September 2026 CVE Landscape
Recorded Future says 80 vulnerabilities were actively exploited in September 2026, including NetScaler zero-days.
In September 2026, Recorded Future's Insikt Group prioritized 94 high-impact vulnerabilities, 59 with a Very Critical risk score, a 29% increase from the prior month. Forty-three came from CISA's KEV catalog, 37 from validated open sources, and 14 from honeypot data alone, spanning 58 vendors. The published table lists 80 vulnerabilities as actively exploited or operationally weaponized, including NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 and renewed PeopleSoft exploitation of CVE-2026-35273. Reporting also linked NightEagle and UNC3569 to GhostContainer and GRAYRABBIT, and Cisco FMC exploitation to credential theft, Cyclops Blink, and Qilin ransomware.