September 2026 Threat Brief

A month driven by exploited edge and management devices, led by two Citrix NetScaler flaws and a CVSS 10 Magento remote-code-execution bug, alongside the largest Microsoft Patch Tuesday on record. Breaches came mostly from unpatched web applications and third-party integrations, and police took over the KillSec ransomware leak site on 30 Sep.

Top items

Citrix NetScaler: two critical flaws, one with unauthenticated root command execution

Critical · exploited

Citrix disclosed CVE-2026-88771 and CVE-2026-88772 on Sunday 27 Sep. CISA added both to the KEV catalog the same day. The first lets an unauthenticated attacker run commands on any NetScaler ADC or Gateway. The second is a memory overflow reachable when DTLS is enabled, which is the default on VPN virtual servers. Mandiant says attacks began in at least early September, in North America and Europe, and that the observed campaign is tied to CVE-2026-88772. It deployed a PHP web shell (WHIPSHOT) and a Python tunnelling tool (SLAPSHOT) and set the setuid bit on /bin/sh to keep root. GreyNoise saw a failed attempt on 24 Sep, three days before disclosure. Citrix says 88771 is also exploited. Sources differ on which flaw the early attacks used.

CVE: CVE-2026-88771
CVE-2026-88772
CVSS: 9.5 (both)
CISA KEV: 27 Sep, federal deadline 30 Sep
Citrix advisory: CTX697096

Action: Install the latest NetScaler security updates now. Disabling DTLS or blocking inbound UDP/443 helps only against 88772 and does not protect against 88771. Because attacks predate disclosure, check appliances for web shells and a setuid /bin/sh going back to early September.

StyleSmuggler: unauthenticated RCE in Magento and Adobe Commerce

Critical · exploited

Attackers inject PHP into Magento's template system and trigger it through a failed-payment email. Sansec recorded unsuccessful probes on 23 Aug and the first confirmed exploitation on 4 Sep. Adobe shipped a hotfix on 7 Sep. All versions from 2.4.4 through 2.4.9 are affected. Adobe tested the fix only on the August 2026 releases of those branches and publishes no fix for 2.2, 2.3 or 2.4.0 to 2.4.3. A successful attack starts a small Rust backdoor that connects to a command server and hides under process names such as chronyd. Sansec has no sign yet that the backdoor has been used. Other operators left web shells and a RAT on some stores.

CVE: CVE-2026-75650
CVSS: 10.0
Adobe bulletin: APSB26-146, hotfix VULN-39341
First exploitation: 4 Sep

Action: Apply the Adobe hotfix and confirm it covers your exact release. Review templates and email logs for injected PHP, and look for processes named kworker/u:8:0, fc-cache, or chronyd running from unexpected paths. Stores older than 2.4.4 have no vendor fix and need an upgrade or isolation.

Microsoft Patch Tuesday: record volume, two exploited zero-days, a wormable DNS flaw

High · exploited

The 8 Sep release was the largest on record. Microsoft's notes list 974 CVEs, of which 964 need customer action (104 Critical, 860 Important). Third-party trackers report totals from 966 to 973 depending on how they count. Two local privilege escalation bugs, both CVSS 7.8, were exploited before the patch: one in the Windows Update stack and one in Windows ALPC that allows escape from an AppContainer sandbox. Trend Micro ZDI calls the DNS flaw CVE-2026-69730 the spiritual successor to SigRed. It is one of 20 wormable bugs that allow unauthenticated remote code execution on most supported Windows versions.

Exploited: CVE-2026-81963 (Windows Update stack)
CVE-2026-85880 (Windows ALPC)
Wormable DNS: CVE-2026-69730
Other notable: CVE-2026-69676 (Kerberos, domain controller RCE)
CVE-2026-55007 (Exchange, malicious Visio attachment)

Action: Patch Windows DNS servers and domain controllers first, then the two exploited bugs, Exchange, and endpoints. A public proof of concept reportedly bypasses the patch for the Defender flaw CVE-2026-69414, so verify Defender versions after updating.

