Weekly report — week 2026-39

Added to CISA KEV (confirmed exploitation)

• CVE-2026-88771Critical · 9.8KEVPublic exploitCitrix NetScaler Improper Input Validation VulnerabilitySep 27, 2026
• CVE-2026-88772High · 8.1KEVPublic exploitCitrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer VulnerabilitySep 27, 2026
• CVE-2026-65660High · 8.8KEVPublic exploitMicrosoft SharePoint Code Injection VulnerabilitySep 25, 2026
• CVE-2026-87902High · 8.1KEVPublic exploitWordPress Core Remote File Inclusion VulnerabilitySep 25, 2026
• CVE-2026-67279Medium · 6.5KEVPublic exploitMikrotik RouterOS Improper Enforcement of Behavioral Workflow VulnerabilitySep 25, 2026
• CVE-2026-5430Critical · 10.0KEVPublic exploitWSO2 Multiple Products Path Traversal VulnerabilitySep 24, 2026
• CVE-2026-71362Critical · 9.1KEVPublic exploitAdobe Commerce and Magento Incorrect Authorization VulnerabilitySep 24, 2026
• CVE-2026-85102Critical · 9.8KEVPublic exploitCheck Point Multiple Products Improper Certificate Validation VulnerabilitySep 22, 2026
• CVE-2026-93952Critical · 10.0KEVArista VeloCloud Orchestrator Improper Input Validation VulnerabilitySep 22, 2026
• CVE-2026-93616Critical · 9.8KEVPublic exploitCheck Point Multiple Products Path Traversal VulnerabilitySep 22, 2026
• CVE-2026-94127Critical · 9.8KEVPublic exploitF5 BIG-IP APM Heap-based Buffer Overflow VulnerabilitySep 22, 2026
• CVE-2026-7273High · 8.8KEVZyxel GS1900 Series Switches Stack-Based Buffer Overflow VulnerabilitySep 21, 2026

Critical CVEs published (KEV and highest EPSS first)

• CVE-2026-93616Critical · 9.8KEVPublic exploitCheck Point Multiple Products Path Traversal VulnerabilityEPSS 19.7%
• CVE-2026-94127Critical · 9.8KEVPublic exploitF5 BIG-IP APM Heap-based Buffer Overflow VulnerabilityEPSS 2.2%
• CVE-2026-88771Critical · 9.8KEVPublic exploitCitrix NetScaler Improper Input Validation VulnerabilityEPSS 1.1%
• CVE-2026-93952Critical · 10.0KEVArista VeloCloud Orchestrator Improper Input Validation VulnerabilityEPSS 1.1%
• CVE-2026-18169Critical · 9.9IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.5%
• CVE-2026-18163Critical · 9.8IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.5%
• CVE-2025-63564Critical · 9.8SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to...EPSS 0.5%
• CVE-2026-18162Critical · 9.8IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.5%
• CVE-2026-16346Critical · 9.9DataStage on Cloud Pak for Data has several vulnerabilitiesEPSS 0.5%
• CVE-2026-86246Critical · 9.1Apache Tomcat Native: Insecure OpenSSL options enabledEPSS 0.4%
• CVE-2026-17635Critical · 9.1IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.3%
• CVE-2025-12999Critical · 9.1UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset…EPSS 0.3%
• CVE-2026-88416Critical · 9.8MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form…EPSS 0.3%
• CVE-2026-100833Critical · 9.6Contrast before 1.23.1 Image Substitution via Policy GenerationEPSS 0.2%
• CVE-2026-18872Critical · 9.3IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.2%

Biggest EPSS increases (30-day exploitation probability)

Nothing this week.

New public exploits and templates

Nothing this week.