# Most vulnerable technologies in September 2026

Source: https://junglewise.ai/threats/monthly/2026-09  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2 October 2026, 00:07 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/monthly/2026-09.json  
License: CC BY 4.0 with a link back

In September 2026, Junglewise Threat Intelligence recorded 15,322 new vulnerabilities: 1,326 critical, 5,770 high and 28 exploited in the wild. The most vulnerable technology was Linux Kernel, with 2,099 vulnerabilities (119 critical), followed by Microsoft Windows (465) and Google Chrome (462).

## Ranking

| # | Technology | Vulns | Critical | High | Exploited | Max CVSS |
| --- | --- | --- | --- | --- | --- | --- |
| 1 | [Linux Kernel](https://junglewise.ai/threats/technologies/kernel) (Linux) | 2099 | 119 | 623 | 0 | 10 |
| 2 | [Microsoft Windows](https://junglewise.ai/threats/technologies/windows-) (Microsoft) | 465 | 39 | 324 | 2 | 10 |
| 3 | [Google Chrome](https://junglewise.ai/threats/technologies/chrome) (Google) | 462 | 77 | 126 | 2 | 9.8 |
| 4 | [Apple macOS](https://junglewise.ai/threats/technologies/macos-tahoe) (Apple) | 288 | 19 | 99 | 1 | 10 |
| 5 | [Google Android](https://junglewise.ai/threats/technologies/android) (Google) | 210 | 17 | 106 | 1 | 9.8 |
| 6 | [Mozilla Firefox](https://junglewise.ai/threats/technologies/firefox) (Mozilla) | 172 | 36 | 81 | 0 | 9.8 |
| 7 | [Mozilla Firefox ESR](https://junglewise.ai/threats/technologies/firefox-esr) (Mozilla) | 145 | 27 | 74 | 0 | 9.8 |
| 8 | [Mozilla Thunderbird](https://junglewise.ai/threats/technologies/thunderbird) (Mozilla) | 107 | 31 | 55 | 0 | 9.8 |
| 9 | [Apple macOS Golden Gate](https://junglewise.ai/threats/technologies/macos-golden-gate) (Apple) | 172 | 8 | 54 | 0 | 10 |
| 10 | [Oracle Hyperion Financial Management](https://junglewise.ai/threats/technologies/hyperion-financial-management) (Oracle) | 80 | 13 | 66 | 0 | 10 |
| 11 | [Apple iPadOS](https://junglewise.ai/threats/technologies/ipados) (Apple) | 140 | 6 | 37 | 1 | 9.8 |
| 12 | [vm2 (npm)](https://junglewise.ai/threats/technologies/vm2) (npm) | 63 | 30 | 9 | 0 | 10 |
| 13 | [WWBN AVideo](https://junglewise.ai/threats/technologies/avideo) (WWBN) | 106 | 6 | 45 | 0 | 9.8 |
| 14 | [IBM Guardium Data Protection](https://junglewise.ai/threats/technologies/guardium-data-protection) (IBM) | 52 | 13 | 37 | 0 | 9.9 |
| 15 | [Apple visionOS](https://junglewise.ai/threats/technologies/visionos) (Apple) | 97 | 5 | 25 | 0 | 9.8 |
| 16 | [NVIDIA GPU Display Driver](https://junglewise.ai/threats/technologies/gpu-display-driver) (Nvidia) | 73 | 0 | 45 | 0 | 7.8 |
| 17 | [SiYuan](https://junglewise.ai/threats/technologies/siyuan) (SiYuan) | 68 | 4 | 34 | 0 | 10 |
| 18 | [Apple watchOS](https://junglewise.ai/threats/technologies/watchos) (Apple) | 82 | 5 | 21 | 0 | 9.8 |
| 19 | [Microsoft SQL Server](https://junglewise.ai/threats/technologies/sql-server) (Microsoft) | 60 | 5 | 31 | 0 | 9.8 |
| 20 | [Apple tvOS](https://junglewise.ai/threats/technologies/tvos) (Apple) | 78 | 4 | 22 | 0 | 9.8 |
| 21 | [IBM Datastage On Cloud Pak For Data](https://junglewise.ai/threats/technologies/datastage-on-cloud-pak-for-data) (IBM) | 36 | 6 | 30 | 0 | 9.9 |
| 22 | [Oracle E-Business Suite](https://junglewise.ai/threats/technologies/e-business-suite) (Oracle) | 42 | 1 | 39 | 0 | 9.8 |
| 23 | [Apple Iphone Os](https://junglewise.ai/threats/technologies/iphone-os) (Apple) | 70 | 3 | 19 | 0 | 9.6 |
| 24 | [IBM Financial Transaction Manager](https://junglewise.ai/threats/technologies/financial-transaction-manager) (IBM) | 45 | 6 | 24 | 0 | 9.9 |
| 25 | [Arubanetworks Fabric Composer](https://junglewise.ai/threats/technologies/fabric-composer) (Arubanetworks) | 51 | 5 | 23 | 0 | 10 |

