# September 2026 CVE Landscape: 94 high-impact vulnerabilities, NetScaler zero-days CVE-2026-88771/CVE-2026-88772, AI-agent-assisted exploitation

> Recorded Future's Insikt Group September 2026 review identifies 94 high-impact vulnerabilities (59 with Very Critical Risk Score, 80 actively exploited or weaponized, 75 with public PoC). Highlights include zero-day exploitation of Citrix NetScaler CVE-2026-88771 and CVE-2026-88772, exploitation of PaperCut, Cisco FMC, PeopleSoft, WordPress and Gitea flaws, and actors using AI agents in exploitation workflows.

- **Published:** 2026-10-14T01:45:23Z
- **Last reviewed:** 2026-10-14T01:45:23Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3448
- **ID:** TL-2026-3448
- **Severity:** CRITICAL (CVSS 9.5)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** NightEagle
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-88771, CVE-2026-88772, CVE-2026-88779, CVE-2026-35273, CVE-2026-81578, CVE-2026-82078, CVE-2026-20079, CVE-2026-20316, CVE-2026-63030, CVE-2026-60137, CVE-2026-60004, CVE-2026-51990, CVE-2019-0708, CVE-2021-38003, CVE-2020-0688

## Description

This record aggregates Recorded Future's September 2026 CVE landscape review (Insikt Group) and the primary reporting behind its headline campaigns. The review counts 94 high-impact vulnerabilities (a 29% increase over August 2026), of which 59 carry a Very Critical Risk Score of 99, 47 enable remote code execution, 75 have public proof-of-concept code and 80 are actively exploited or weaponized. 58 vendors are affected; the oldest flaw is CVE-2014-6271 (Bash), and eight are five or more years old. Top weakness classes are CWE-306, CWE-22, CWE-78, CWE-89 and CWE-94. The source report publishes no IOCs and no per-CVE CVSS scores.

Citrix NetScaler ADC/Gateway zero-days: CVE-2026-88771 (improper input validation, CWE-20, unauthenticated command execution on default configurations) and CVE-2026-88772 (memory corruption, CWE-119, requires DTLS, which is enabled by default on VPN virtual servers) both carry CVSS v4 9.5. Rapid7 reports earliest exploitation attempts on 2026-09-20 and web shell deployment on 2026-09-24; Citrix disclosed and CISA added both to KEV on 2026-09-27. Mandiant/GTIG assess advanced, suspected state-sponsored actors are behind initial intrusions affecting dozens of organizations in North America and Europe (government, financial services, education, telecommunications, legal and professional services). Reported post-exploitation includes a web shell at /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver, httpd.conf changes so .deb files execute as PHP, web shells staged under /netscaler/gui/vpn/scripts/linux/, config hooks disguising shell execution as image requests, archives of nsroot password hashes, SSL certificates and private keys, and the SLAPSHOT TCP tunneling tool. A third flaw, CVE-2026-88779 (SAML memory overflow, CVSS 8.7), was disclosed and added to KEV on 2026-10-04. Fixed builds include 14.1-73.41 and 13.1-64.28 (and later).

