CVE Landscape

September 2026 CVE landscape: 94 high-impact vulnerabilities identified, with zero-day NetScaler exploits, AI-assisted campaigns, and Qilin ransomware deployment via Cisco FMC flaws. Insikt Group identified 94 high-impact vulnerabilities including 59 Very Critical, a 29% increase from August. Zero-day exploitation targeted NetScaler ADC/Gateway (CVE-2026-88771, CVE-2026-88772). Three threat clusters exploited Cisco FMC flaws leading to Qilin ransomware and Cyclops Blink deployment. AI-assisted campaigns using Claude, Qwen, and DeepSeek compromised 440 PaperCut instances across 395 organizations.

Insikt Group identified 73 high-impact vulnerabilities exploited in August 2026 across 45 vendors, with Chinese-speaking actors using AI tools to automate exploitation workflows. 34 of 73 vulnerabilities enabled RCE across Microsoft, Linux, network appliance, AI platform, and collaboration products. UAT-10147 exploited Telerik, AjaxPro, Nacos, and Zimbra for initial access, then used DeepAudit and PentestGPT for post-compromise automation. A separate actor used Hermes Agent with DeepSeek against Langflow and n8n. Both operations remained semi-autonomous.

Insikt Group identified 85 high-impact vulnerabilities in July 2026, a 44% increase from the prior month, with 57 enabling RCE and 60 having public PoC exploits. Threat actors including the Dysphoria botnet, Cloud Atlas, Armored Likho, UAT-7810, and TA488 actively exploited vulnerabilities across IoT devices, email platforms, enterprise applications, and security appliances. Common weakness classes included OS command injection (CWE-78), unrestricted file upload (CWE-434), code injection (CWE-94), and deserialization flaws (CWE-502). Fourteen vulnerabilities were at least five years old, demonstrating continued exploitation of legacy flaws in unpatched environments.

Insikt Group identified 60 high-impact vulnerabilities in June 2026 (a 49% increase from May), with 23 listed in CISA's KEV catalog and 53 having public PoC exploits. The dominant theme was exploitation of externally reachable enterprise applications and appliances by multiple threat actors: StrikeShark chained 13 CVEs to deploy SharkLoader and Cobalt Strike, Lazarus exploited CVE-2025-55182 (React2Shell, CVSS 10.0) to deploy COPPERHEDGE and EtherRAT, APT36 targeted India via Microsoft Office/Windows CVEs, and Qilin ransomware was linked to Check Point gateway exploitation. 25 of the 60 vulnerabilities enabled RCE across 18 vendors, with CWE-22 (Path Traversal) being the most common flaw class.