# Newly exploited vulnerabilities: week of 21 to 27 September 2026 (week 39)

Source: https://junglewise.ai/threats/exploited/2026-09-21  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2 October 2026, 19:23 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/exploited/2026-09-21.json  
License: CC BY 4.0 with a link back

In the week of 21 to 27 September 2026, 12 vulnerabilities were newly recorded as exploited in the wild, 12 of them critical. The technology hit most was Citrix NetScaler (2), followed by Citrix NetScaler ADC (2) and Citrix NetScaler Gateway (2).

## Newly exploited this week

- [CVE-2026-88772: Citrix NetScaler ADC and Gateway remote code execution and denial of service](https://junglewise.ai/threats/cve-2026-88772-vulnerability-in-citrix-netscaler-adc-and-citrix-netscaler) (critical, exploited in the wild, exploited since 27 Sep 2026, published 27 Sep 2026)
- [CVE-2026-88771: Citrix NetScaler ADC and Gateway improper input validation](https://junglewise.ai/threats/cve-2026-88771-improper-input-validation-vulnerability-in-citrix-netscaler-adc) (critical, exploited in the wild, exploited since 27 Sep 2026, published 27 Sep 2026)
- [CVE-2026-87902: An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php`…](https://junglewise.ai/threats/cve-2026-87902-wordpress-core-remote-file-inclusion) (critical, exploited in the wild, CVSS 8.1, exploited since 25 Sep 2026, published 22 Sep 2026)
- [CVE-2026-67279: RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never…](https://junglewise.ai/threats/cve-2026-67279-mikrotik-routeros-improper-behavioral-workflow-enforcement) (critical, exploited in the wild, CVSS 6.5, exploited since 25 Sep 2026, published 5 Sep 2026)
- [CVE-2026-65660: Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to…](https://junglewise.ai/threats/cve-2026-65660-microsoft-sharepoint-code-injection) (critical, exploited in the wild, CVSS 8.8, exploited since 25 Sep 2026, published 11 Aug 2026)
- [CVE-2026-71362: Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An…](https://junglewise.ai/threats/cve-2026-71362-adobe-commerce-and-magento-incorrect-authorization) (critical, exploited in the wild, CVSS 9.1, exploited since 24 Sep 2026, published 11 Aug 2026)
- [CVE-2026-5430: The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported…](https://junglewise.ai/threats/cve-2026-5430-wso2-api-control-plane-path-traversal-vulnerability) (critical, exploited in the wild, CVSS 10, exploited since 24 Sep 2026, published 6 Aug 2026)
- [CVE-2026-94127: When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can…](https://junglewise.ai/threats/cve-2026-94127-f5-big-ip-apm-heap-based-buffer-overflow) (critical, exploited in the wild, CVSS 9.8, exploited since 22 Sep 2026, published 22 Sep 2026)
- [CVE-2026-93616: A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary…](https://junglewise.ai/threats/cve-2026-93616-check-point-multiple-products-path-traversal-vulnerability) (critical, exploited in the wild, CVSS 9.8, exploited since 22 Sep 2026, published 22 Sep 2026)
- [CVE-2026-93952: VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access…](https://junglewise.ai/threats/cve-2026-93952-arista-velocloud-orchestrator-improper-input-validation) (critical, exploited in the wild, CVSS 10, exploited since 22 Sep 2026, published 22 Sep 2026)
- [CVE-2026-85102: Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an…](https://junglewise.ai/threats/cve-2026-85102-check-point-security-gateway-and-spark-firewall-improper) (critical, exploited in the wild, CVSS 9.8, exploited since 22 Sep 2026, published 9 Sep 2026)
- [CVE-2026-7273: Zyxel GS1900 Series stack-based buffer overflow in CGI program](https://junglewise.ai/threats/cve-2026-7273-zyxel-gs1900-series-stack-based-buffer-overflow-in-cgi-program) (critical, exploited in the wild, CVSS 8.8, exploited since 21 Sep 2026, published 16 Jun 2026)

## Technologies hit most

1. [Citrix NetScaler](https://junglewise.ai/threats/technologies/netscaler): 2 vulnerabilities
2. [Citrix NetScaler ADC](https://junglewise.ai/threats/technologies/netscaler-adc): 2 vulnerabilities
3. [Citrix NetScaler Gateway](https://junglewise.ai/threats/technologies/gateway): 2 vulnerabilities
4. [Adobe Commerce](https://junglewise.ai/threats/technologies/commerce): 1 vulnerability
5. [Adobe Magento](https://junglewise.ai/threats/technologies/magento): 1 vulnerability
6. [Adobe Magento Enterprise Edition](https://junglewise.ai/threats/technologies/magento-enterprise-edition): 1 vulnerability
7. Check Point Log Server: 1 vulnerability
8. Check Point Multi-Domain Log Server: 1 vulnerability
9. Check Point Multi-Domain Security Management Server: 1 vulnerability
10. [Check Point Security Gateway](https://junglewise.ai/threats/technologies/security-gateway): 1 vulnerability
11. Check Point Security Management Server: 1 vulnerability
12. Check Point SmartEvent: 1 vulnerability
13. Check Point Spark Firewall: 1 vulnerability
14. [F5 BIG-IP APM](https://junglewise.ai/threats/technologies/big-ip-apm): 1 vulnerability
15. [Microsoft SharePoint](https://junglewise.ai/threats/technologies/sharepoint): 1 vulnerability

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 21 to 27 September 2026 (week 39)", https://junglewise.ai/threats/exploited/2026-09-21, 2 October 2026.