Threat reportVulnerabilityTL-2026-3448
September 2026 CVE Landscape: 94 high-impact vulnerabilities, NetScaler zero-days CVE-2026-88771/CVE-2026-88772, AI-agent-assisted exploitation
September 2026 CVE Landscape (TL-2026-3448), also tracked as September 2026 CVE Landscape, is a critical-severity software vulnerability scored CVSS 9.5, first published 2026-10-14. It is attributed to NightEagle with medium confidence, affects Citrix NetScaler ADC and Gateway, references 15 CVEs (CVE-2026-88771, CVE-2026-88772, CVE-2026-88779), maps to 18 MITRE ATT&CK techniques (T1003.001, T1003.006, T1014), and is covered by 9 detection rules and 19 indicators of compromise.
- CVSS
- 9.5/10Critical
- CVEs
- 15Referenced vulnerabilities
- Techniques
- 18MITRE ATT&CK
- Actors
- 3NightEagle
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 19Indicators of compromise
Key facts for TL-2026-3448
- Threat ID
- TL-2026-3448
- Also known as
- September 2026 CVE Landscape, NetScaler zero-days CVE-2026-88771/CVE-2026-88772
- Severity
- CRITICAL
- CVSS
- 9.5
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution
- NightEagle, UNC3569, ShinyHunters
- Attribution confidence
- MEDIUM
- Motivation
- ESPIONAGE
- Target sectors
- government administration, education, finance, telecoms, legal and professional services, manufacturing, construction, critical infrastructure, defense, energy
- Target regions
- North America, Europe, Asia, russia, Global
- Detection rules
- 9
- Indicators of compromise
- 19
Malware and tooling in September 2026 CVE Landscape
Malware and tooling: AgendaCrypt, Cyclops Blink, GRAYRABBIT, GhostContainer, Neo-reGeorg - S1189, SIDEEYE, SIXZUT, SLAPSHOT, AionUI / Hindsight / OpenAI Codex, JSP web shell and JAR-based command executor, MeshAgent, Neo-reGeorg
How September 2026 CVE Landscape works
Recorded Future's Insikt Group September 2026 review identifies 94 high-impact vulnerabilities (59 with Very Critical Risk Score, 80 actively exploited or weaponized, 75 with public PoC). Highlights include zero-day exploitation of Citrix NetScaler CVE-2026-88771 and CVE-2026-88772, exploitation of PaperCut, Cisco FMC, PeopleSoft, WordPress and Gitea flaws, and actors using AI agents in exploitation workflows.
This record aggregates Recorded Future's September 2026 CVE landscape review (Insikt Group) and the primary reporting behind its headline campaigns. The review counts 94 high-impact vulnerabilities (a 29% increase over August 2026), of which 59 carry a Very Critical Risk Score of 99, 47 enable remote code execution, 75 have public proof-of-concept code and 80 are actively exploited or weaponized. 58 vendors are affected; the oldest flaw is CVE-2014-6271 (Bash), and eight are five or more years old. Top weakness classes are CWE-306, CWE-22, CWE-78, CWE-89 and CWE-94. The source report publishes no IOCs and no per-CVE CVSS scores.
Citrix NetScaler ADC/Gateway zero-days: CVE-2026-88771 (improper input validation, CWE-20, unauthenticated command execution on default configurations) and CVE-2026-88772 (memory corruption, CWE-119, requires DTLS, which is enabled by default on VPN virtual servers) both carry CVSS v4 9.5. Rapid7 reports earliest exploitation attempts on 2026-09-20 and web shell deployment on 2026-09-24; Citrix disclosed and CISA added both to KEV on 2026-09-27. Mandiant/GTIG assess advanced, suspected state-sponsored actors are behind initial intrusions affecting dozens of organizations in North America and Europe (government, financial services, education, telecommunications, legal and professional services). Reported post-exploitation includes a web shell at /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver, httpd.conf changes so .deb files execute as PHP, web shells staged under /netscaler/gui/vpn/scripts/linux/, config hooks disguising shell execution as image requests, archives of nsroot password hashes, SSL certificates and private keys, and the SLAPSHOT TCP tunneling tool. A third flaw, CVE-2026-88779 (SAML memory overflow, CVSS 8.7), was disclosed and added to KEV on 2026-10-04. Fixed builds include 14.1-73.41 and 13.1-64.28 (and later).
