- CVE-2026-86218: Another Unauthenticated RCE Vulnerability in N-able N-central Under Active Exploitation
- Living on the Edge: Increasing Threats Against Network Perimeter Infrastructure
- Three Actively Exploited Vulnerabilities in Citrix NetScaler ADC and Gateway
- Two Additional SonicWall SMA1000 Vulnerabilities Enter CISA’s KEV Catalog
- CVE-2025-25249: Active Attacks Exploit a Critical Fortinet FortiOS Vulnerability
- CVE-2026-94127: F5 BIG-IP APM OAuth Vulnerability Enables Unauthenticated RCE and Is Actively Exploited
- Multiple Critical Vulnerabilities Affect Check Point Security Products, Including Two Under Active Exploitation
- Adobe Commerce and Magento: Two Exploited Vulnerabilities Threaten PHP Execution Security and Customer Accounts
- CVE-2026-28326: Embedded Cryptographic Key Exposes SolarWinds Access Rights Manager to Unauthenticated RCE
- Ivanti Resolves Six Critical Vulnerabilities in Neurons for ITSM
- Summary
Security debt is accumulating across enterprise IT environments at an increasingly alarming rate, with many organizations failing to address exposures before additional vulnerabilities emerge. Despite the scale of the problem, regular vulnerability scanning, systematic risk prioritization, and prompt security updates remain essential measures for preventing attackers from exploiting software weaknesses. Organizations operating structured and coordinated security programs can still maintain effective vulnerability management practices. However, environments with insufficient security controls may require greater vulnerability management maturity to prevent unresolved exposures from escalating into severe security incidents.
The following report examines the most significant high-risk vulnerabilities and security developments affecting enterprise IT during September 2026.
CVE-2026-86218: Another Unauthenticated RCE Vulnerability in N-able N-central Under Active Exploitation
- CVSS 9.8 · Critical
- EPSS 12.9% (96th percentile)
- Actively exploited
- CISA KEV
- Public PoC
CVE-2026-86218 (CVSS 9.8, EPSS ≥ 96th percentile) is a critical remote code execution (RCE) vulnerability that can be exploited without authentication in N-able N-central releases earlier than 2026.3.1.14. The weakness results from insufficient neutralization of directives within statically stored code, classified as [CWE-96]. The vulnerability is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog. Publicly accessible exploitation resources include a comprehensive technical examination, a Metasploit module, and at least one other proof-of-concept (PoC) exploit. Their availability further increases the likelihood of continued malicious activity.
Two additional N-central vulnerabilities were included in CISA’s KEV catalog during the preceding month. Greenbone also issued two separate security notifications concerning N-central vulnerabilities in 2025[1][2]. The associated risks are particularly significant because N-central provides remote administration capabilities for corporate IT departments and Managed Service Providers (MSPs). An attacker gaining control of an N-central server could potentially compromise multiple customer environments administered through the platform.
N-able addressed CVE-2026-86218 in N-central 2026.3 HF4, build 2026.3.1.14. Installed versions and patch levels require careful verification because the preceding 2026.3 HF3 release was issued just days earlier to resolve CVE-2026-86206 and CVE-2026-86207. CVE-2026-86206 is also believed to be exploited in real-world attacks. Meanwhile, Previdian has identified attempts to exploit CVE-2026-86207 against its monitoring sensors, and an in-depth technical assessment of the vulnerability has been published.
The OPENVAS ENTERPRISE FEED provides a remote banner-based detection check for CVE-2026-86218. CVE-2026-86206 and CVE-2026-86207 are covered by a separate remote banner check and an active vulnerability test.
Living on the Edge: Increasing Threats Against Network Perimeter Infrastructure
The latest Verizon DBIR 2026 indicates that exploitation of vulnerabilities in publicly accessible software has become the leading initial-access method worldwide. Greenbone’s OPENVAS SCAN (Enterprise) offers extensive capabilities for identifying vulnerabilities in perimeter infrastructure through network-based assessments and authenticated host-level scanning. Combined with the OPENVAS ENTERPRISE FEED, these capabilities provide industry-leading vulnerability detection coverage.
