Weekly report · exploited in the wild
Newly exploited vulnerabilities: week of 28 September to 4 October 2026 (week 40)
Final report, published . It does not change.
In the week of 28 September to 4 October 2026, 6 vulnerabilities were newly recorded as exploited in the wild, 6 of them critical. The technology hit most was Zammad (2), followed by Zammad Gmbh Zammad (2) and Apple Ios (1).
- Newly exploited
- 6
- Critical
- 6
- Technologies hit
- 9
Newly exploited this week
- CVE-2026-88779: Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before…criticalCVSS 7.5Exploited since Published Citrix NetScaler
- CVE-2026-102490: Zammad privilege escalation to rootcriticalExploited since Published Zammad, Zammad Gmbh Zammad
- CVE-2026-102489: Zammad session hijack leading to remote code executioncriticalExploited since Published Zammad, Zammad Gmbh Zammad
- CVE-2026-104286: An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail…criticalCVSS 9.8Exploited since Published Fortinet FortiMail
- CVE-2026-76504: Cisco Catalyst SD-WAN Manager API authentication bypasscriticalCVSS 9.8Exploited since Published Cisco Catalyst SD-WAN Manager
- CVE-2026-86950: Apple CoreGraphics out-of-bounds write in file processingcriticalCVSS 8.8Exploited since Published Apple Ios, Apple iPadOS, Apple macOS
Technologies hit most
- 1.Zammad2 vulnerabilities
- 2.Zammad Gmbh Zammad2 vulnerabilities
- 3.Apple Ios1 vulnerability
- 4.Apple iPadOS1 vulnerability
- 5.Apple macOS1 vulnerability
- 6.Apple Multiple Products1 vulnerability
- 7.Cisco Catalyst SD-WAN Manager1 vulnerability
- 8.Citrix NetScaler1 vulnerability
- 9.Fortinet FortiMail1 vulnerability
How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
A vulnerability is exploited in the wild when the CISA Known Exploited Vulnerabilities catalogue lists it or a vendor advisory says so. The date it was first recorded as exploited is CISA's date added where it came from the catalogue, else the day Junglewise learned of it.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/exploited/2026-09-28.json, and this page as text at https://junglewise.ai/threats/exploited/2026-09-28.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 28 September to 4 October 2026 (week 40)", https://junglewise.ai/threats/exploited/2026-09-28, 6 October 2026.