September 2026 CVE Landscape
Recorded Future says 80 vulnerabilities were actively exploited in September 2026, including NetScaler zero-days.
85
Threat actor
NightEagle
- Mentions · 7d0
- Mentions · 30d1
- All mentions8
- First seenSep 16, 2026
- Last mentioned20d ago
Timeline
8 articles · newest firstNightEagle Uses BlueKeep and DCSync to Move Toward Active Directory Domain Controllers
NightEagle espionage group used GhostContainer, BlueKeep exploitation, and DCSync attempts to compromise Russian organizations and target Active Directory controllers.
75
Hacking group ‘NightEagle’ targeting China’s high-tech sector expands operations to Russia
Kaspersky reports the NightEagle espionage group (APT-Q-95) expanded from China-focused targets to Russian companies, backdooring Microsoft Exchange servers with GhostContainer using stolen VPN credentials.
68
NightEagle Hackers Abuse Microsoft Dev Tunnels and GhostContainer to Breach Russian Companies
NightEagle (APT-Q-95) breached Russian firms using stolen VPN credentials, a GhostContainer Exchange backdoor, Dev Tunnels abuse, and DCSync.
74
NightEagle Hackers Abuse Microsoft Dev Tunnels and GhostContainer to Breach Russian Companies
Kaspersky links NightEagle (APT-Q-95) intrusions in Russia to stolen VPN credentials, the GhostContainer Exchange backdoor, and Microsoft Dev Tunnels abuse.
72
NightEagle Hackers Target Russian Companies Using GhostContainer Backdoor
Kaspersky links NightEagle (APT-Q-95) intrusions in Russia to stolen VPN credentials, the GhostContainer Exchange backdoor, BlueKeep exploitation, and covert tunneling for espionage.
74
Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers
Kaspersky details NightEagle, Hacking Cat, and Toy Ghouls targeting Russian enterprises with Exchange backdoors, Gorilla RAT, and destructive Monkey ransomware.
76
NightEagle targets Russian companies
Kaspersky links NightEagle (APT-Q-95) attacks on Russian firms to compromised VPN credentials, a GhostContainer Exchange backdoor, RDP tunneling, BlueKeep exploitation, and DCSync.
74
Related CVEs
by mentions- CVE-2019-0708100%9.8Unauthenticated RCE in Microsoft Remote Desktop Services (BlueKeep)
- CVE-2020-0688100%8.8RCE in Microsoft Exchange Server from Shared Install-Time Validation Keys
- CVE-2026-543022%10.0Unauthenticated JWT Algorithm Bypass in WSO2 API Manager and Gateways
- CVE-2021-44228100%10.0JNDI Injection Remote Code Execution in Apache Log4j2 (Log4Shell)
- CVE-2022-22965100%9.8Unauthenticated RCE in VMware Spring Framework (Spring4Shell) - JDK 9+ Tomcat WARs
- CVE-2026-1949033%9.3Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gateway
- CVE-2026-7136290%9.1Unauthenticated Privilege Escalation Flaw in Adobe Commerce (Magento)
- CVE-2026-72733%8.8Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
- CVE-2026-58704<1%8.8Permission Bypass in Google Pixel Cellular Modem Allows Proximal Privilege Escalation
- CVE-2026-4871070%6.5HTTP Request Smuggling in Kludex Starlette (CVE-2026-48710)
Appears with
- GhostContainermalware · 8
- Kasperskyvendor · 7
- APT-Q-95threat actor · 7
- Microsoft Exchangeproduct · 7
- Microsoftvendor · 6
- Microsoft dev tunnelsproduct · 3
- rdp2tcpproduct · 3
- Kasperskyorganization · 2
- Windowsproduct · 2
- GhostContainerproduct · 2
- rdp2tcpmalware · 2
- Fortinetvendor · 1
- NightEagleorganization · 1
- Active Directoryproduct · 1
- QiAnXinvendor · 1
- Monkey ransomwaremalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.