Exploited vulnerabilities and zero-days

Product	CVE	What it allows	Status
Citrix NetScaler ADC / Gateway	CVE-2026-88771, CVE-2026-88772	Unauthenticated command execution (88771). Memory overflow leading to RCE or denial of service when DTLS is on (88772).	Exploited CISA KEV 27 Sep. Exploited since early Sep per Mandiant.
Cisco Secure Firewall Management Center	CVE-2026-20079	Unauthenticated authentication bypass, script execution, and possible root access. Talos tracks three clusters, including Qilin ransomware operators (UAT-11988) and a group with tooling that overlaps Sandworm (UAT-11823).	Exploited CISA KEV, federal deadline 12 Sep. The Sandworm link is tooling overlap only, not confirmed attribution.
Magento / Adobe Commerce 2.4.4 to 2.4.9	CVE-2026-75650	Unauthenticated RCE through template injection (CVSS 10.0)	Exploited Hotfix 7 Sep. No fix for versions older than 2.4.4.
Check Point Security Gateway / Spark	CVE-2026-85102	Pre-authentication bypass and remote code execution	Exploited Patched 9 Sep. Exploitation attempts from 12 Sep. CISA KEV 22 Sep.
Check Point Management Server	CVE-2026-93616	Pre-authentication path traversal, upload and execution of scripts on the management server	Exploited Attacks since at least 23 Jul against a handful of customers. Hotfix SK1000171. CISA KEV 22 Sep.
F5 BIG-IP APM	CVE-2026-94127	Unauthenticated heap overflow leading to RCE (CVSS 9.8 v3.1, 9.3 v4.0)	Exploited Advisory 22 Sep. F5 later limited the condition to APM acting as an OAuth authorization server. CISA KEV wording is broader.
Arista VeloCloud Orchestrator	CVE-2026-93952	Improper input validation in the SD-WAN management platform. Details withheld.	Exploited CISA KEV 22 Sep. Arista published indicators of compromise.
Cisco Secure Email Gateway	CVE-2026-76461	Unauthenticated root command execution through a crafted email carrying SQL statements (CVSS 9.8)	Exploited Fixed in 15.5.5-0141, 16.0.4-302, 16.5.0-780. No workaround. CISA KEV 14 Sep.
WordPress core	CVE-2026-87902	Unauthenticated RCE when a theme directory begins with "page-" and a readable local PHP file such as pearcmd.php exists (CVSS 9.2)	Exploited Fixed in 7.1.2, 7.0.6, 6.9.9, 6.8.10. First attempt 22 Sep, same day as the patch. CISA KEV 25 Sep.
Windows Update stack · Windows ALPC	CVE-2026-81963 · CVE-2026-85880	Local privilege escalation to SYSTEM (CVSS 7.8 each)	Exploited Zero-days fixed in the 8 Sep Patch Tuesday.
Cisco Catalyst SD-WAN Manager	CVE-2026-76504	Unauthenticated admin access	Exploited Advisory and CISA KEV 30 Sep.
Zammad helpdesk 6.3.0 to 6.5.4	CVE-2026-102489 / 102490	Privilege escalation chain used to breach DIVD, the Dutch vulnerability-disclosure institute. Investigators describe the intrusion as agentic-AI-driven.	Exploited Reported 30 Sep. CISA KEV.

Supply chain

Brevo (email platform)

A flaw in Brevo's SAML single sign-on was used against 138 customer accounts. Trezor warned about 347,000 newsletter addresses after phishing emails went out from its own sending address, and BitBox and CoinTracking were also affected. Reported 9 Sep.

Dropbox via Lenovo ID

About 5,000 Dropbox accounts were taken over through a flaw in Lenovo's email verification for Lenovo ID, a legacy integration. Reported 2 Sep. Only an email address was needed to register a Lenovo ID that could sign in to the linked Dropbox account.

BigCommerce / Ribon apps

A compromised application key for the Ribon apps, tied to a Fastr system breach, was used to inject malicious scripts into a small number of storefronts. BigCommerce says its own platform was not breached. Merchants were notified from 17 to 18 Sep and the number of affected stores and shoppers has not been published.

npm

On 7 Sep Aikido Security reported four npm packages published by one account within an hour, carrying a Shai-Hulud payload with the same hash as one used in the 19 May @antv compromise. The payload runs from a preinstall script. The sources do not say how the publishing account was accessed or whether other packages were affected.

AI coding agents

More than 13,000 sensitive screenshots taken during agent-driven development workflows were found committed to public GitHub repositories, reported 29 Sep to 1 Oct.

Scope of this section

No September npm, PyPI, or GitHub Actions compromise on the scale of earlier 2026 incidents turned up in the sources reviewed.

