Company
Previdian, formerly KEVIntel, is a security service that tracks and reports real-world exploitation of software vulnerabilities as they occur.
CISA added Atlassian's CVE-2026-21589, rated CVSS 9.3, to its Known Exploited Vulnerabilities catalog on October 15. An attacker needs a file's exact path, and in one watchTowr test that was enough to reach Jira administrator access.
Reality
Attackers made 1,423 attempts against Previdian honeypots since September 19 to exploit Langflow CVE-2026-105740 (CVSS 9.9, versions before 1.9.0). In one sequence they got the required login with a common username and password, Previdian said.
Reality
Attackers began targeting SonicWall's maximum-severity SMA1000 flaw CVE-2026-102255 within three days of its patch, Previdian's honeypots show. SonicWall's advisory had not called it exploited by Friday, so owners waiting on that label are patching behind the attackers.
Perspective Coverage
7 publishersReality
Atlassian rates CVE-2026-21589 critical at CVSS 4.0 9.3, a no-login file-read flaw in every version of eight self-hosted products. Honeypots saw exploitation attempts by October 6, a day after the advisory, according to a dev.to write-up that found no public report of confirmed victims.
Reality
Previdian recorded exploitation attempts against Atlassian's CVE-2026-21589 within two hours of watchTowr publishing the arbitrary file access technique. The CVSS 9.3 flaw lets an unauthenticated attacker read specific webroot files across eight Data Center products.
Perspective Coverage
6 publishersReality
Atlassian disclosed CVE-2026-21589, a 9.3-rated unauthenticated file-read flaw affecting all eight of its self-hosted Data Center products. A public proof of concept drew exploitation attempts within two hours of landing on 7 October.
Reality
Microsoft says attackers are exploiting SharePoint flaw CVE-2026-65660, roughly six weeks after it shipped a fix in August. Any server still missing that update should be treated as possibly compromised, checked for webshells and patched.
Perspective Coverage
4 publishersReality
CISA listed WSO2's maximum-severity JWT bypass, CVE-2026-5430, as exploited, with a September 27 federal fix deadline. The public evidence so far is forged-token attempts from one IP against the wrong WSO2 product, a thinner record than Sansec's sighting of live Magento attacks.
Perspective Coverage
4 publishersReality
WordPress released 7.1.2 on 22 September 2026 to fix remote file inclusion flaw CVE-2026-87902, and the first exploit attempt was recorded the same day. The fix was back-ported to every maintained branch down to 4.7, so an exposed site has hours before scanners find it.
Reality
CVE-2026-8452 shipped as a June 30 denial-of-service fix. A WatchTowr proof of concept turned it into pre-auth code execution, and in-the-wild exploitation followed.
Perspective Coverage
7 publishersReality
CISA says all four are under active exploitation, and three of them are unauthenticated flaws in edge and management appliances. Its own alert cites BOD 26-04 and prints no due date for any of them.
Perspective Coverage
4 publishersReality
Orkes Conductor evaluates workflow expressions on a GraalVM context with the sandbox disabled, and Fortinet blocked about 1,300 exploitation attempts against CVE-2026-58138 over two days in September.
Reality
The flaw reaches code execution only where the active theme has a top-level directory starting with page- and a readable local .php file such as pearcmd.php sits on the server. Previdian has logged 68 attempts.
Reality
Adobe shipped the out-of-band hotfix on September 8. Sansec dates exploitation to September 4, and that four-day gap is why the advisory pairs the patch with a required encryption-key rotation.
Reality
CVE-2026-75650 scores a flat 10.0 and was already in use on September 4. Adobe's hotfix comes paired with encryption key rotation, and Sansec's Rust backdoor findings matter more than the score does.
Reality
The mid-August Citrix advisory that many teams parked behind lower-risk work now has attack traffic behind it, and the appliances in scope are the ones fronting remote access. Role and firmware decide scope, not appliance count.
Reality