Several particularly dangerous vulnerabilities affecting network-edge technologies emerged during September 2026.
Three Actively Exploited Vulnerabilities in Citrix NetScaler ADC and Gateway
During September, CISA added three vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway to its KEV catalog. Two of them, CVE-2026-88771 (CVSS 9.8) and CVE-2026-88772 (CVSS 8.1), were disclosed toward the end of September. The third, CVE-2026-19490 (CVSS 9.8), was initially published in August 2026.
Public information regarding these vulnerabilities includes multiple detailed technical investigations and proof-of-concept exploits. The availability of these resources increases the potential for further exploitation.
The three vulnerabilities added to CISA’s KEV catalog are outlined below, along with their CVSS severity ratings and EPSS exploitation probability estimates.
CVE-2026-88771
- CVSS 9.8 · Critical
- EPSS 1.1% (63rd percentile)
An improper input validation vulnerability [CWE-20] permits arbitrary remote code execution without authentication. NetScaler ADC and NetScaler Gateway installations are susceptible when operating with their default configurations.
CVE-2026-19490
- CVSS 9.8 · Critical
- EPSS 8.0% (95th percentile)
An authentication bypass vulnerability involving an alternative access route [CWE-288] allows unauthenticated remote attackers to target affected appliances. Successful exploitation requires the appliance to operate as a Gateway or AAA virtual server. Certain newer vulnerable builds additionally require a configured SAML action.
The consequences vary according to the appliance configuration. Potential outcomes include denial-of-service (DoS) conditions and, in the case of vulnerable Gateway deployments, the possibility of obtaining an anonymous authenticated VPN session. Such a session could provide access to an organization’s internal network.
CVE-2026-88772
- CVSS 8.1 · High
- EPSS 1.3% (69th percentile)
A memory overflow vulnerability [CWE-119] may enable remote code execution or cause denial-of-service conditions. Exploitation requires DTLS to be enabled. This protocol is activated by default in VPN virtual server deployments.
The following table identifies vulnerable release ranges and the corresponding corrected versions.
| CVE | Affected versions | Fixed versions |
| CVE-2026-88771 | – NetScaler ADC and Gateway 14.1 до 14.1-73.37 – NetScaler ADC and Gateway 13.1 до 13.1-64.23 – NetScaler ADC FIPS to 14.1-73.37 – NetScaler ADC FIPS and NDcPP to 13.1-37.279 | – NetScaler ADC and Gateway 14.1-73.37 or later – NetScaler ADC and Gateway 13.1-64.23 or later – NetScaler ADC 14.1-FIPS 14.1-73.37 FIPS or later – NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.279 or later |
| CVE-2026-19490 | – NetScaler ADC and Gateway 14.1 до 14.1-73.32 – NetScaler ADC and Gateway 13.1 до 13.1-63.21 – NetScaler ADC FIPS tо 14.1-73.32 – NetScaler ADC FIPS and NDcPP до 13.1-37.277 | – NetScaler ADC та Gateway 14.1-73.32 or later – NetScaler ADC та Gateway 13.1-63.21 or later – NetScaler ADC 14.1-FIPS 14.1-73.32 FIPS or later – NetScaler ADC 13.1-FIPS та 13.1-NDcPP 13.1-37.277 or later |
| CVE-2026-88772 | – NetScaler ADC та Gateway 14.1 до 14.1-73.37 – NetScaler ADC and Gateway 13.1 до 13.1-64.23 – NetScaler ADC FIPS to 14.1-73.37 – NetScaler ADC FIPS and NDcPP to 13.1-37.279 | – NetScaler ADC та Gateway 14.1-73.37 or later – NetScaler ADC та Gateway 13.1-64.23 or later – NetScaler ADC 14.1-FIPS 14.1-73.37 FIPS or later – NetScaler ADC 13.1-FIPS та 13.1-NDcPP 13.1.37.279 or later |
Citrix has not released any alternative workarounds for these vulnerabilities. Consequently, affected environments require upgrades to the appropriate corrected builds listed above.
