Weekly report · exploited in the wild
Newly exploited vulnerabilities: week of 14 to 20 September 2026 (week 38)
Final report, published . It does not change.
In the week of 14 to 20 September 2026, 7 vulnerabilities were newly recorded as exploited in the wild, 7 of them critical. The technology hit most was Linux Kernel (3), followed by Acronis Backup Extension for Plesk (1) and Acronis Backup Plugin for cPanel & WHM (1).
- Newly exploited
- 7
- Critical
- 7
- Technologies hit
- 11
Newly exploited this week
- CVE-2026-53266: Linux Kernel netfilter improper memory write in ebt_snat ARP rewritecriticalExploited since Published Linux Kernel, Linux Kernel
- CVE-2025-39964: Linux Kernel race condition in af_alg_sendmsgcriticalCVSS 3.3Exploited since Published Linux Kernel, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- CVE-2025-39682: Linux Kernel memory corruption in TLS zero-length record handlingcriticalCVSS 9.8Exploited since Published Linux Kernel, Linux Kernel, Siemens SIMATIC CN 4100
- CVE-2026-87886: Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin…criticalCVSS 7.8Exploited since Published Acronis Backup Extension for Plesk, Acronis Backup Plugin for cPanel & WHM
- CVE-2026-76460: A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to…criticalCVSS 10Exploited since Published Cisco Identity Services Engine, Cisco ISE Passive Identity Connector
- CVE-2026-58704: In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote…criticalCVSS 8.8Exploited since Published Google Android
- CVE-2026-76461: A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an…criticalCVSS 9.8Exploited since Published Cisco Secure Email Gateway
Technologies hit most
- 1.Linux Kernel3 vulnerabilities
- 2.Acronis Backup Extension for Plesk1 vulnerability
- 3.Acronis Backup Plugin for cPanel & WHM1 vulnerability
- 4.Cisco Identity Services Engine1 vulnerability
- 5.Cisco ISE Passive Identity Connector1 vulnerability
- 6.Cisco Secure Email Gateway1 vulnerability
- 7.Google Android1 vulnerability
- 8.Siemens SIMATIC CN 41001 vulnerability
- 9.Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP1 vulnerability
- 10.Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP1 vulnerability
- 11.Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP1 vulnerability
How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
A vulnerability is exploited in the wild when the CISA Known Exploited Vulnerabilities catalogue lists it or a vendor advisory says so. The date it was first recorded as exploited is CISA's date added where it came from the catalogue, else the day Junglewise learned of it.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/exploited/2026-09-14.json, and this page as text at https://junglewise.ai/threats/exploited/2026-09-14.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 14 to 20 September 2026 (week 38)", https://junglewise.ai/threats/exploited/2026-09-14, 2 October 2026.