Other campaigns in the review: (1) Cisco Secure FMC CVE-2026-20079 (CVSS 10.0, unauthenticated auth bypass to root script execution) and CVE-2026-20316 (static low-privileged credentials) were exploited by three Talos-tracked clusters: UAT-12197 (JSP web shell in the Tomcat webroot and a JAR-based command executor), UAT-11823 (Cyclops Blink variant, tooling overlapping Sandworm) and UAT-11988 (Qilin ransomware affiliates). (2) A suspected Russian-speaking actor used hundreds of AI agents (GreyNoise: OpenAI Codex as execution harness with a DeepSeek model, AionUI and Hindsight orchestration) to chain PaperCut NG/MF CVE-2026-81578 and CVE-2026-82078, compromising at least 440 instances across 395 organizations in 48 countries, 204 in education, with domain admin reached in at least 12 cases. (3) A suspected Chinese-speaking operator used the SecFlow framework with Claude, Qwen and DeepSeek workers against government and education targets in Asia (Hunt.io, 2026-09-03), routing model traffic via niestools.com proxies. (4) UNC6240/ShinyHunters re-exploited Oracle PeopleSoft CVE-2026-35273 (Environment Management Hub, CVSS 9.8, previously a zero-day 2026-05-27 to 2026-06-09), bypassing WAF rules with /%50SEMHUB/ instead of /PSEMHUB/ and deploying SIDEEYE, Neo-reGeorg and MeshAgent. (5) Red Heron (suspected Chinese) has exploited WordPress, Linux, Gitea and Proxmox VE since May 2026; Acronis documented 49 organizations via WordPress, 1,386 Gitea instances scanned across seven countries, confirmed compromises in Canada, Argentina, Taiwan, the U.S., Qatar and Sri Lanka, and a new Linux rootkit, SIXZUT. (6) UNC3569 exploited Tencent Sogou Input Method CVE-2026-51990 via a one-click custom-protocol link and an outdated embedded Chromium (CVE-2021-38003) to deploy the GRAYRABBIT backdoor. (7) NightEagle (Kaspersky) targets Russian manufacturing and construction firms with stolen VPN credentials, Cloudflare WARP routing, the GhostContainer in-memory backdoor on Exchange servers (incorporating Neo-reGeorg, a CVE-2020-0688 exploit and ysoserial's GhostWebShell), BlueKeep (CVE-2019-0708) lateral movement and Kerberos/DCSync-style credential abuse.
Defenders should prioritize patching internet-facing edge and management systems (NetScaler, Cisco FMC/ISE/SD-WAN, SonicWall, Check Point, Fortinet, F5, MikroTik, PaperCut, GitLab, SharePoint), review logs for the paths and behaviors above, and treat per-CVE detail as requiring verification against vendor advisories.
MITRE ATT&CK techniques used in TL-2026-3448
Credential Access
T1003.001 OS Credential Dumping: LSASS Memory; T1003.006 OS Credential Dumping: DCSync; T1552.004 Unsecured Credentials: Private Keys; T1555.003 Credentials from Password Stores: Credentials from Web Browsers; T1558 Steal or Forge Kerberos Tickets
Defense Evasion
T1014 Rootkit; T1036 Masquerading
Execution
T1059.004 Command and Scripting Interpreter: Unix Shell; T1204.001 User Execution: Malicious Link
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application
Command and Control
T1090 Proxy; T1219 Remote Access Tools; T1572 Protocol Tunneling
Persistence
T1505.003 Server Software Component: Web Shell
Resource Development
T1588.005 Obtain Capabilities: Exploits; T1588.007 Obtain Capabilities: Artificial Intelligence
Affected products and versions in September 2026 CVE Landscape
- Citrix — NetScaler ADC and Gateway
Vulnerable versions: Versions prior to 14.1-73.41; Versions prior to 13.1-64.28; 13.1-FIPS/NDcPP prior to 13.1.37.282
Fixed in: 14.1-73.41+; 13.1-64.28+; 13.1.37.282+ (FIPS/NDcPP) - Cisco — Secure Firewall Management Center (FMC) / Secure Cloud Control
Vulnerable versions: Releases vulnerable to CVE-2026-20079 and CVE-2026-20316
Fixed in: See Cisco advisories - PaperCut — PaperCut NG/MF
Vulnerable versions: Releases vulnerable to CVE-2026-81578 and CVE-2026-82078
Fixed in: See PaperCut advisories - Oracle — PeopleSoft Enterprise PeopleTools
Vulnerable versions: 8.61; 8.62
Fixed in: Oracle security update for CVE-2026-35273 - Tencent — Sogou Input Method
Vulnerable versions: Versions with outdated embedded Chromium (CVE-2026-51990)