Shortly after the vulnerabilities became public, the OPENVAS ENTERPRISE FEED introduced a remote banner-based version detection check covering CVE-2026-88771 and CVE-2026-88772. CVE-2026-19490 is addressed through a separate remote banner check and an active detection test.
Two Additional SonicWall SMA1000 Vulnerabilities Enter CISA’s KEV Catalog
SonicWall has acknowledged active exploitation of two recently identified vulnerabilities affecting SMA1000 appliances.
Both vulnerabilities have been included in CISA’s KEV catalog. Their severity classifications and EPSS scores are presented below.
CVE-2026-83548
- CVSS 10 · Critical
- EPSS 8.8% (95th percentile)
A server-side request forgery (SSRF) vulnerability [CWE-918] exists in the Appliance Work Place interface and can be exploited before authentication. The underlying issue involves an unintended alternative access route. An unauthenticated remote attacker may exploit this weakness to access restricted functionality and carry out operations without authorization.
CVE-2026-83549
- CVSS 7.8 · High
- EPSS 10.8% (96th percentile)
An operating system command injection vulnerability [CWE-78] affects the Appliance Management Console (AMC). An authenticated remote attacker possessing administrative credentials can exploit the issue to execute arbitrary commands at the operating system level.
By combining both vulnerabilities into a single attack sequence, adversaries can achieve unauthenticated remote code execution on affected appliances. A Metasploit module implementing this exploitation chain is publicly available.
SonicWall addressed the two vulnerabilities through a combined security update documented in advisory SNWLID-2026-0016. The OPENVAS ENTERPRISE FEED introduced a remote banner-based check covering both issues within hours of their public disclosure.
| Products | Affected versions | Fixed versions |
| SonicWall SMA1000 (6210, 7210, 8200v) | – 12.4.3-03453 and earlier – 12.5.0-02835 and earlier | – 12.4.3-03526 – 12.5.0-02952 |
CVE-2025-25249: Active Attacks Exploit a Critical Fortinet FortiOS Vulnerability
- CVSS 9.8 · Critical
- EPSS 3.9% (90th percentile)
- Actively exploited
- CISA KEV
CVE-2025-25249 (CVSS 9.8, EPSS ≥ 90th percentile) was publicly disclosed in January 2026. The vulnerability originates from a heap-based buffer overflow [CWE-122] in Fortinet’s cw_acd daemon. This component serves as the CAPWAP (Control and Provisioning of Wireless Access Points) Access Controller daemon.
The vulnerable functionality is accessible through the network, allowing unauthenticated attackers to execute arbitrary code remotely on affected FortiOS, FortiSwitchManager, and FortiSASE systems.
Within FortiOS, the set allowaccess fabric interface configuration enables the Security Fabric Connection service. This service incorporates both FortiTelemetry functionality and the CAPWAP endpoint.
Threat actors have actively exploited CVE-2025-25249 since July 2026. CISA subsequently included the vulnerability in its KEV catalog in September.
Observed attacks have involved the deployment of PivotC2, a newly identified Node.js-based malware strain. At least 178 victims have been confirmed in connection with these attacks.
The affected product versions and available fixes are detailed below.
| Product | Affected versions | Fixed versions |
| FortiOS | – 7.6.0 through 7.6.3 – 7.4.0 through 7.4.8 – 7.2.0 through 7.2.11 – 7.0.0 through 7.0.17 – all 6.4 releases | – 7.6.4 – 7.4.9 – 7.2.12 – 7.0.18 |
| FortiSwitchManager | – 7.2.0 through 7.2.6 – 7.0.0 through 7.0.5 | – 7.2.7 – 7.0.6 |
| FortiSASE | – 25.2.b – 25.1.a.2 | – 25.2.c – 25.1.b |
Fortinet identifies two potential mitigation approaches: removing Fabric access permissions from individual interfaces or preventing access to the CAPWAP daemon.
