# Most vulnerable technologies: week of 21 to 27 September 2026 (week 39)

Source: https://junglewise.ai/threats/weekly/2026-09-21  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 29 September 2026, 00:07 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/weekly/2026-09-21.json  
License: CC BY 4.0 with a link back

In the week of 21 to 27 September 2026, Junglewise Threat Intelligence recorded 2,950 new vulnerabilities: 192 critical, 892 high and 6 exploited in the wild. The most vulnerable technology was Linux Kernel, with 607 vulnerabilities (20 critical), followed by Microsoft Windows (28) and IBM Financial Transaction Manager (45).

## Ranking

| # | Technology | Vulns | Critical | High | Exploited | Max CVSS |
| --- | --- | --- | --- | --- | --- | --- |
| 1 | [Linux Kernel](https://junglewise.ai/threats/technologies/kernel) (Linux) | 607 | 20 | 127 | 0 | 10 |
| 2 | [Microsoft Windows](https://junglewise.ai/threats/technologies/windows-) (Microsoft) | 28 | 22 | 4 | 0 | 10 |
| 3 | [IBM Financial Transaction Manager](https://junglewise.ai/threats/technologies/financial-transaction-manager) (IBM) | 45 | 6 | 24 | 0 | 9.9 |
| 4 | [Openclaw](https://junglewise.ai/threats/technologies/openclaw) (Openclaw) | 55 | 0 | 24 | 0 | 8.8 |
| 5 | [Adobe Campaign Classic](https://junglewise.ai/threats/technologies/campaign-classic) (Adobe) | 17 | 16 | 1 | 0 | 10 |
| 6 | [Foxit PDF Editor](https://junglewise.ai/threats/technologies/pdf-editor) (Foxit) | 31 | 0 | 24 | 0 | 8.8 |
| 7 | [Foxit PDF Reader](https://junglewise.ai/threats/technologies/pdf-reader) (Foxit) | 30 | 0 | 23 | 0 | 8.8 |
| 8 | [Lantronix EMG7500](https://junglewise.ai/threats/technologies/emg7500) (Lantronix) | 13 | 10 | 3 | 0 | 10 |
| 9 | [Lantronix EMG8500](https://junglewise.ai/threats/technologies/emg8500) (Lantronix) | 13 | 10 | 3 | 0 | 10 |
| 10 | [Lantronix SLB882](https://junglewise.ai/threats/technologies/slb882) (Lantronix) | 13 | 10 | 3 | 0 | 10 |
| 11 | [Lantronix SLC8000](https://junglewise.ai/threats/technologies/slc8000) (Lantronix) | 13 | 10 | 3 | 0 | 10 |
| 12 | [Lantronix SLC9000](https://junglewise.ai/threats/technologies/slc9000) (Lantronix) | 13 | 10 | 3 | 0 | 10 |
| 13 | [Lantronix SLCx-02](https://junglewise.ai/threats/technologies/slcx-02) (Lantronix) | 12 | 10 | 2 | 0 | 10 |
| 14 | [Lantronix SLCx-03](https://junglewise.ai/threats/technologies/slcx-03) (Lantronix) | 12 | 10 | 2 | 0 | 10 |
| 15 | [mcp-atlassian (PyPI)](https://junglewise.ai/threats/technologies/mcp-atlassian) (PyPI) | 24 | 1 | 15 | 0 | 10 |
| 16 | [IBM Datastage On Cloud Pak For Data](https://junglewise.ai/threats/technologies/datastage-on-cloud-pak-for-data) (IBM) | 15 | 2 | 13 | 0 | 9.9 |
| 17 | [Red Hat Ansible Automation Platform](https://junglewise.ai/threats/technologies/ansible-automation-platform-2) (Red Hat) | 18 | 3 | 7 | 0 | 9.9 |
| 18 | [Froxlor](https://junglewise.ai/threats/technologies/froxlor) (Froxlor) | 13 | 4 | 6 | 0 | 9.9 |
| 19 | [Netcore NBR200V2](https://junglewise.ai/threats/technologies/nbr200v2) (Netcore) | 7 | 7 | 0 | 0 | 10 |
| 20 | [Adobe Connect](https://junglewise.ai/threats/technologies/adobe-connect) (Adobe) | 9 | 6 | 1 | 0 | 9.9 |
| 21 | [Adobe Connect For Mobile](https://junglewise.ai/threats/technologies/connect-for-mobile) (Adobe) | 9 | 6 | 1 | 0 | 9.9 |
| 22 | [Apple macOS](https://junglewise.ai/threats/technologies/macos-tahoe) (Apple) | 9 | 6 | 1 | 0 | 9.9 |
| 23 | [IBM Concert](https://junglewise.ai/threats/technologies/concert) (IBM) | 16 | 4 | 2 | 0 | 9.8 |
| 24 | [Apache Tomcat](https://junglewise.ai/threats/technologies/tomcat) (Apache) | 11 | 3 | 7 | 0 | 9.8 |
| 25 | [Citrix NetScaler Gateway](https://junglewise.ai/threats/technologies/gateway) (Citrix) | 8 | 2 | 0 | 2 | n/a |

