Report Date: 2026-09-16
New KEVs: 7 — unchanged vs last weekRansomware Victims: 174 ▲ +13 vs last week
7 vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog this period. Cisco products show the strongest concentration of risk signals this week. Ransomware activity is moderate with 174 new victims posted to leak sites over the last 7 days, with Thegentlemen posting the most victims.
Patch This Week
The top 3 KEVs to remediate right now, ranked by CISA deadline proximity, ransomware exploitation, and severity. These are confirmed exploited — if you do nothing else today, patch these.
- CVE-2026-86060 – MikroTik RouterOS | CVSS 9.2 | EPSS 1.1% / 63th pct | PoC Available
CISA deadline: 2026-09-13 (overdue by 3d) — Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - CVE-2026-67277 – MikroTik RouterOS | CVSS 8.8 | EPSS 0.9% / 57th pct | PoC Available
CISA deadline: 2026-09-13 (overdue by 3d) — Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - CVE-2026-85706 – GitLab Community Edition and Enterprise Edition | CVSS 10.0 | EPSS 12.0% / 96th pct
CISA deadline: 2026-09-14 (overdue by 2d) — Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Top KEVs
Vulnerabilities confirmed actively exploited in the wild by CISA — ranked by ransomware use, then severity. Patch these before anything else.
New Today
- CVE-2026-76460 – Cisco Identity Services Engine | CVSS 10.0 (CRITICAL) | AV: Network | Ransomware Use: No
- CVE-2026-58704 – Google Pixel | CVSS 8.8 (HIGH) | AV: Adjacent | EPSS 0.1% / 2th pct | Ransomware Use: No
Still Outstanding
- CVE-2026-85706 – GitLab Community Edition and Enterprise Edition | CVSS 10.0 (CRITICAL) | AV: Network | EPSS 12.0% / 96th pct | Ransomware Use: No
- CVE-2026-84869 – ConnectWise ScreenConnect | CVSS 9.9 (CRITICAL) | AV: Network | EPSS 0.7% / 51th pct | Ransomware Use: No
- CVE-2026-76461 – Cisco Secure Email Gateway | CVSS 9.8 (CRITICAL) | AV: Network | EPSS 2.0% / 80th pct | Ransomware Use: No
- CVE-2026-86060 – MikroTik RouterOS | CVSS 9.2 (CRITICAL) | AV: Network | EPSS 1.1% / 63th pct | Ransomware Use: No | PoC Available
- CVE-2026-67277 – MikroTik RouterOS | CVSS 8.8 (HIGH) | AV: Network | EPSS 0.9% / 57th pct | Ransomware Use: No | PoC Available
Security News
Advisories, threat research, and incident reports from 12 sources across government, commercial research, and security journalism — prioritized by source credibility.
- CISA ICS AdvisoryAdvisory · yesterday – CareCam CM2507
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to access live video and sensitive device information, enable unauthorized services, execute arbitrary code, modify device operat… - CISA ICS AdvisoryAdvisory · yesterday – Siemens Teamcenter
View CSAF Summary A reflected cross site scripting vulnerability in the authentication redirect flow (/auth/) of Teamcenter allows an unauthenticated remote attacker to inject JavaScript into an authenticated user's sess… - CISA ICS AdvisoryAdvisory · yesterday – Siemens Mendix SAML
View CSAF Summary Mendix SAML module contains a vulnerability that could allow unauthenticated remote attackers to hijack an account in specific SSO configurations. Mendix has provided fix releases for the Mendix SAML mo… - SANS ISCResearch · 2 days ago – Apple Updates Everything, (Mon, Sep 14th)
Today, Apple released its annual update across all its operating systems. With that, Apple not only released new features but also patched 261 different vulnerabilities. This is the most vulnerabilities Apple has ever pa… - SANS ISCIncident · 5 days ago – The Self-Expanding Stolen Inference Supply Chain: An AI Agent Harvesting and Re-Serving LLM Access, (Fri, Sep 11th)
I identified an attacker using a semi-autonomous coding agent to run an offensive operation: finding poorly secured LLM resale gateways, acquiring API access through ordinary web flaws and account farming, validating the… - Unit 42Research · today – Atomic macOS (AMOS) Stealer Activity
Modern macOS malware uses deceptive setup guides to steal credentials and sensitive user data. Learn how to identify and block these threats. The post Atomic macOS (AMOS) Stealer Activity appeared first on Unit 42 . - Unit 42Research · 2 days ago – Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection
We designed a behavioral clustering model to map cloud identity roles from audit logs, enabling continuous threat detection using standard SQL queries. The post Unmasking Cloud Identities: From Behavioral Clustering to A… - Sophos X-OpsResearch · today – September Patch Tuesday haul includes 973 CVEs
<p>Windows takes 718 fixes… but what if it was actually a slow month?</p> Categories: Threat Research Tags: Patch Tuesday, x-ops, Threat Research - Sophos X-OpsResearch · yesterday – Cisco Secure Email Gateway vulnerability (CVE-2026-76461) in active exploitation