Affected organizations should assess their exposure and either implement the recommended mitigation or upgrade their devices to patched versions. FortiOS 6.4 installations require migration to a supported release branch containing the security fix.
Following disclosure, Greenbone promptly incorporated package-level vulnerability detection for CVE-2025-25249 in FortiOS into the OPENVAS ENTERPRISE FEED. The feed also provides ongoing detection coverage for newly discovered security issues affecting Fortinet technologies.
CVE-2026-94127: F5 BIG-IP APM OAuth Vulnerability Enables Unauthenticated RCE and Is Actively Exploited
- CVSS 9.8 · Critical
- EPSS 2.2% (82nd percentile)
- Actively exploited
- CISA KEV
CVE-2026-94127 (CVSS 9.8, EPSS ≥ 82nd percentile) is a critical heap-based buffer overflow vulnerability [CWE-122] in F5 BIG-IP APM. Exploitation can result in remote code execution without authentication and complete compromise of the affected system.
The vulnerable configuration requires an APM access policy and an OAuth profile to be associated with the same virtual server. Implementations that use APM exclusively as an OAuth Client or Resource Server are not vulnerable.
The exploitation process involves submitting an oversized Authorization: Bearer HTTP header to an OAuth endpoint, such as /f5-oauth2/v1/userinfo.
F5 has confirmed that attackers are exploiting this weakness in real-world environments. CISA has also entered the vulnerability into its KEV catalog. In addition, watchTowr Labs has released a technical analysis describing the exploitation mechanism.
F5 offers an official workaround based on iRules for customers holding an active support agreement. Other temporary defensive measures include restricting access to OAuth endpoints through IP allow-listing or web application firewall (WAF) rules. Disabling the OAuth Authorization Server is another mitigation option when that functionality is unnecessary.
The OPENVAS ENTERPRISE FEED contains package-level detection for CVE-2026-94127 in F5 BIG-IP APM. It also maintains regular vulnerability detection coverage for other F5 products.
The vulnerable release branches and their corresponding hotfixes are listed below.
| Affected versions | Patched hotfixes |
| 17.1.0 до Hotfix-BIGIP-17.1.3.5.0.41.14-ENG | 17.1.0 Hotfix-BIGIP-17.1.3.5.0.41.14-ENG |
| 17.5.0 до Hotfix-BIGIP-17.5.1.9.0.160.12-ENG | 17.5.0 Hotfix-BIGIP-17.5.1.9.0.160.12-ENG |
| 21.1.0 до Hotfix-BIGIP-21.1.0.2.0.30.22-ENG | 21.1.0 Hotfix-BIGIP-21.1.0.2.0.30.22-ENG |
Multiple Critical Vulnerabilities Affect Check Point Security Products, Including Two Under Active Exploitation
Check Point has confirmed active attacks exploiting two critical security vulnerabilities. The first, CVE-2026-85102 (CVSS 9.8, EPSS ≥ 94th percentile), affects VPN certificate processing in Check Point Quantum Security Gateway and Spark Firewall products. The second, CVE-2026-93616 (CVSS 9.8, EPSS ≥ 97th percentile), affects the Check Point management web service.
Both vulnerabilities have been incorporated into CISA’s KEV catalog.
Two other critical vulnerabilities were also disclosed during September. CVE-2026-85103 (CVSS 9.8, EPSS ≥ 89th percentile) and CVE-2026-91843 (CVSS 9.8, EPSS ≥ 42nd percentile) affect components associated with VPN functionality and security management.
Check Point has observed attacks directed at Spark customers worldwide, originating from anonymized IP addresses. The vendor additionally reported internal port and service scanning as part of post-exploitation activity.
