Cisco patched CVE-2026-76519, an exploited Secure Email Gateway flaw that gives unauthenticated attackers root through a crafted email attachment. Devices with File Reputation enabled and Content Scanner Tools earlier than 25.3.0.5525 are affected.
Perspective Coverage
5 publishers
- Builder
- Builder 13%
- Operator
- Operator 76%
- Investor
- Investor 11%
Reality
- Evidence82
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence78
Volexity says UTA0576 used a zero-day chain to get unauthenticated root on a fully patched Ivanti Connect Secure 22.8R2.4 VPN. Ivanti's Integrity Checker Tool does not flag it, so the check for lateral movement from the VPN device falls to forensics.
Perspective Coverage
10 publishers
- Builder
- Builder 15%
- Operator
- Operator 70%
- Investor
- Investor 15%
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap+8
- Incentives40
- Confidence78
SonicWall patched four flaws in its SMA 1000 VPN gateways, led by CVE-2026-102255, a server-side request forgery open to remote attackers without credentials. The company reports no exploitation, though attackers used two similar SMA 1000 flaws as zero-days this year.
Perspective Coverage
4 publishers
- Builder
- Builder 23%
- Operator
- Operator 67%
- Investor
- Investor 10%
Reality
- Evidence72
- Adoption30
- Hype gap+8
- Incentives
- Not scored
- Confidence70
Public exploit for CVE-2026-88771 turns a quiet NetScaler zero-day into internet-wide attacks
A public proof-of-concept for CVE-2026-88771 pushed a stealthy NetScaler zero-day into mass exploitation, with fewer than 10% of exposed hosts patched. Citrix admits its detection script may miss intrusions, so exposed appliances should be treated as breached.
Reality
- Evidence60
- Adoption70
- Hype gap+8
- Incentives35
- Confidence62
Citrix confirmed CVE-2026-88779, a third exploited NetScaler zero-day, after appliances patched against the previous two began rebooting under attack. The vendor rates it denial of service, though logged payloads and a researcher's honeypot point toward code execution.
Perspective Coverage
11 publishers
- Builder
- Builder 19%
- Operator
- Operator 68%
- Investor
- Investor 13%
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap+20
- Incentives50
- Confidence70
Mandiant and Google traced a September 2026 campaign exploiting NetScaler bug CVE-2026-88772, CVSS 9.5, to root on appliances with no login. From there the intruders drop web shells and a Python tunneler that reaches into victims' internal networks to steal credentials.
Perspective Coverage
21 publishers
- Builder
- Builder 30%
- Operator
- Operator 62%
- Investor
- Investor 8%
Reality
- Evidence88
- Adoption82
- Hype gap−8
- Incentives58
- Confidence85
Fortinet says attackers are exploiting a CVSS 9.8 unauthenticated file-write flaw in FortiMail, and no fixed release has shipped yet. Until builds arrive, its two workarounds are the only protection, including for 7.2 users told to move to a 7.4 branch that is still unpatched.
Perspective Coverage
10 publishers
- Builder
- Builder 10%
- Operator
- Operator 82%
- Investor
- Investor 8%
Reality
- Evidence78
- Adoption30
- Hype gap+8
- Incentives40
- Confidence76
CVE-2026-76460 scores a CVSS 10.0, affects Cisco ISE and ISE-PIC in every configuration, and has no workaround. CISA added it to the KEV catalog the day the patches shipped and gave federal agencies three days.
Perspective Coverage
10 publishers
- Builder
- Builder 16%
- Operator
- Operator 74%
- Investor
- Investor 10%
Reality
- Evidence82
- Adoption
- Not scored
- Hype gap+5
- Incentives30
- Confidence80
Citrix fixed CVE-2026-88772, a pre-auth DTLS memory overflow in NetScaler exploited as a zero-day and one of two exploited flaws in Sunday's advisory. The vulnerable handshake runs before authentication, so an internet-facing appliance answers a crafted packet with no login.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+8
- Incentives
- Not scored
- Confidence58
buildConfirmed3 publishers Citrix confirmed attackers are exploiting two CVSS 9.5 pre-auth RCE flaws in NetScaler ADC and Gateway, one of them present in default configurations. Self-managed appliances need the fixed build, installed after evidence is saved, since an upgrade can erase signs of intrusion.