## Most affected vendors

1. [Linux](https://junglewise.ai/threats/vendors/linux): 2,081 vulnerabilities, 119 critical, 0 exploited
2. [Microsoft](https://junglewise.ai/threats/vendors/microsoft): 1,092 vulnerabilities, 88 critical, 4 exploited
3. [Oracle](https://junglewise.ai/threats/vendors/oracle): 592 vulnerabilities, 83 critical, 0 exploited
4. [Google](https://junglewise.ai/threats/vendors/google): 669 vulnerabilities, 83 critical, 3 exploited
5. [IBM](https://junglewise.ai/threats/vendors/ibm): 386 vulnerabilities, 42 critical, 0 exploited
6. [Apple](https://junglewise.ai/threats/vendors/apple): 326 vulnerabilities, 21 critical, 1 exploited
7. [Mozilla](https://junglewise.ai/threats/vendors/mozilla): 191 vulnerabilities, 41 critical, 0 exploited
8. [Dell](https://junglewise.ai/threats/vendors/dell): 205 vulnerabilities, 11 critical, 0 exploited
9. [Apache](https://junglewise.ai/threats/vendors/apache): 156 vulnerabilities, 29 critical, 0 exploited
10. [Nvidia](https://junglewise.ai/threats/vendors/nvidia): 168 vulnerabilities, 1 critical, 0 exploited

## Most severe vulnerabilities

- [CVE-2026-85706: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1…](https://junglewise.ai/threats/cve-2026-85706-gitlab-community-and-enterprise-edition-path-traversal-in-commits) (critical, exploited in the wild, CVSS 10, published 12 Sep 2026)
- [CVE-2026-76460: A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to…](https://junglewise.ai/threats/cve-2026-76460-cisco-identity-services-engine-incorrect-privileged-api-use) (critical, exploited in the wild, CVSS 10, published 16 Sep 2026)
- [CVE-2026-83548: A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended…](https://junglewise.ai/threats/cve-2026-83548-sonicwall-sma1000-server-side-request-forgery) (critical, exploited in the wild, CVSS 10, published 1 Sep 2026)
- [CVE-2026-75650: Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that…](https://junglewise.ai/threats/cve-2026-75650-adobe-commerce-and-magento-improper-neutralization-in-template) (critical, exploited in the wild, CVSS 10, published 7 Sep 2026)
- [CVE-2026-93952: VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access…](https://junglewise.ai/threats/cve-2026-93952-arista-velocloud-orchestrator-improper-input-validation) (critical, exploited in the wild, CVSS 10, published 22 Sep 2026)
- [CVE-2026-84869: A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session…](https://junglewise.ai/threats/cve-2026-84869-connectwise-screenconnect-unauthorized-file-transfer-and) (critical, exploited in the wild, CVSS 9.9, published 8 Sep 2026)
- [CVE-2026-76461: A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an…](https://junglewise.ai/threats/cve-2026-76461-cisco-secure-email-gateway-sql-injection) (critical, exploited in the wild, CVSS 9.8, published 14 Sep 2026)
- [CVE-2026-93616: A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary…](https://junglewise.ai/threats/cve-2026-93616-check-point-multiple-products-path-traversal-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 22 Sep 2026)
- [CVE-2026-86218: N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.](https://junglewise.ai/threats/cve-2026-86218-n-able-n-central-static-code-injection-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 6 Sep 2026)
- [CVE-2026-19490: Citrix NetScaler authentication bypass via alternate path](https://junglewise.ai/threats/cve-2026-19490-citrix-netscaler-authentication-bypass-via-alternate-path) (critical, exploited in the wild, CVSS 9.8, published 9 Sep 2026)

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Most vulnerable technologies in September 2026", https://junglewise.ai/threats/monthly/2026-09, 2 October 2026.