Data breaches

Organization	People / records	Cause and data
Gyazo (Helpfeel)	~23.62M user records, ~490M image metadata records	Vulnerability in the image upload server exploited 11 Sep. Names or nicknames, emails, password hashes, device and session IDs, X integration tokens. Metadata includes upload IPs and EXIF location. No payment data.
Times Car (Park24 / Times Mobility)	Up to ~6.6M accounts; ~1.6M confirmed with ID documents	Unauthorized access to web systems detected 25 Sep. Names, addresses, dates of birth, driver's license details, passwords stored unrecoverably. 6.6M is a stated maximum and the final count is under investigation. One tracker lists ~1.6M as the confirmed figure.
US Defense Manpower Data Center	~3.05M (2.76M living, 294K deceased)	Flaw in a file-sharing system, patched 16 Jul. Unencrypted SSNs and personnel data accessed from Oct 2025. Reporting dates differ: one tracker lists 24 Sep, Help Net Security is dated 1 Oct.
Mathspace	1,079,819 people	Unpatched self-hosted Metabase instance
Seicomart (Secoma)	572,022 accounts	Cause not disclosed. Reported 29 Sep.
Ludwig Maximilian University of Munich	~600,000 data sets	Cause not disclosed. Reported 19 Sep.
Weverse (HYBE)	422,584 accounts	Vulnerability exploitation. Reported 6 Sep.
Brevo customers (Trezor, BitBox, CoinTracking)	347,000 Trezor email addresses	SAML single sign-on flaw reached 138 Brevo accounts. Used to send phishing.
Japan Digital Agency (Government Solution Service)	~246,000 records	VPN flaw exploited. Reported 11 Sep.
Veradigm	Not disclosed. Gentlemen group claims 3.5M patient records.	Vendor credentials for a Veradigm API used to copy patient data. 8-K filed 8 Sep. Veradigm says clinical data was not involved and some records may include SSNs.
DriveWealth (Revolut, Stake, Hatch customers)	No total. Notices list 62,000+ Rhode Island residents.	Social engineering on 4 to 5 Sep. Names, contact details, citizenship, partial account numbers. No passwords or card data.
Dropbox (via Lenovo ID)	~5,000 accounts	Lenovo email verification flaw, described under Supply chain

Unverified claims: IDScan.net (company confirmed unauthorized access to its VeriScan cloud environment; a seller's claim of 153M+ licenses has not been confirmed and no victim count is published). CenterPoint Energy (8-K filed 14 Sep confirms access affecting a portion of customers; the attacker's 7.49M records and unauthenticated API cause are unconfirmed). FBI jobs portal (ShinyHunters claims a PeopleSoft zero-day and 2 to 3 TB; the FBI is investigating and has not confirmed a breach). Florida DMV DAVID database (200,000+ claimed; the agency attributes access to a police user's credentials stored on a personal device, and reports differ on data types). Services Australia Medicare statistics portal (a tracker lists an OpenAI research agent reaching non-public files, with no evidence of data theft; a vendor blog dates the access to 18 Jun and the public announcement to 24 Sep; the mechanism is disputed). Bitget (the CEO says she suspects a North Korean group; the exchange has not made a formal attribution).

Law enforcement and research

KillSec takedown

On 30 Sep, in an operation called KillSwitch led by Hamburg police and prosecutors, authorities took control of the ransomware group's leak site and secured at least 110 TB of data. Three people were provisionally arrested and eight searches were carried out in Greece, Romania, Spain, and the United Kingdom. A 16-year-old is named as the suspected main operator. The group is linked to about 1,000 suspected attacks, about 500 of them identified as successful, and the figures may change as evidence is analysed. Ten countries, Europol, and Eurojust took part, with support from Bitdefender and Group-IB. Police announced it on 1 Oct.

Liquid Network (Blockstream)

On 6 Sep roughly 4,000 of the 4,200 BTC in the federation wallet was drained after a bug in the Elements code let unbacked L-BTC be redeemed through SideSwap's peg-out. The attackers returned about 3,400 BTC (~$262.6M) and kept about 598 BTC (~$47M). One report says no keys or credentials were stolen.

Bitget

On 24 Sep the exchange reported unauthorized transfers from a limited number of hot wallets and suspended withdrawals. The loss was first put at about $351.6M and revised to about $387.5M on 25 Sep. The attack method has not been described in the sources reviewed.

Research and disclosure

A public proof of concept called ShieldCrash reportedly bypasses the patch for the Microsoft Defender privilege escalation flaw CVE-2026-69414 (ShieldBreak), which was fixed on 8 Sep. No Pwn2Own event or major conference disclosure dated September was found in the sources reviewed.

Certificate and trust failures

No certificate authority or root store incident dated September was found in the sources reviewed.

What to do

Update every NetScaler ADC and Gateway, then hunt for WHIPSHOT, SLAPSHOT, and a setuid /bin/sh dating back to early September.

Apply the Adobe hotfix to Magento and Adobe Commerce, and move any store older than 2.4.4 to a supported release.

Patch Check Point gateways and management servers, F5 BIG-IP APM, Arista VeloCloud, and Cisco Secure Email Gateway, then check for prior compromise, since patching does not evict an attacker already inside.

Restrict management interfaces for Check Point, Cisco FMC, and VeloCloud to trusted internal addresses.

Apply the September Patch Tuesday updates, starting with DNS servers, domain controllers, and the two exploited privilege escalation bugs.

Update WordPress to 7.1.2, 7.0.6, 6.9.9 or 6.8.10 and check themes for directories beginning with page-.

Enforce multifactor authentication on SaaS and consumer-linked accounts, and remove legacy sign-in integrations such as Lenovo ID where they are not needed.

Rotate API keys and application credentials held by third-party apps and email or e-commerce platforms, and review which vendors hold long-lived keys to your systems.