Research

September 2026 CVE Landscape

In September 2026, Insikt Group® identified 94 high-impact vulnerabilities that should be prioritized for remediation, 59 of which had a Very Critical Recorded Future Risk Score. This represents a 29% increase from last month.

Read at Recorded Future Insikt Group

EPSS

1.00 (p100)

• Recorded Future Insikt Group (recordedfuture.com)
• CVE-2026-88771 on this site · NVD · CVE.org · Vulnpedia
• CVE-2026-88772 on this site · NVD · CVE.org · Vulnpedia
• CVE-2026-35273 on this site · NVD · CVE.org · Vulnpedia
• CVE-2019-0708 on this site · NVD · CVE.org · Vulnpedia
• CVE-2021-38003 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 79
   Tenable research Tenable 2d ago

   php2shell one week later: Why one exploit doesn’t work everywhere

   Exploited CVSS 9.2 EPSS 0.16 Fix available CVE-2026-109618CVE-2026-109619CVE-2021-44228+1 more PHP
2. 22
   News The Register 3d ago

   Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble

   CVE-2026-101767CVE-2026-35273 Oracle
3. 24
   Research ZDI 4d ago

   CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft

   CVE-2026-35273 Oracle
4. 36
   Talos research Talos 11d ago

   There's only so much code: the rise in vulnerability numbers

   EPSS 1.00 Fix available CVE-2021-44228 Microsoft
5. 25
   Research Eclypsium 11d ago

   Fake Kernel Threads Are Hiding Backdoors on Linux Servers and Appliances

   CVE-2026-75650CVE-2026-20079 Adobe Linux kernel
6. 74
   Research Rapid7 12d ago

   Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

   Exploited EPSS 0.78 CVE-2026-88771CVE-2026-88779CVE-2026-88772 Citrix Rapid7
7. 47
   Research Cloudflare 12d ago

   Beyond the patch: Protecting your NetScaler gateway against future vulnerabilities

   EPSS 0.78 CVE-2026-88771CVE-2026-88772 Citrix
8. 92
   Research ThreatLabz 15d ago

   CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability

   Exploited CVSS 9.8 EPSS 0.82 CVE-2026-88771CVE-2026-107406CVE-2026-75650 Citrix
9. 97
   Threat signal FortiGuard 23d ago

   Citrix NetScaler RCE zero-day Vulnerabilities

   Exploited CVSS 9.5 EPSS 0.78 Fix available CVE-2026-88771CVE-2026-88772 Citrix
10. 14
    KrebsOnSecurity Krebs 24d ago

    ShinyHunters Extorted Boeing Spin-off Prior to Arrests

    CVE-2026-35273
11. 22
    Research Check Point Research 26d ago

    5th October – Threat Intelligence Report

    EPSS 0.26 CVE-2026-88771CVE-2026-88772CVE-2026-76504+2 more
12. 74
    Research Unit 42 30 Sep 2026

    Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)

    Exploited EPSS 0.78 CVE-2026-88771CVE-2026-88772 Citrix
13. 74
    Threat intelligence Google TIG 29 Sep 2026

    Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances

    Exploited EPSS 0.78 CVE-2026-88772CVE-2026-88771CVE-2026-88778 Google Citrix
14. 49
    watchTowr Labs watchTowr 29 Sep 2026

    Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772)

    EPSS 0.78 CVE-2026-88772CVE-2026-88771CVE-2026-88773+6 more Citrix
15. 14
    KrebsOnSecurity Krebs 28 Sep 2026

    Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation

    CVE-2026-35273
16. 49
    watchTowr Labs watchTowr 28 Sep 2026

    Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)

    EPSS 0.78 CVE-2026-88771CVE-2026-88772CVE-2026-88773+5 more Citrix
17. 74
    Research Sophos X-Ops 28 Sep 2026

    Citrix NetScaler vulnerabilities (CVE-2026-88771, CVE-2026-88772) in active exploitation

    Exploited EPSS 0.78 CVE-2026-88771CVE-2026-88772 Citrix
18. 90
    KEV NVD 27 Sep 2026

    Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

    KEV · due 30 Sep 2026 (overdue) EPSS 0.78 Fix available CVE-2026-88772 Citrix
19. 90
    KEV NVD 27 Sep 2026

    Citrix NetScaler Improper Input Validation Vulnerability

    KEV · due 30 Sep 2026 (overdue) EPSS 0.82 Fix available CVE-2026-88771 Citrix
20. 80
    CISA alert CISA 27 Sep 2026

    Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway

    Exploited EPSS 0.78 No fix yet CVE-2026-107406CVE-2026-88779CVE-2026-88771+7 more Citrix