{"schema_version":1,"title":"Newly exploited vulnerabilities: week of 21 to 27 September 2026 (week 39)","summary":"In the week of 21 to 27 September 2026, 12 vulnerabilities were newly recorded as exploited in the wild, 12 of them critical. The technology hit most was Citrix NetScaler (2), followed by Citrix NetScaler ADC (2) and Citrix NetScaler Gateway (2).","url":"https://junglewise.ai/threats/exploited/2026-09-21","json_url":"https://junglewise.ai/threats/exploited/2026-09-21.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/exploited/2026-09-21","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","method":"A vulnerability is exploited in the wild when the CISA Known Exploited Vulnerabilities catalogue lists it or a vendor advisory says so; exploited_since is CISA's date added where it came from the catalogue, else the day Junglewise learned of it.","kind":"exploited_week","total":12,"period":{"end":"2026-09-27","start":"2026-09-21"},"critical":12,"generated_at":"2026-10-02T19:23:09.012711+00:00","technologies":[{"hub":true,"name":"Citrix NetScaler","slug":"netscaler","vulnerabilities":2,"url":"https://junglewise.ai/threats/technologies/netscaler"},{"hub":true,"name":"Citrix NetScaler ADC","slug":"netscaler-adc","vulnerabilities":2,"url":"https://junglewise.ai/threats/technologies/netscaler-adc"},{"hub":true,"name":"Citrix NetScaler Gateway","slug":"gateway","vulnerabilities":2,"url":"https://junglewise.ai/threats/technologies/gateway"},{"hub":true,"name":"Adobe Commerce","slug":"commerce","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/commerce"},{"hub":true,"name":"Adobe Magento","slug":"magento","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/magento"},{"hub":true,"name":"Adobe Magento Enterprise Edition","slug":"magento-enterprise-edition","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/magento-enterprise-edition"},{"hub":false,"name":"Check Point Log Server","slug":"log-server","vulnerabilities":1},{"hub":false,"name":"Check Point Multi-Domain Log Server","slug":"multi-domain-log-server","vulnerabilities":1},{"hub":false,"name":"Check Point Multi-Domain Security Management Server","slug":"multi-domain-security-management-server","vulnerabilities":1},{"hub":true,"name":"Check Point Security Gateway","slug":"security-gateway","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/security-gateway"},{"hub":false,"name":"Check Point Security Management Server","slug":"security-management-server","vulnerabilities":1},{"hub":false,"name":"Check Point SmartEvent","slug":"smartevent","vulnerabilities":1},{"hub":false,"name":"Check Point Spark Firewall","slug":"spark-firewall","vulnerabilities":1},{"hub":true,"name":"F5 BIG-IP APM","slug":"big-ip-apm","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/big-ip-apm"},{"hub":true,"name":"Microsoft SharePoint","slug":"sharepoint","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/sharepoint"}],"vulnerabilities":[{"cve":"CVE-2026-88772","slug":"cve-2026-88772-vulnerability-in-citrix-netscaler-adc-and-citrix-netscaler","title":"Citrix NetScaler ADC and Gateway remote code execution and denial of service","severity":"critical","exploited":true,"published_at":"2026-09-27T17:16:56.39+00:00","technologies":[{"hub":true,"name":"Citrix NetScaler","slug":"netscaler","vendor":{"name":"Citrix","slug":"citrix"}},{"hub":true,"name":"Citrix NetScaler ADC","slug":"netscaler-adc","vendor":{"name":"Citrix","slug":"citrix"}},{"hub":true,"name":"Citrix NetScaler Gateway","slug":"gateway","vendor":{"name":"Citrix","slug":"citrix"}}],"exploited_since":"2026-09-27T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-88772-vulnerability-in-citrix-netscaler-adc-and-citrix-netscaler"},{"cve":"CVE-2026-88771","slug":"cve-2026-88771-improper-input-validation-vulnerability-in-citrix-netscaler-adc","title":"Citrix NetScaler ADC and Gateway improper input validation","severity":"critical","exploited":true,"published_at":"2026-09-27T17:16:56.26+00:00","technologies":[{"hub":true,"name":"Citrix