{"schema_version":1,"title":"Newly exploited vulnerabilities: week of 14 to 20 September 2026 (week 38)","summary":"In the week of 14 to 20 September 2026, 7 vulnerabilities were newly recorded as exploited in the wild, 7 of them critical. The technology hit most was Linux Kernel (3), followed by Acronis Backup Extension for Plesk (1) and Acronis Backup Plugin for cPanel & WHM (1).","url":"https://junglewise.ai/threats/exploited/2026-09-14","json_url":"https://junglewise.ai/threats/exploited/2026-09-14.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/exploited/2026-09-14","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","method":"A vulnerability is exploited in the wild when the CISA Known Exploited Vulnerabilities catalogue lists it or a vendor advisory says so; exploited_since is CISA's date added where it came from the catalogue, else the day Junglewise learned of it.","kind":"exploited_week","total":7,"period":{"end":"2026-09-20","start":"2026-09-14"},"critical":7,"generated_at":"2026-10-02T19:23:09.012711+00:00","technologies":[{"hub":true,"name":"Linux Kernel","slug":"kernel","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/kernel"},{"hub":false,"name":"Acronis Backup Extension for Plesk","slug":"backup-extension-for-plesk","vulnerabilities":1},{"hub":false,"name":"Acronis Backup Plugin for cPanel & WHM","slug":"backup-plugin-for-cpanel-whm","vulnerabilities":1},{"hub":true,"name":"Cisco Identity Services Engine","slug":"identity-services-engine","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/identity-services-engine"},{"hub":true,"name":"Cisco ISE Passive Identity Connector","slug":"ise-passive-identity-connector","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/ise-passive-identity-connector"},{"hub":true,"name":"Cisco Secure Email Gateway","slug":"secure-email-gateway","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/secure-email-gateway"},{"hub":true,"name":"Google Android","slug":"android","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/android"},{"hub":true,"name":"Siemens SIMATIC CN 4100","slug":"simatic-cn-4100","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/simatic-cn-4100"},{"hub":true,"name":"Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","slug":"simatic-s7-1500-cpu-1518-4-pn-dp-mfp","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/simatic-s7-1500-cpu-1518-4-pn-dp-mfp"},{"hub":true,"name":"Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","slug":"simatic-s7-1500-cpu-1518f-4-pn-dp-mfp","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/simatic-s7-1500-cpu-1518f-4-pn-dp-mfp"},{"hub":true,"name":"Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","slug":"siplus-s7-1500-cpu-1518-4-pn-dp-mfp","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/siplus-s7-1500-cpu-1518-4-pn-dp-mfp"}],"vulnerabilities":[{"cve":"CVE-2026-53266","epss":0.0065,"slug":"cve-2026-53266-linux-kernel-netfilter-improper-memory-write-in-ebt-snat-arp","title":"Linux Kernel netfilter improper memory write in ebt_snat ARP rewrite","severity":"critical","exploited":true,"published_at":"2026-06-25T09:16:44.643+00:00","technologies":[{"hub":true,"name":"Linux Kernel","slug":"kernel","vendor":{"name":"Linux","slug":"linux"}},{"hub":true,"name":"Linux Kernel","slug":"kernel","vendor":{"name":"Linux","slug":"linux"}}],"exploited_since":"2026-09-18T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-53266-linux-kernel-netfilter-improper-memory-write-in-ebt-snat-arp"},{"cve":"CVE-2025-39964","cvss":3.3,"epss":0.01,"slug":"cve-2025-39964-linux-kernel-race-condition-in-af-alg-sendmsg","title":"Linux Kernel race condition in af_alg_sendmsg","severity":"critical","exploited":true,"published_at":"2025-10-13T14:15:34.737+00:00","technologies":[{"hub":true,"name":"Linux Kernel","slug":"kernel","vendor":{"name":"Linux","slug":"linux"}},{"hub":true,"name":"Linux