Fixed in: See vendor update - Multiple — WordPress Core, Gitea, Proxmox VE, Microsoft Exchange/RDS and 50+ other vendors listed in the review
Vulnerable versions: Per-CVE; see Recorded Future review and vendor advisories
Fixed in: Per vendor
Remediation for September 2026 CVE Landscape
Patches
- Citrix NetScaler security bulletin for CVE-2026-88771/88772/88779
- Cisco Secure FMC advisories for CVE-2026-20079 and CVE-2026-20316
- Oracle PeopleSoft PeopleTools update for CVE-2026-35273
- Vendor updates for the PaperCut, WordPress, Gitea and Sogou Input Method CVEs
Immediate actions
- Patch Citrix NetScaler ADC/Gateway to 14.1-73.41+ / 13.1-64.28+ (FIPS/NDcPP 13.1.37.282+) and hunt for the .ctxs.receiver web shell and modified httpd.conf
- Rotate nsroot credentials, SSL certificates and private keys on any NetScaler that was exposed
- Patch Cisco FMC (CVE-2026-20079, CVE-2026-20316), PaperCut NG/MF (CVE-2026-81578, CVE-2026-82078) and Oracle PeopleSoft (CVE-2026-35273) and search logs for both /PSEMHUB/ and /%50SEMHUB/ requests
- Prioritize CISA KEV-listed edge and management-plane CVEs in the review
Workarounds
- Disable DTLS on NetScaler VPN virtual servers where feasible until patched (CVE-2026-88772)
- Disable or remove PeopleSoft Environment Management Hub where possible; do not rely on WAF rules alone
- Remove or update Sogou Input Method and its embedded Chromium
Longer-term hardening
- Restrict management interfaces (FMC, PaperCut, Gitea, Proxmox, Plesk) from direct internet exposure
- Deploy EDR and file-integrity monitoring on network appliances and Exchange servers
- Shorten patch SLAs: AI-agent-assisted actors reached remote code execution within hours of disclosure
- Enforce MFA and monitor VPN logins to counter stolen-credential access
CVEs associated with September 2026 CVE Landscape
Weaknesses (CWE) in September 2026 CVE Landscape
Timeline of September 2026 CVE Landscape
- UNC6240/ShinyHunters begins zero-day exploitation of Oracle PeopleSoft CVE-2026-35273 (window runs to 2026-06-09); Red Heron's broad WordPress/Linux/Gitea/Proxmox exploitation also dates from May 2026.
- Hunt.io reports a suspected Chinese-speaking operator using the SecFlow framework with Claude, Qwen and DeepSeek AI workers against Asian government and education targets.
- Acronis TRU publishes Red Heron's exploitation of a Gitea flaw and the new SIXZUT Linux rootkit.
- Kaspersky reports NightEagle targeting Russian manufacturing and construction firms with the GhostContainer backdoor on Exchange servers.
- Earliest observed exploitation attempts against Citrix NetScaler CVE-2026-88771/CVE-2026-88772 (Rapid7).
- NetScaler web shell deployment observed in the wild.
- Citrix discloses eight NetScaler flaws including zero-days CVE-2026-88771 and CVE-2026-88772; CISA adds both to KEV.
- Citrix NetScaler SAML flaw CVE-2026-88779 (CVSS 8.7) disclosed and added to KEV.
Sources cited for September 2026 CVE Landscape
- September 2026 CVE Landscape (Recorded Future / Insikt Group)
- Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772 (Rapid7)
- Suspected state-sponsored hackers exploited NetScaler zero-day since early September (Help Net Security)
- Citrix NetScaler RCE zero-days exploited globally for weeks (Help Net Security)
- Citrix Confirmed Two New NetScaler Flaws Exploited as Zero-Day (Security Affairs)
- Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers (BleepingComputer)
- AI agents exploited PaperCut flaws to breach 395 organizations (Help Net Security)
- Chinese-Speaking Operator Uses AI Agents to Target Government and Education Systems Across Asia (Hunt.io)
- Kaspersky identifies NightEagle campaign targeting organizations in Russia
- Three threat groups target Russian organizations (The Hacker News)
- Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit (Acronis TRU)
- Attackers bypass WAFs to exploit Oracle PeopleSoft (The Hacker News)
- Active Exploitation of Oracle PeopleSoft Zero-Day CVE-2026-35273 (Rapid7)
Detection coverage for TL-2026-3448
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3448 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.