NetScaler","slug":"netscaler","vendor":{"name":"Citrix","slug":"citrix"}},{"hub":true,"name":"Citrix NetScaler ADC","slug":"netscaler-adc","vendor":{"name":"Citrix","slug":"citrix"}},{"hub":true,"name":"Citrix NetScaler Gateway","slug":"gateway","vendor":{"name":"Citrix","slug":"citrix"}}],"exploited_since":"2026-09-27T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-88771-improper-input-validation-vulnerability-in-citrix-netscaler-adc"},{"cve":"CVE-2026-87902","cvss":8.1,"epss":0.0288,"slug":"cve-2026-87902-wordpress-core-remote-file-inclusion","title":"An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the","severity":"critical","exploited":true,"published_at":"2026-09-22T17:17:28.31+00:00","technologies":[{"hub":true,"name":"Wordpress","slug":"wordpress","vendor":{"name":"Wordpress","slug":"wordpress"}}],"exploited_since":"2026-09-25T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-87902-wordpress-core-remote-file-inclusion"},{"cve":"CVE-2026-67279","cvss":6.5,"epss":0.0071,"slug":"cve-2026-67279-mikrotik-routeros-improper-behavioral-workflow-enforcement","title":"RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an","severity":"critical","exploited":true,"published_at":"2026-09-05T20:17:18.39+00:00","technologies":[{"hub":true,"name":"MikroTik RouterOS","slug":"routeros","vendor":{"name":"MikroTik","slug":"mikrotik"}}],"exploited_since":"2026-09-25T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-67279-mikrotik-routeros-improper-behavioral-workflow-enforcement"},{"cve":"CVE-2026-65660","cvss":8.8,"epss":0.0122,"slug":"cve-2026-65660-microsoft-sharepoint-code-injection","title":"Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over","severity":"critical","exploited":true,"published_at":"2026-08-11T17:18:54.08+00:00","technologies":[{"hub":true,"name":"Microsoft SharePoint","slug":"sharepoint","vendor":{"name":"Microsoft","slug":"microsoft"}}],"exploited_since":"2026-09-25T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-65660-microsoft-sharepoint-code-injection"},{"cve":"CVE-2026-71362","cvss":9.1,"epss":0.8962,"slug":"cve-2026-71362-adobe-commerce-and-magento-incorrect-authorization","title":"Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage","severity":"critical","exploited":true,"published_at":"2026-08-11T18:18:21.61+00:00","technologies":[{"hub":true,"name":"Adobe Commerce","slug":"commerce","vendor":{"name":"Adobe","slug":"adobe"}},{"hub":true,"name":"Adobe Magento","slug":"magento","vendor":{"name":"Adobe","slug":"adobe"}},{"hub":true,"name":"Adobe Magento Enterprise Edition","slug":"magento-enterprise-edition","vendor":{"name":"Adobe","slug":"adobe"}}],"exploited_since":"2026-09-24T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-71362-adobe-commerce-and-magento-incorrect-authorization"},{"cve":"CVE-2026-5430","cvss":10,"epss":0.0058,"slug":"cve-2026-5430-wso2-api-control-plane-path-traversal-vulnerability","title":"The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an a","severity":"critical","exploited":true,"published_at":"2026-08-06T08:16:33.24+00:00","technologies":[{"hub":true,"name":"Wso2 API Control Plane","slug":"api-control-plane","vendor":{"name":"Wso2","slug":"wso2"}},{"hub":true,"name":"Wso2 API Manager","slug":"api-manager","vendor":{"name":"Wso2","slug":"wso2"}},{"hub":false,"name":"Wso2 API Microgateway","slug":"api-microgateway","vendor":{"name":"Wso2","slug":"wso2"}},{"hub":true,"name":"Wso2 Enterprise Integrator","slug":"enterprise-integrator","vendor":{"name":"Wso2","slug":"wso2"}},{"hub":true,"name":"Wso2 Identity Server","slug":"identity-server","vendor":{"name":"Wso2","slug":"wso2"}},{"hub":true,"name":"Wso2 Traffic Manager","slug":"traffic-manager","vendor":{"name":"Wso2","slug":"wso2"}}],"exploited_since":"2026-09-24T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-5430-wso2-api-control-plane-path-traversal-vulnerability"},{"cve":"CVE-2026-94127","cvss":9.8,"epss":0.0223,"slug":"cve-2026-94127-f5-big-ip-apm-heap-based-buffer-overflow","title":"When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code","severity":"critical","exploited":true,"published_at":"2026-09-22T15:17:24.313+00:00","technologies":[{"hub":true,"name":"F5 