, FAST, Ziroom), September looks less like a vendor cluster and more like a sustained assault on the entire network-infrastructure layer.
Critical Exploitable Vulnerabilities — September 2026
Pay attention to these critical vulnerabilities with known exploits and high EPSS scores.
| CVE | Target | CVSS | EPSS %ile | Exploit | CWE |
|---|---|---|---|---|---|
| CVE-2026-85706 | GitLab CE/EE repository commits API | 10.0 | 99.83 | PoC public | CWE-22/287 |
| CVE-2026-85046 | Google Chrome V8 (type confusion) | 8.8 | 98.85 | PoC public | CWE-843 |
| CVE-2026-87902 | WordPress get_page_template LFI → RCE | 8.1 | 98.78 | PoC public | CWE-98 |
| CVE-2026-76461 | Cisco Secure Email Gateway (AsyncOS) RCE | 9.8 | 98.07 | PoC public | CWE-78 |
| CVE-2026-93616 | Check Point Management Server upload | 9.8 | 97.33 | PoC public | CWE-22/434 |
| CVE-2026-76460 | Cisco ISE API auth bypass | 10.0 | 96.46 | PoC public | CWE-287 |
| CVE-2026-86218 | N-central pre-auth RCE | 9.8 | 96.21 | PoC public | CWE-306 |
| CVE-2026-83548 | SonicWall SMA1000 SSRF (pre-auth) | 10.0 | 95.03 | PoC public | CWE-918 |
| CVE-2026-85102 | Check Point Quantum Gateway cert validation RCE | 9.8 | 94.35 | PoC public | CWE-295 |
| CVE-2026-85103 | Check Point Quantum heap overflow in ASN.1 | 9.8 | 89.28 | PoC public | CWE-122 |
| CVE-2026-74849 | ManageEngine ADSelfService Plus GINA RCE | 9.8 | 91.41 | PoC public | CWE-306 |
| CVE-2026-80099 | Newfold / Bluehost / Hostgator auth bypass | 8.8 | 86.55 | PoC public | CWE-287 |
Actionable Recommendations
1. Patch Oracle Fusion Middleware and GitLab immediately. Oracle’s September CPU includes six scope-changing 10.0 CVEs (CVE-2026-71133, CVE-2026-83020, CVE-2026-83021, CVE-2026-83059, CVE-2026-83099, CVE-2026-87230) that take over WebLogic, Access Manager, Internet Directory, Forms, Platform Security for Java, and Hyperion Financial Management with no authentication. CVE-2026-85706 (GitLab) sits at the top of September’s EPSS leaderboard at the 99.83rd percentile — if your GitLab instance is internet-exposed and not on 18.11.12 / 19.0.9 / 19.1.8 / 19.2.6 / 19.3.2, assume compromise and investigate.
2. Audit all MCP and AI-gateway deployments for unauthenticated tool execution. September disclosed at least seven distinct MCP-related critical vulnerabilities (CVE-2026-59971, CVE-2026-53710, CVE-2026-77244, CVE-2026-61560, CVE-2026-77521, CVE-2026-61732, CVE-2026-87911). Inventory every MCP server, SSE endpoint, and AI gateway in your environment; confirm each binds to localhost or an authenticated network path, enforces per-request identity, and gates execute-class tools behind human approval. Microsoft’s Azure AI Language (CVE-2026-70352) and Copilot Studio (CVE-2026-80098) prove this surface is exposed in managed services too — review Azure RBAC on AI resources.
3. Prioritize network-edge gateway patching. Patch Cisco ISE/ISE-PIC (CVE-2026-20130, CVE-2026-20192, CVE-2026-76423, CVE-2026-76460), HPE Networking Fabric Composer (CVE-2026-76657, CVE-2026-76658), Citrix NetScaler ADC/Gateway (CVE-2026-88771/88772/88773), Check Point Quantum (CVE-2026-85102/85103), and F5 BIG-IP APM (CVE-2026-94127) within your emergency change window. All are pre-auth or near-pre-auth RCE on the perimeter — the same class of vulnerability behind every major breach of 2024–2026.
4. Freeze vm2 and migrate off it. Nine 10.0 sandbox-escape CVEs (CVE-2026-92937
May you live in interesting times!