Previdian recorded exploitation attempts against Atlassian's CVE-2026-21589 within two hours of watchTowr publishing the arbitrary file access technique. The CVSS 9.3 flaw lets an unauthenticated attacker read specific webroot files across eight Data Center products.
Perspective Coverage
6 publishers
- Builder
- Builder 27%
- Operator
- Operator 67%
- Investor
- Investor 6%
Reality
- Evidence78
- Adoption30
- Hype gap+15
- Incentives45
- Confidence70
PaperCut's 26.0.4 patch left its exploited pre-auth RCE chain reachable
PaperCut's 27 August 2026 advisory of in-the-wild exploitation hid a pre-auth RCE chain whose first patch, 26.0.4, watchTowr defeated within a day. Operators who patched once and stopped tracking the CVEs may still be reachable without credentials.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+8
- Incentives45
- Confidence55
Atlassian disclosed a 9.3-rated flaw, CVE-2026-21589, that lets attackers with no login read known files in 8 self-hosted Data Center products. It wants internet-facing instances taken offline or cut off from outside access until they are upgraded or behind a blocking rule.
Perspective Coverage
15 publishers
- Builder
- Builder 24%
- Operator
- Operator 75%
- Investor
- Investor 1%
Reality
- Evidence72
- Adoption58
- Hype gap−20
- Incentives68
- Confidence68
Citrix patches two NetScaler zero-days that attackers used before any fix existed
Citrix shipped fixes on September 27 for NetScaler flaws CVE-2026-88771 and CVE-2026-88772, both rated 9.5 and exploited on unpatched appliances. Exploitation began before the fix, at a date Citrix has not given, so affected appliances need an intrusion check as well as an upgrade.
Reality
- Evidence66
- Adoption
- Not scored
- Hype gap0
- Incentives
- Not scored
- Confidence62
CISA listed WSO2's maximum-severity JWT bypass, CVE-2026-5430, as exploited, with a September 27 federal fix deadline. The public evidence so far is forged-token attempts from one IP against the wrong WSO2 product, a thinner record than Sansec's sighting of live Magento attacks.
Perspective Coverage
4 publishers
- Builder
- Builder 25%
- Operator
- Operator 65%
- Investor
- Investor 10%
Reality
- Evidence55
- Adoption25
- Hype gap+35
- Incentives40
- Confidence55
WatchTowr reproduced CVE-2026-19478 from the advisory and patch alone, then caught the first exploitation attempts on its honeypots. Self-managed owners do not get a week to schedule this.
Perspective Coverage
5 publishers
- Builder
- Builder 29%
- Operator
- Operator 63%
- Investor
- Investor 8%
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+20
- Incentives62
- Confidence70
Citrix confirmed CVE-2026-88779, a third exploited NetScaler zero-day, after appliances patched against the previous two began rebooting under attack. The vendor rates it denial of service, though logged payloads and a researcher's honeypot point toward code execution.
Perspective Coverage
11 publishers
- Builder
- Builder 19%
- Operator
- Operator 68%
- Investor
- Investor 13%
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap+20
- Incentives50
- Confidence70
Mandiant and Google traced a September 2026 campaign exploiting NetScaler bug CVE-2026-88772, CVSS 9.5, to root on appliances with no login. From there the intruders drop web shells and a Python tunneler that reaches into victims' internal networks to steal credentials.
Perspective Coverage
21 publishers
- Builder
- Builder 30%
- Operator
- Operator 62%
- Investor
- Investor 8%
Reality
- Evidence88
- Adoption82
- Hype gap−8
- Incentives58
- Confidence85
SonicWall's CVSS 10.0 SSRF chains into command execution on remote access appliances, and JFrog Artifactory hands unauthenticated attackers admin under default configuration. Reverse shells and miners are already landing.
Perspective Coverage
4 publishers
- Builder
- Builder 14%
- Operator
- Operator 72%
- Investor
- Investor 14%
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+10
- Incentives35
- Confidence68
buildConfirmed3 publishers Citrix confirmed attackers are exploiting two CVSS 9.5 pre-auth RCE flaws in NetScaler ADC and Gateway, one of them present in default configurations. Self-managed appliances need the fixed build, installed after evidence is saved, since an upgrade can erase signs of intrusion.
Perspective Coverage
3 publishers
- Builder
- Builder 22%
- Operator
- Operator 65%
- Investor
- Investor 13%
Reality
- Evidence76
- Adoption68
- Hype gap+5
- Incentives35
- Confidence74
Cisco says attackers are exploiting CVE-2026-76504, a 9.8-rated flaw that gives unauthenticated requests admin access to the Catalyst SD-WAN Manager API. Every configuration is affected, leaving exposed on-premises Managers needing an out-of-cycle upgrade and a check for earlier intrusion.