Although the Security Management and Log Server is not generally classified as an edge network service, Censys identified 3,836 instances exposed to the public internet globally.
The four critical Check Point vulnerabilities are described below, including their CVSS ratings and EPSS exploitation likelihood estimates.
CVE-2026-85102
- CVSS 9.8 · Critical
- EPSS 7.5% (94th percentile)
Insufficient certificate trust verification [CWE-295] during VPN negotiations in Check Point Quantum Security Gateway enables unauthenticated remote attackers to execute arbitrary code on the gateway.
CVE-2026-93616
- CVSS 9.8 · Critical
- EPSS 19.7% (97th percentile)
A directory traversal vulnerability [CWE-22] enables an unauthenticated attacker to upload arbitrary scripts to Check Point Management Server and execute them.
CVE-2026-85103
- CVSS 9.8 · Critical
- EPSS 3.7% (89th percentile)
A heap-based buffer overflow [CWE-122] occurs during the decoding of ASN.1 data in VPN certificates. The vulnerability can be exploited remotely without authentication to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems.
CVE-2026-91843
- CVSS 9.8 · Critical
- EPSS 0.5% (42nd percentile)
A stack overflow vulnerability [CWE-121] in the login procedure allows unauthenticated remote attackers to execute arbitrary code with root-level privileges.
The OPENVAS ENTERPRISE FEED supports remote banner-based detection for CVE-2026-85102 and CVE-2026-85103 through a combined check. Separate remote banner checks are provided for CVE-2026-93616 and CVE-2026-91843.
Remediation efforts in environments using vulnerable Check Point products should focus primarily on internet-accessible VPN infrastructure and security management interfaces. The two vulnerabilities already being exploited in the wild warrant the highest remediation priority.
Adobe Commerce and Magento: Two Exploited Vulnerabilities Threaten PHP Execution Security and Customer Accounts
Adobe has disclosed two critical vulnerabilities affecting Adobe Commerce and Magento Open Source.
The first, CVE-2026-75650 (CVSS 10, EPSS ≥ 90th percentile), is known as StyleSmuggler. It involves a template-engine vulnerability [CWE-1336] that can permit arbitrary remote code execution without authentication.
The second, CVE-2026-71362 (CVSS 9.1, EPSS = 100th percentile), results from improper authorization controls [CWE-863] and enables privilege escalation.
Adobe has confirmed active exploitation of CVE-2026-75650. Both vulnerabilities are included in CISA’s KEV catalog and have been identified as requiring forensic investigation.
According to research published by Sansec, the StyleSmuggler attack begins with an unauthenticated request directed at Magento’s GraphQL endpoint.
Attackers can construct specially crafted HTTP requests that insert malicious PHP code through HTTP headers and parameters into the template-processing workflow. The injected code is subsequently executed when the system automatically renders email messages.
Sansec has also determined that CVE-2026-71362 allows attackers to switch an existing customer session to a different customer’s account. Successful exploitation can expose private information belonging to other customers.
The OPENVAS ENTERPRISE FEED includes individual remote banner-based detection checks for CVE-2026-75650 and CVE-2026-71362 affecting Adobe Commerce and Magento Open Source.
Adobe resolved CVE-2026-71362 through security update APSB26-138. A subsequent hotfix, VULN-39341, was issued to address CVE-2026-75650 (StyleSmuggler).
Both security fixes must be deployed according to the relevant affected release branches.
Adobe additionally recommends rotating potentially exposed encryption keys, OAuth client secrets, and third-party extension integration tokens. The recommendation also extends to payment credentials and other credentials associated with privileged access.
CVE-2026-28326: Embedded Cryptographic Key Exposes SolarWinds Access Rights Manager to Unauthenticated RCE
- CVSS 8.8 · High
- EPSS 0.7% (51st percentile)
CVE-2026-28326 (CVSS 8.8) is a remote code execution vulnerability affecting SolarWinds Access Rights Manager (ARM) versions earlier than 2026.2.1. Exploitation does not require prior authentication.