BIG-IP APM","slug":"big-ip-apm","vendor":{"name":"F5","slug":"f5"}}],"exploited_since":"2026-09-22T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-94127-f5-big-ip-apm-heap-based-buffer-overflow"},{"cve":"CVE-2026-93616","cvss":9.8,"epss":0.1965,"slug":"cve-2026-93616-check-point-multiple-products-path-traversal-vulnerability","title":"A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Poin","severity":"critical","exploited":true,"published_at":"2026-09-22T13:17:11.963+00:00","technologies":[{"hub":false,"name":"Check Point Log Server","slug":"log-server","vendor":{"name":"Check Point","slug":"check-point"}},{"hub":false,"name":"Check Point Multi-Domain Log Server","slug":"multi-domain-log-server","vendor":{"name":"Check Point","slug":"check-point"}},{"hub":false,"name":"Check Point Multi-Domain Security Management Server","slug":"multi-domain-security-management-server","vendor":{"name":"Check Point","slug":"check-point"}},{"hub":false,"name":"Check Point Security Management Server","slug":"security-management-server","vendor":{"name":"Check Point","slug":"check-point"}},{"hub":false,"name":"Check Point SmartEvent","slug":"smartevent","vendor":{"name":"Check Point","slug":"check-point"}}],"exploited_since":"2026-09-22T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-93616-check-point-multiple-products-path-traversal-vulnerability"},{"cve":"CVE-2026-93952","cvss":10,"epss":0.009,"slug":"cve-2026-93952-arista-velocloud-orchestrator-improper-input-validation","title":"VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functio","severity":"critical","exploited":true,"published_at":"2026-09-22T08:16:43.047+00:00","exploited_since":"2026-09-22T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-93952-arista-velocloud-orchestrator-improper-input-validation"},{"cve":"CVE-2026-85102","cvss":9.8,"epss":0.0099,"slug":"cve-2026-85102-check-point-security-gateway-and-spark-firewall-improper","title":"Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote att","severity":"critical","exploited":true,"published_at":"2026-09-09T13:20:43.793+00:00","technologies":[{"hub":true,"name":"Check Point Security Gateway","slug":"security-gateway","vendor":{"name":"Check Point","slug":"check-point"}},{"hub":false,"name":"Check Point Spark Firewall","slug":"spark-firewall","vendor":{"name":"Check Point","slug":"check-point"}}],"exploited_since":"2026-09-22T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-85102-check-point-security-gateway-and-spark-firewall-improper"},{"cve":"CVE-2026-7273","cvss":8.8,"epss":0.0129,"slug":"cve-2026-7273-zyxel-gs1900-series-stack-based-buffer-overflow-in-cgi-program","title":"Zyxel GS1900 Series stack-based buffer overflow in CGI program","severity":"critical","exploited":true,"published_at":"2026-06-16T03:16:13.557+00:00","technologies":[{"hub":false,"name":"Zyxel GS1900-10HP","slug":"gs1900-10hp","vendor":{"name":"Zyxel","slug":"zyxel"}},{"hub":false,"name":"Zyxel GS1900-16","slug":"gs1900-16","vendor":{"name":"Zyxel","slug":"zyxel"}},{"hub":false,"name":"Zyxel GS1900-24","slug":"gs1900-24","vendor":{"name":"Zyxel","slug":"zyxel"}},{"hub":false,"name":"Zyxel GS1900-24E","slug":"gs1900-24e","vendor":{"name":"Zyxel","slug":"zyxel"}},{"hub":false,"name":"Zyxel GS1900-24EP","slug":"gs1900-24ep","vendor":{"name":"Zyxel","slug":"zyxel"}},{"hub":false,"name":"Zyxel GS1900-24HPv2","slug":"gs1900-24hpv2","vendor":{"name":"Zyxel","slug":"zyxel"}}],"exploited_since":"2026-09-21T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-7273-zyxel-gs1900-series-stack-based-buffer-overflow-in-cgi-program"}],"previous":{"key":"2026-09-14","top":"Linux Kernel","total":7,"period":{"end":"2026-09-20","start":"2026-09-14"},"critical":7,"url":"https://junglewise.ai/threats/exploited/2026-09-14"},"next":{"key":"2026-09-28","top":"Zammad","total":6,"period":{"end":"2026-10-04","start":"2026-09-28"},"critical":6,"url":"https://junglewise.ai/threats/exploited/2026-09-28"}}