Kernel","slug":"kernel","vendor":{"name":"Linux","slug":"linux"}},{"hub":true,"name":"Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","slug":"simatic-s7-1500-cpu-1518-4-pn-dp-mfp","vendor":{"name":"Siemens","slug":"siemens"}},{"hub":true,"name":"Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","slug":"simatic-s7-1500-cpu-1518f-4-pn-dp-mfp","vendor":{"name":"Siemens","slug":"siemens"}},{"hub":true,"name":"Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","slug":"siplus-s7-1500-cpu-1518-4-pn-dp-mfp","vendor":{"name":"Siemens","slug":"siemens"}}],"exploited_since":"2026-09-18T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2025-39964-linux-kernel-race-condition-in-af-alg-sendmsg"},{"cve":"CVE-2025-39682","cvss":9.8,"epss":0.0288,"slug":"cve-2025-39682-linux-kernel-memory-corruption-in-tls-zero-length-record-handling","title":"Linux Kernel memory corruption in TLS zero-length record handling","severity":"critical","exploited":true,"published_at":"2025-09-05T18:15:44.67+00:00","technologies":[{"hub":true,"name":"Linux Kernel","slug":"kernel","vendor":{"name":"Linux","slug":"linux"}},{"hub":true,"name":"Linux Kernel","slug":"kernel","vendor":{"name":"Linux","slug":"linux"}},{"hub":true,"name":"Siemens SIMATIC CN 4100","slug":"simatic-cn-4100","vendor":{"name":"Siemens","slug":"siemens"}}],"exploited_since":"2026-09-18T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2025-39682-linux-kernel-memory-corruption-in-tls-zero-length-record-handling"},{"cve":"CVE-2026-87886","cvss":7.8,"epss":0.0023,"slug":"cve-2026-87886-acronis-backup-privilege-escalation-in-cpanel-whm-and-plesk","title":"Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Li","severity":"critical","exploited":true,"published_at":"2026-09-17T23:18:53.763+00:00","technologies":[{"hub":false,"name":"Acronis Backup Extension for Plesk","slug":"backup-extension-for-plesk","vendor":{"name":"Acronis","slug":"acronis"}},{"hub":false,"name":"Acronis Backup Plugin for cPanel & WHM","slug":"backup-plugin-for-cpanel-whm","vendor":{"name":"Acronis","slug":"acronis"}}],"exploited_since":"2026-09-16T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-87886-acronis-backup-privilege-escalation-in-cpanel-whm-and-plesk"},{"cve":"CVE-2026-76460","cvss":10,"epss":0.1403,"slug":"cve-2026-76460-cisco-identity-services-engine-incorrect-privileged-api-use","title":"A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication.","severity":"critical","exploited":true,"published_at":"2026-09-16T21:17:21.43+00:00","technologies":[{"hub":true,"name":"Cisco Identity Services Engine","slug":"identity-services-engine","vendor":{"name":"Cisco","slug":"cisco"}},{"hub":true,"name":"Cisco ISE Passive Identity Connector","slug":"ise-passive-identity-connector","vendor":{"name":"Cisco","slug":"cisco"}}],"exploited_since":"2026-09-16T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-76460-cisco-identity-services-engine-incorrect-privileged-api-use"},{"cve":"CVE-2026-58704","cvss":8.8,"epss":0.0059,"slug":"cve-2026-58704-google-pixel-improper-authorization-in-cellular-modem","title":"In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) esc","severity":"critical","exploited":true,"published_at":"2026-09-15T19:17:32.297+00:00","technologies":[{"hub":true,"name":"Google Android","slug":"android","vendor":{"name":"Google","slug":"google"}}],"exploited_since":"2026-09-16T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-58704-google-pixel-improper-authorization-in-cellular-modem"},{"cve":"CVE-2026-76461","cvss":9.8,"epss":0.2827,"slug":"cve-2026-76461-cisco-secure-email-gateway-sql-injection","title":"A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacke","severity":"critical","exploited":true,"published_at":"2026-09-14T17:17:51.113+00:00","technologies":[{"hub":true,"name":"Cisco Secure Email Gateway","slug":"secure-email-gateway","vendor":{"name":"Cisco","slug":"cisco"}}],"exploited_since":"2026-09-14T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-76461-cisco-secure-email-gateway-sql-injection"}],"previous":{"key":"2026-09-07","top":"JFrog Artifactory","total":14,"period":{"end":"2026-09-13","start":"2026-09-07"},"critical":14,"url":"https://junglewise.ai/threats/exploited/2026-09-07"},"next":{"key":"2026-09-21","top":"Citrix NetScaler","total":12,"period":{"end":"2026-09-27","start":"2026-09-21"},"critical":12,"url":"https://junglewise.ai/threats/exploited/2026-09-21"}}