Perspective Coverage
3 publishers
- Builder
- Builder 22%
- Operator
- Operator 65%
- Investor
- Investor 13%
Reality
- Evidence76
- Adoption68
- Hype gap+5
- Incentives35
- Confidence74
Google Threat Intelligence Group counted 10,740 vulnerability disclosures in August, more than double the monthly figure at the start of 2026. Exploitation is rising more slowly, so the first call on any budget reopened this quarter is triage capacity.
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+25
- Incentives45
- Confidence65
Three exploited flaws, three very different exposure classes. The self-hosted Metabase zero-day is the one with an unpatched population behind it.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence55
Huntress has seen exploitation in two customer environments. One flaw hands over PaperCut's configuration without a login, the second turns that configuration into a class loader, so patching and config review are one job.
Perspective Coverage
10 publishers
- Builder
- Builder 27%
- Operator
- Operator 60%
- Investor
- Investor 13%
Reality
- Evidence85
- Adoption70
- Hype gap−10
- Incentives40
- Confidence78
The advisory confirming attacks on a Security Gateway VPN flaw three days after its September 9 fix also carries the first patch for a management path traversal that was used in targeted attacks in late July.
Perspective Coverage
6 publishers
- Builder
- Builder 21%
- Operator
- Operator 70%
- Investor
- Investor 9%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+5
- Incentives60
- Confidence70
F5 disclosed CVE-2026-94127 on September 22 with hotfixes and evidence of exploitation. It is a data plane heap overflow, so a locked-down management interface still leaves the system exploitable, and federal agencies had until September 25.
Perspective Coverage
6 publishers
- Builder
- Builder 19%
- Operator
- Operator 64%
- Investor
- Investor 17%
Reality
- Evidence78
- Adoption40
- Hype gap+10
- Incentives30
- Confidence75
The bureau has not confirmed a breach and says it cannot yet tell whether its own systems or a third-party provider were the way in, while Reuters and 404 Media report that sample records match real personnel.
Perspective Coverage
3 publishers
- Builder
- Builder 22%
- Operator
- Operator 63%
- Investor
- Investor 15%
Reality
- Evidence55
- Adoption45
- Hype gap+30
- Incentives80
- Confidence60
Vicarius puts a human reviewer and a deterministic judge between its AI-written fixes and production
ScriptAI drafts detection and remediation logic for software flaws that have no vendor patch behind them. Vicarius says the draft, review and verify cycle finishes in under an hour, against weeks by hand. It is live for vRx customers today.
Reality
- Evidence32
- Adoption12
- Hype gap+35
- Incentives80
- Confidence40
Volexity dates UTA0565's exploitation to September 3 and 4, five to six days before it first reported the chain publicly, delivered from typosquats of China Digital Times and the Center for American Progress and ending in a new implant it calls CLEANGULP.
Reality
- Evidence72
- Adoption58
- Hype gap+8
- Incentives52
- Confidence64
buildOne report1 publisher Google flags possible limited exploitation of Pixel modem bypass; CISA says active exploitation confirmed
The September Pixel bulletin closes a logic error in the cellular modem that escalates privileges from an adjacent position with no user interaction, and published guidance for checking a device stops at the patch level.
Reality
- Evidence55
- Adoption30
- Hype gap−10
- Incentives45
- Confidence50
Cisco Patches 44 CVEs Across ISE, FMC, Nexus Dashboard; Separately Warns of Exploited ISE Authentication Bypass Zero-Day
Twelve of the 20 Identity Services Engine CVEs Cisco fixed on September 16 are critical and three were public before the patch, but all three need an administrator account, so the queue starts elsewhere.
Reality
- Evidence58
- Adoption52
- Hype gap−10
- Incentives40
- Confidence62