# Newly exploited vulnerabilities: week of 14 to 20 September 2026 (week 38)

Source: https://junglewise.ai/threats/exploited/2026-09-14  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2 October 2026, 19:23 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/exploited/2026-09-14.json  
License: CC BY 4.0 with a link back

In the week of 14 to 20 September 2026, 7 vulnerabilities were newly recorded as exploited in the wild, 7 of them critical. The technology hit most was Linux Kernel (3), followed by Acronis Backup Extension for Plesk (1) and Acronis Backup Plugin for cPanel & WHM (1).

## Newly exploited this week

- [CVE-2026-53266: Linux Kernel netfilter improper memory write in ebt_snat ARP rewrite](https://junglewise.ai/threats/cve-2026-53266-linux-kernel-netfilter-improper-memory-write-in-ebt-snat-arp) (critical, exploited in the wild, exploited since 18 Sep 2026, published 25 Jun 2026)
- [CVE-2025-39964: Linux Kernel race condition in af_alg_sendmsg](https://junglewise.ai/threats/cve-2025-39964-linux-kernel-race-condition-in-af-alg-sendmsg) (critical, exploited in the wild, CVSS 3.3, exploited since 18 Sep 2026, published 13 Oct 2025)
- [CVE-2025-39682: Linux Kernel memory corruption in TLS zero-length record handling](https://junglewise.ai/threats/cve-2025-39682-linux-kernel-memory-corruption-in-tls-zero-length-record-handling) (critical, exploited in the wild, CVSS 9.8, exploited since 18 Sep 2026, published 5 Sep 2025)
- [CVE-2026-87886: Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin…](https://junglewise.ai/threats/cve-2026-87886-acronis-backup-privilege-escalation-in-cpanel-whm-and-plesk) (critical, exploited in the wild, CVSS 7.8, exploited since 16 Sep 2026, published 17 Sep 2026)
- [CVE-2026-76460: A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to…](https://junglewise.ai/threats/cve-2026-76460-cisco-identity-services-engine-incorrect-privileged-api-use) (critical, exploited in the wild, CVSS 10, exploited since 16 Sep 2026, published 16 Sep 2026)
- [CVE-2026-58704: In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote…](https://junglewise.ai/threats/cve-2026-58704-google-pixel-improper-authorization-in-cellular-modem) (critical, exploited in the wild, CVSS 8.8, exploited since 16 Sep 2026, published 15 Sep 2026)
- [CVE-2026-76461: A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an…](https://junglewise.ai/threats/cve-2026-76461-cisco-secure-email-gateway-sql-injection) (critical, exploited in the wild, CVSS 9.8, exploited since 14 Sep 2026, published 14 Sep 2026)

## Technologies hit most

1. [Linux Kernel](https://junglewise.ai/threats/technologies/kernel): 3 vulnerabilities
2. Acronis Backup Extension for Plesk: 1 vulnerability
3. Acronis Backup Plugin for cPanel & WHM: 1 vulnerability
4. [Cisco Identity Services Engine](https://junglewise.ai/threats/technologies/identity-services-engine): 1 vulnerability
5. [Cisco ISE Passive Identity Connector](https://junglewise.ai/threats/technologies/ise-passive-identity-connector): 1 vulnerability
6. [Cisco Secure Email Gateway](https://junglewise.ai/threats/technologies/secure-email-gateway): 1 vulnerability
7. [Google Android](https://junglewise.ai/threats/technologies/android): 1 vulnerability
8. [Siemens SIMATIC CN 4100](https://junglewise.ai/threats/technologies/simatic-cn-4100): 1 vulnerability
9. [Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP](https://junglewise.ai/threats/technologies/simatic-s7-1500-cpu-1518-4-pn-dp-mfp): 1 vulnerability
10. [Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP](https://junglewise.ai/threats/technologies/simatic-s7-1500-cpu-1518f-4-pn-dp-mfp): 1 vulnerability
11. [Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP](https://junglewise.ai/threats/technologies/siplus-s7-1500-cpu-1518-4-pn-dp-mfp): 1 vulnerability

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 14 to 20 September 2026 (week 38)", https://junglewise.ai/threats/exploited/2026-09-14, 2 October 2026.