Categories: Threat Research Tags: advisory, vulnerability, Cisco - The RecordNews · today – Coast Guard, FBI boarded tanker after attack by âforeign cyber actorsâ
U.S. personnel boarded an oil tanker in the Gulf of Mexico to âensure integrity of the vesselâs operational and information technology systems," after an apparent cyberattack, the U.S. Coast Guard said. - The RecordIncident · today – International Meteor Organization says cyberattack dealt âcritical blowâ to website
A website used around the world for reporting meteors faces weeks of downtime as the organization moves away from systems that were hacked recently. - Security Affairs (APT)Incident · yesterday – One Exploit Chain, Two Espionage Campaigns: Chrome and Windows Under Fire
Two China-linked groups ran identical Chrome/Windows zero-day exploits against NGOs, before Chrome’s patch shipped, deploying different backdoors each. Two China-linked threat actors used the same Chrome/Windows ze… - Security Affairs (APT)Incident · 6 days ago – Four Nation-State Actors Used the Same Chrome Zero-Day Exploit Kit Within 12 Days
Four espionage groups used the BlueMoon Chrome+Windows exploit kit within 12 days. Researchers suspect AI development. Proofpoint published a detailed analysis of a Chrome-and-Windows exploit kit it tracks as BlueMoon th… - Security Affairs (Cybercrime)News · today – BambooToken: The Malware That Speaks MQTT to Stay Under the Radar
Lumen exposes BambooToken, a stealthy malware family using MQTT and sideloading to quietly infect targets across Asia and beyond. BambooToken is a new malware family that uses MQTT, a lightweight messaging protocol commo… - Security Affairs (Cybercrime)Incident · today – Revolut Data Leak May Trace Back to Compromised Italian Government Accounts
A suspected compromise of an Italian government PEC account may have allowed threat actors to impersonate law enforcement and obtain sensitive data from hundreds of Revolut customers. The Revolut data exposure may be par…
Ransomware Activity
Victim counts posted to ransomware group leak sites — use this to gauge which groups are most active and which sectors and regions are being targeted.
23 new victims posted today
7-day total: 174 via Ransomware.live
Infostealer Exposure: 230 employee credentials and 2,068 user credentials compromised via infostealer malware across victim organisations — indicating credential theft likely preceded these ransomware deployments.
Most Active Groups
Group Intelligence
- Thegentlemen — The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.
- Qilin — Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
- Auditteam — AuditTeam is a small ransomware group with approximately 5 known victims, primarily targeting organizations in East and Southeast Asia across technology and manufacturing sectors, operating a data leak site consistent with double-extortion methodology.
- Krybit — Krybit is an emerging RaaS group that launched in late March 2026, offering affiliates an 80/20 revenue split with support for Windows, Linux, ESXi, and NAS device encryption, and became notable for a public feud with rival group 0APT in which each breached and leaked the other's operator data.
- Safepay — SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid-2025 with a high-profile early attack against UK telematics firm Microlise stealing 1.2 TB of data.
Most Targeted Sectors
Top Countries
US (52), IN (9), JP (6), RU (6), GB (5)
Notable Incidents
- Port of Tanjung Pelepas (Transportation · MY) — claimed by Direwolf. Marine Shipping & Transportation Press coverage →
- Springfield Public Schools (Education · US) — claimed by Interlock. Springfield Public Schools in Springfield, Massachusetts, is the third-largest school district in the state, with over 23,500 students and over 4,200 full-time employees. The school budget accounts for more than two-thir… Press coverage →
- ryomo.co.jp (Not Found · JP) — claimed by Safepay. Established in January 1970 as a regional computer-services center, the company has developed into a publicly listed systems integrator providing … Press coverage →
- City of Fort Smith Arkansas (Government & Defense · US) — claimed by Interlock. The City of Fort Smith is committed to providing high-quality, resident-focused services to foster a thriving community. This is how they try to position themselves, but in reality, they are very negligent towards their … Press coverage →
Vendor-Specific Risks
Vendors with confirmed KEV exploitation this week — the stacked bar shows how that exposure breaks down across exploited CVEs (red), critical CVEs to watch (orange), and news mentions (yellow). Prioritize patching vendors with the largest red segment.
Stay Ahead
Found this useful? Get the daily report in your reader.
Free. No account. No email. Follow in Feedly, Inoreader, or any RSS reader.