Other campaigns in the review: (1) Cisco Secure FMC CVE-2026-20079 (CVSS 10.0, unauthenticated auth bypass to root script execution) and CVE-2026-20316 (static low-privileged credentials) were exploited by three Talos-tracked clusters: UAT-12197 (JSP web shell in the Tomcat webroot and a JAR-based command executor), UAT-11823 (Cyclops Blink variant, tooling overlapping Sandworm) and UAT-11988 (Qilin ransomware affiliates). (2) A suspected Russian-speaking actor used hundreds of AI agents (GreyNoise: OpenAI Codex as execution harness with a DeepSeek model, AionUI and Hindsight orchestration) to chain PaperCut NG/MF CVE-2026-81578 and CVE-2026-82078, compromising at least 440 instances across 395 organizations in 48 countries, 204 in education, with domain admin reached in at least 12 cases. (3) A suspected Chinese-speaking operator used the SecFlow framework with Claude, Qwen and DeepSeek workers against government and education targets in Asia (Hunt.io, 2026-09-03), routing model traffic via niestools.com proxies. (4) UNC6240/ShinyHunters re-exploited Oracle PeopleSoft CVE-2026-35273 (Environment Management Hub, CVSS 9.8, previously a zero-day 2026-05-27 to 2026-06-09), bypassing WAF rules with /%50SEMHUB/ instead of /PSEMHUB/ and deploying SIDEEYE, Neo-reGeorg and MeshAgent. (5) Red Heron (suspected Chinese) has exploited WordPress, Linux, Gitea and Proxmox VE since May 2026; Acronis documented 49 organizations via WordPress, 1,386 Gitea instances scanned across seven countries, confirmed compromises in Canada, Argentina, Taiwan, the U.S., Qatar and Sri Lanka, and a new Linux rootkit, SIXZUT. (6) UNC3569 exploited Tencent Sogou Input Method CVE-2026-51990 via a one-click custom-protocol link and an outdated embedded Chromium (CVE-2021-38003) to deploy the GRAYRABBIT backdoor. (7) NightEagle (Kaspersky) targets Russian manufacturing and construction firms with stolen VPN credentials, Cloudflare WARP routing, the GhostContainer in-memory backdoor on Exchange servers (incorporating Neo-reGeorg, a CVE-2020-0688 exploit and ysoserial's GhostWebShell), BlueKeep (CVE-2019-0708) lateral movement and Kerberos/DCSync-style credential abuse.

Defenders should prioritize patching internet-facing edge and management systems (NetScaler, Cisco FMC/ISE/SD-WAN, SonicWall, Check Point, Fortinet, F5, MikroTik, PaperCut, GitLab, SharePoint), review logs for the paths and behaviors above, and treat per-CVE detail as requiring verification against vendor advisories.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078 Valid Accounts
- T1204.001 User Execution: Malicious Link
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1505.003 Server Software Component: Web Shell
- T1036 Masquerading
- T1014 Rootkit
- T1003.001 OS Credential Dumping: LSASS Memory
- T1003.006 OS Credential Dumping: DCSync
- T1558 Steal or Forge Kerberos Tickets
- T1552.004 Unsecured Credentials: Private Keys
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1572 Protocol Tunneling
- T1090 Proxy
- T1219 Remote Access Tools
- T1588.005 Obtain Capabilities: Exploits
- T1588.007 Obtain Capabilities: Artificial Intelligence

## Sources

- [September 2026 CVE Landscape (Recorded Future / Insikt Group)](https://www.recordedfuture.com/blog/september-2026-cve-landscape)
- [Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772 (Rapid7)](https://rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772)
- [Suspected state-sponsored hackers exploited NetScaler zero-day since early September (Help Net Security)](https://www.helpnetsecurity.com/?p=386307)
- [Citrix NetScaler RCE zero-days exploited globally for weeks (Help Net Security)](https://www.helpnetsecurity.com/?p=385886)
- [Citrix Confirmed Two New NetScaler Flaws Exploited as Zero-Day (Security Affairs)](https://securityaffairs.com/?p=199873)
- [Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers (BleepingComputer)](https://bleepingcomputer.com/news/security/cisco-fmc-flaws-exploited-by-ransomware-gang-state-sponsored-hackers)
- [AI agents exploited PaperCut flaws to breach 395 organizations (Help Net Security)](https://www.helpnetsecurity.com/?p=384371)
- [Chinese-Speaking Operator Uses AI Agents to Target Government and Education Systems Across Asia (Hunt.io)](https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia)
- [Kaspersky identifies NightEagle campaign targeting organizations in Russia](https://www.kaspersky.com/about/press-releases/kaspersky-identifies-nighteagle-campaign-targeting-organizations-in-russia)
- [Three threat groups target Russian organizations (The Hacker News)](https://thehackernews.com/2026/09/three-threat-groups-target-russian.html)
- [Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit (Acronis TRU)](https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/)
- [Attackers bypass WAFs to exploit Oracle PeopleSoft (The Hacker News)](https://thehackernews.com/2026/09/attackers-bypass-wafs-to-exploit-oracle.html)
- [Active Exploitation of Oracle PeopleSoft Zero-Day CVE-2026-35273 (Rapid7)](https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3448