Perspective Coverage
12 publishers
- Builder
- Builder 14%
- Operator
- Operator 76%
- Investor
- Investor 10%
Reality
- Evidence85
- Adoption
- Not scored
- Hype gap+10
- Incentives40
- Confidence80
buildOne report1 publisher Patching NetScaler to 14.1-73.37 leaves planted webshells and persistence in place
Attackers using two NetScaler zero-days since early September left webshells that patching to 14.1-73.37 or 13.1-64.23 does not remove. Operators have to search every appliance for those traces, patched or not, and move OT remote access onto a jump host of its own.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+10
- Incentives30
- Confidence60
GitLab's September 10 patch release closes CVE-2026-85706, a CVSS 10.0 path confinement failure in the repository commits API. GitLab.com was already patched, so the exposure sits with self-managed servers.
Perspective Coverage
3 publishers
- Builder
- Builder 33%
- Operator
- Operator 62%
- Investor
- Investor 5%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+5
- Incentives30
- Confidence70
buildConfirmed2 publishers Attackers are chaining three self-hosted JFrog Artifactory flaws, one rated CVSS 9.8, to mint administrator tokens in under five minutes. Because every build resolves its packages through that one repository, it is as efficient to attack as to run.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+10
- Incentives30
- Confidence65
Citrix has patched eight NetScaler flaws, including two zero-days scored 9.5 that CISA says attackers are exploiting globally. The safest response costs a planned outage of remote access now and months of monitoring afterwards.
Reality
- Evidence74
- Adoption
- Not scored
- Hype gap+5
- Incentives35
- Confidence72
watchTowr tells NetScaler owners to pull gateways offline over zero-day CVE-2026-88771
watchTowr says attackers exploited CVE-2026-88771, a pre-auth command injection in default-config Citrix NetScaler, before any fix existed. Upgrading to 14.1-73.37 or 13.1-64.23 closes the hole, though a gateway exposed in that window may already have been used.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+25
- Incentives70
- Confidence50
watchTowr says attackers exploited two remote code execution flaws in Citrix NetScaler ADC and Gateway before any fix existed. The August patch for CVE-2026-19490 fixes a different bug, so every operator now has to decide whether to keep the box online and whether to assume it is breached.
Perspective Coverage
3 publishers
- Builder
- Builder 15%
- Operator
- Operator 73%
- Investor
- Investor 12%
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+10
- Incentives35
- Confidence60
A researcher published a GeoServer SQL injection on 12 August 2026 and watchTowr says probing started within hours. With no fix shipped, access control is the only lever available.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+20
- Incentives40
- Confidence60
watchTowr says attackers are already pulling cloud credentials through MLflow's Tracking Server, and VulnCheck logged scanning against a FUXA path traversal a day later.
Perspective Coverage
5 publishers
- Builder
- Builder 29%
- Operator
- Operator 63%
- Investor
- Investor 8%
Reality
- Evidence72
- Adoption55
- Hype gap+20
- Incentives35
- Confidence70
Kiteworks told customers worldwide to power off its file-sharing servers for six hours on September 26 after a federal warning of a possible attack. Servers with no internet exposure are included, so being on release 9.5.1 with every known fix does not by itself clear a customer.
Perspective Coverage
5 publishers
- Builder
- Builder 18%
- Operator
- Operator 73%
- Investor
- Investor 9%
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+20
- Incentives45
- Confidence62
Earlier coverage
- Feds say Siemens S7 controllers are already being probed, and the fix list is not a patch
Security · August 26, 2026 · Confirmed2 publishers
- Citrix called it a crash bug. It is unauthenticated RCE, and CISA gave agencies three days.
Security · August 26, 2026 · Confirmed7 publishers
- Chained PaperCut flaws let unauthenticated requests load attacker Java into the server process
Security · August 28, 2026 · Confirmed10 publishers
- A file.path parameter in GitLab's commit API reads server files before authentication
Build · September 11, 2026 · Confirmed3 publishers
- Two Artifactory flaws turned an anonymous JWT into admin in under five minutes
Security · September 11, 2026 · Confirmed4 publishers
- Forged admin JWTs are landing on WSO2 API Manager four months after the fix shipped
Security · September 16, 2026 · Confirmed2 publishers
- Attackers began probing WSO2's JWT bypass 133 days after the fixes went out
Build · September 17, 2026 · Confirmed2 publishers
- A manipulated Bearer header escalates privileges in Cleo Harmony through 5.8.1.10
Security · September 3, 2026 · Confirmed2 publishers