Report Date: 2026-10-01
New KEVs: 7 — unchanged vs last weekRansomware Victims: 0 ▼ -173 vs last week
7 vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog this period. Citrix products show the strongest concentration of risk signals this week.
Patch This Week
The top 3 KEVs to remediate right now, ranked by CISA deadline proximity, ransomware exploitation, and severity. These are confirmed exploited — if you do nothing else today, patch these.
- CVE-2026-65660 – Microsoft SharePoint | CVSS 8.8 | EPSS 2.1% / 81th pct
CISA deadline: 2026-09-28 (overdue by 3d) — Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - CVE-2026-87902 – WordPress Core | CVSS 8.1 | EPSS 19.8% / 97th pct
CISA deadline: 2026-09-28 (overdue by 3d) — Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - CVE-2026-67279 – MikroTik RouterOS | CVSS 6.9 | EPSS 1.0% / 62th pct | PoC Available
CISA deadline: 2026-09-28 (overdue by 3d) — Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Top KEVs
Vulnerabilities confirmed actively exploited in the wild by CISA — ranked by ransomware use, then severity. Patch these before anything else.
This Reporting Window
- CVE-2026-76504 – Cisco Catalyst SD-WAN Manager | CVSS 9.8 (CRITICAL) | AV: Network | Ransomware Use: No
- CVE-2026-88772 – Citrix NetScaler | CVSS 9.5 (CRITICAL) | AV: Network | EPSS 1.3% / 69th pct | Ransomware Use: No
- CVE-2026-88771 – Citrix NetScaler | CVSS 9.5 (CRITICAL) | AV: Network | EPSS 1.1% / 63th pct | Ransomware Use: No
- CVE-2026-86950 – Apple Multiple Products | CVSS 8.8 (HIGH) | AV: Network | EPSS 0.8% / 55th pct | Ransomware Use: No
- CVE-2026-65660 – Microsoft SharePoint | CVSS 8.8 (HIGH) | AV: Network | EPSS 2.1% / 81th pct | Ransomware Use: No
- CVE-2026-87902 – WordPress Core | CVSS 8.1 (HIGH) | AV: Network | EPSS 19.8% / 97th pct | Ransomware Use: No
- CVE-2026-67279 – MikroTik RouterOS | CVSS 6.9 (MEDIUM) | AV: Network | EPSS 1.0% / 62th pct | Ransomware Use: No | PoC Available
Security News
Advisories, threat research, and incident reports from 12 sources across government, commercial research, and security journalism — prioritized by source credibility.
- CISA ICS AdvisoryAdvisory · 2 days ago – Viidure Dashcam Android Application
View CSAF Summary Successful exploitation of these vulnerabilities could allow attackers to access, modify, or delete sensitive user data and critical system files, potentially compromising the operation of the entire pl… - CISA ICS AdvisoryAdvisory · 2 days ago – MikroTik RouterOS
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to achieve remote code execution or cause a denial of service. The following versions of MikroTik RouterOS are affected: RouterOS &l… - CISA ICS AdvisoryAdvisory · 2 days ago – Anjvision YSSD-RTMP-H5
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to access sensitive information, access user accounts, execute OS-level commands, or take full control over the device. The follo… - SANS ISCResearch · 3 days ago – Apple Emergency Patch for iOS 26, macOS26, macOS15 (CVE-2026-86950), (Mon, Sep 28th)
Apple today released patches for all of its operating systems. However, only patches for older branches include a security fix. The vulnerability being addressed in iOS 26, macOS 26 and macOS 15 is already being exploite… - SANS ISCResearch · 4 days ago – Wireshark 4.6.9 Released, (Sun, Sep 27th)
Wireshark release 4.6.9 fixes 19 vulnerabilities and 16 bugs.
 - Unit 42Research · yesterday – Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)
Unit 42 is aware of possible 0-day activity against NetScaler devices. Citrix reports CVE-2026-88771, CVE-2026-88772 have been exploited in the wild. The post Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026… - Unit 42Research · 6 days ago – 3 Consulting Myths Debunked by Unit 42 Experts
Unit 42 security experts address critical cybersecurity misconceptions, offering practical insights to help your organization reinforce its enterprise defenses. The post 3 Consulting Myths Debunked by Unit 42 Experts app… - Sophos X-OpsResearch · yesterday – TerminalFix and Lorem Ipsum Loader enable covert tunneling
The activity is linked to a broader campaign that previously used a different delivery mechanism Categories: Threat Research Tags: TerminalFix, clickfix, Lorem Ipsum Loader - Sophos X-OpsResearch · 3 days ago – Citrix NetScaler vulnerabilities (CVE-2026-88771, CVE-2026-88772) in active exploitation
Categories: Threat Research Tags: advisory, vulnerability, Citrix - The RecordIncident · yesterday – US sanctions 10 over ATM malware scheme tied to Tren de Aragua
Treasuryâs Office of Foreign Assets Control (OFAC) targeted multiple Venezuelan nationals and several companies they control that are part of the effort to launder the money stolen from dozens of ATMs. - The RecordNews · yesterday – After reports on suicide deaths, Pentagon puts Cyber Command on notice
An August 31 memo obtained by Recorded Future News shows that the Pentagon's assistant secretary for cyber policy made specific demands of U.S. Cyber Command leadership after reports of a cluster of suicide deaths. - Security Affairs (APT)News · 6 days ago – Cryptocurrency exchange Bitget Says North Korea-Linked Hackers Stole $351.6 Million
Bitget says suspected North Korea-linked actors stole $351.6M from hot and warm wallets. Withdrawals were suspended while Mandiant investigates. Cryptocurrency exchange Bitget says suspected North Korea-linked threat act… - Security Affairs (APT)News · 14 days ago – SilkParasite Infrastructure Links SpiceRAT to Central Asian Targets
Hunt.io links SpiceRAT, NodeEdgeRAT and NomadRAT to a four-year SilkParasite campaign targeting governments and critical sectors in Central Asia. Hunt.io and researcher Guy Yasur have traced a tight cluster of SpiceRAT c… - Security Affairs (Cybercrime)News · yesterday – Attackers Abuse ChatGPT Custom GPTs to Deploy a Full-Featured RAT
Threat actors abused fake ChatGPT Custom GPTs and ClickFix to deliver a multi-stage RAT. ChatGPT’s Custom GPT feature is the latest legitimate surface being turned into a delivery mechanism, and Huntress researcher… - Security Affairs (Cybercrime)Incident · 2 days ago – Japanese railway operators Keio Corporation and Tokyo Metro disclose security breaches
Keio, a major Japanese railway operator, was hit by ransomware, disrupting business systems and forcing the company to shut down its network. Keio Corporation, one of Japan’s major private railway operators, was hit by a…
Ransomware Activity
Ransomware activity data could not be retrieved for this reporting window.
Vendor-Specific Risks
Vendors with confirmed KEV exploitation this week — the stacked bar shows how that exposure breaks down across exploited CVEs (red), critical CVEs to watch (orange), and news mentions (yellow). Prioritize patching vendors with the largest red segment.
Stay Ahead
Found this useful? Get the daily report in your reader.
Free. No account. No email. Follow in Feedly, Inoreader, or any RSS reader.