## Most affected vendors

1. [Linux](https://junglewise.ai/threats/vendors/linux): 589 vulnerabilities, 20 critical, 0 exploited
2. [IBM](https://junglewise.ai/threats/vendors/ibm): 96 vulnerabilities, 12 critical, 0 exploited
3. [Adobe](https://junglewise.ai/threats/vendors/adobe): 53 vulnerabilities, 25 critical, 0 exploited
4. [Microsoft](https://junglewise.ai/threats/vendors/microsoft): 30 vulnerabilities, 22 critical, 0 exploited
5. [Openclaw](https://junglewise.ai/threats/vendors/openclaw): 73 vulnerabilities, 0 critical, 0 exploited
6. [Apache](https://junglewise.ai/threats/vendors/apache): 43 vulnerabilities, 7 critical, 0 exploited
7. [Red Hat](https://junglewise.ai/threats/vendors/red-hat): 42 vulnerabilities, 4 critical, 0 exploited
8. [Foxit](https://junglewise.ai/threats/vendors/foxit): 31 vulnerabilities, 0 critical, 0 exploited
9. [Lantronix](https://junglewise.ai/threats/vendors/lantronix): 13 vulnerabilities, 10 critical, 0 exploited
10. [Zoho](https://junglewise.ai/threats/vendors/zoho): 15 vulnerabilities, 2 critical, 0 exploited

## Most severe vulnerabilities

- [CVE-2026-93952: VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access…](https://junglewise.ai/threats/cve-2026-93952-arista-velocloud-orchestrator-improper-input-validation) (critical, exploited in the wild, CVSS 10, published 22 Sep 2026)
- [CVE-2026-93616: A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary…](https://junglewise.ai/threats/cve-2026-93616-check-point-multiple-products-path-traversal-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 22 Sep 2026)
- [CVE-2026-94127: When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can…](https://junglewise.ai/threats/cve-2026-94127-f5-big-ip-apm-heap-based-buffer-overflow) (critical, exploited in the wild, CVSS 9.8, published 22 Sep 2026)
- [CVE-2026-87902: An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php`…](https://junglewise.ai/threats/cve-2026-87902-wordpress-core-remote-file-inclusion) (critical, exploited in the wild, CVSS 8.1, published 22 Sep 2026)
- [CVE-2026-88772: Citrix NetScaler ADC and Gateway remote code execution and denial of service](https://junglewise.ai/threats/cve-2026-88772-vulnerability-in-citrix-netscaler-adc-and-citrix-netscaler) (critical, exploited in the wild, published 27 Sep 2026)
- [CVE-2026-88771: Citrix NetScaler ADC and Gateway improper input validation](https://junglewise.ai/threats/cve-2026-88771-improper-input-validation-vulnerability-in-citrix-netscaler-adc) (critical, exploited in the wild, published 27 Sep 2026)
- [CVE-2026-94097: Netcore NBR200V2 command injection in network tools CGI](https://junglewise.ai/threats/cve-2026-94097-a-vulnerability-was-determined-in-netcore-nbr200v2-1-3-241127) (critical, CVSS 10, published 21 Sep 2026)
- [CVE-2026-80155: Lantronix SLC8000 SLC9000 EMG authentication bypass in web management portal](https://junglewise.ai/threats/cve-2026-80155-lantronix-slc8000-before-firmware-v9-7-0-5-slc9000-before) (critical, CVSS 10, published 22 Sep 2026)
- [CVE-2026-89275: Adobe Campaign Classic code injection vulnerability](https://junglewise.ai/threats/cve-2026-89275-adobe-campaign-classic-acc-is-affected-by-an-improper-control-of) (critical, CVSS 10, published 22 Sep 2026)
- [CVE-2026-84412: Adobe Campaign Classic code injection](https://junglewise.ai/threats/cve-2026-84412-adobe-campaign-classic-acc-is-affected-by-an-improper-control-of) (critical, CVSS 10, published 22 Sep 2026)

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Most vulnerable technologies: week of 21 to 27 September 2026 (week 39)", https://junglewise.ai/threats/weekly/2026-09-21, 29 September 2026.