The underlying weakness involves the use of a hard-coded static cryptographic key [CWE-321]. Successful exploitation can lead to complete compromise of the affected system.
Some technical information regarding the vulnerability has already been disclosed publicly, potentially facilitating the development of working exploits.
The issue involves the ARM gRPC service operating on TCP port 55555. During TLS authentication, the service fails to correctly process connections that do not provide a client certificate. Instead of rejecting the connection, it redirects authentication to a fallback mechanism.
This alternative authentication path accepts an HMAC token created using a hard-coded secret. Consequently, an attacker who generates a valid token can authenticate without presenting a client certificate.
SolarWinds Access Rights Manager is designed to provision, revoke, administer, and audit user permissions across corporate networks. Its scope includes access to systems, files, and organizational data, including resources managed through Microsoft Active Directory, Exchange, and SharePoint.
Because ARM occupies a central position in enterprise access administration, remediation of CVE-2026-28326 is particularly important. The risk becomes more significant when ARM services can be reached from untrusted IP addresses.
A remote banner-based vulnerability check for CVE-2026-28326 in SolarWinds ARM is available in the OPENVAS ENTERPRISE FEED.
The vulnerability affects ARM 2026.2 and every earlier release.
For installations where immediate patching is not feasible, SolarWinds strongly advises preventing public internet exposure of ARM and limiting connectivity to trusted IP addresses.
Complete remediation requires upgrading affected installations to version 2026.2.1 without unnecessary delay.
Ivanti Resolves Six Critical Vulnerabilities in Neurons for ITSM
Ivanti has published security advisories covering eight newly identified vulnerabilities in Neurons for ITSM versions preceding 2026.2. All eight vulnerabilities can potentially enable remote code execution on the affected server.
Six vulnerabilities have received critical severity ratings. Two can be exploited by unauthenticated attackers, whereas the remaining vulnerabilities require an authenticated session.
The identified weaknesses include insecure deserialization [CWE-502] and missing authorization controls [CWE-862].
No confirmed exploitation in the wild has been reported so far. Nevertheless, Ivanti technologies have frequently been targeted by cybercriminal groups, including operators conducting ransomware attacks.
Ivanti Neurons for ITSM enables IT administrators and support teams to manage service requests, incidents, problems, and change-management processes.
Successful exploitation could allow attackers to interfere with service-desk records, compromise credentials, and manipulate connected integrations. It could also create opportunities for lateral movement deeper into an organization’s IT infrastructure.
The affected deployment types, vulnerable releases, and required remediation measures are outlined below.
| Deployment | Affected versions | Fix status |
| Ivanti ITSM On-premises | 2025.2, 2025.3, 2025.4, 2026.1 | Install the September 2026 Security Patch corresponding to the deployed version branch |
| Ivanti ITSM On-premises (released September 21, 2026) | 2026.2 | Not affected |
According to Ivanti’s published security advisories, cloud customers already benefit from the necessary protections. However, administrators operating on-premises installations must deploy the appropriate security patches to address the vulnerabilities. The OPENVAS ENTERPRISE FEED incorporated a remote banner-based detection check covering all eight identified Neurons for ITSM vulnerabilities immediately following their disclosure.
Summary
September 2026 demonstrated a rapid increase in the number of critical vulnerabilities affecting enterprise IT infrastructure. Security issues identified in N-able N-central, Citrix NetScaler, SonicWall, Fortinet, F5, Check Point, Adobe Commerce, and Ivanti Neurons ITSM highlight the persistent risks associated with exposed enterprise systems.
The scale and severity of these vulnerabilities reinforce the importance of maintaining continuous visibility into organizational attack surfaces. Consistent vulnerability scanning, risk-based remediation prioritization, and timely patch deployment remain the foundations of effective vulnerability management. These measures are essential for reducing opportunities for attackers to exploit software weaknesses and minimizing the potential operational consequences of successful attacks.
