BeyondTrust says a suspected China-nexus actor has exploited Remote Support flaw CVE-2026-102764 since late August. SaaS customers were patched on October 8, but self-hosted installs without automatic updates must be updated by hand.
Perspective Coverage
8 publishers
- Builder
- Builder 16%
- Operator
- Operator 67%
- Investor
- Investor 17%
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap+5
- Incentives40
- Confidence76
Cisco patched CVE-2026-76519, an exploited Secure Email Gateway flaw that gives unauthenticated attackers root through a crafted email attachment. Devices with File Reputation enabled and Content Scanner Tools earlier than 25.3.0.5525 are affected.
Perspective Coverage
5 publishers
- Builder
- Builder 13%
- Operator
- Operator 76%
- Investor
- Investor 11%
Reality
- Evidence82
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence78
Attackers began targeting SonicWall's maximum-severity SMA1000 flaw CVE-2026-102255 within three days of its patch, Previdian's honeypots show. SonicWall's advisory had not called it exploited by Friday, so owners waiting on that label are patching behind the attackers.
Perspective Coverage
7 publishers
- Builder
- Builder 17%
- Operator
- Operator 77%
- Investor
- Investor 6%
Reality
- Evidence66
- Adoption25
- Hype gap+28
- Incentives40
- Confidence72
Citrix urged NetScaler customers to patch CVE-2026-107406, a memory overflow that allows remote code execution on appliances set up as SAML IdP or SP. The company says it knows of no attacks so far, on a product line where it has patched exploited zero-days twice in recent weeks.
Perspective Coverage
5 publishers
- Builder
- Builder 30%
- Operator
- Operator 61%
- Investor
- Investor 9%
Reality
- Evidence83
- Adoption60
- Hype gap+12
- Incentives42
- Confidence84
SonicWall patched four flaws in its SMA 1000 VPN gateways, led by CVE-2026-102255, a server-side request forgery open to remote attackers without credentials. The company reports no exploitation, though attackers used two similar SMA 1000 flaws as zero-days this year.
Perspective Coverage
4 publishers
- Builder
- Builder 23%
- Operator
- Operator 67%
- Investor
- Investor 10%
Reality
- Evidence72
- Adoption30
- Hype gap+8
- Incentives
- Not scored
- Confidence70
CVE-2026-58231 is an unauthenticated, CVSS 10.0 code execution bug in Commerce Cloud's Data Hub Adapter. Defused says attempts hit its honeypots three days after patch day.
Perspective Coverage
4 publishers
- Builder
- Builder 21%
- Operator
- Operator 66%
- Investor
- Investor 13%
Reality
- Evidence62
- Adoption55
- Hype gap+25
- Incentives45
- Confidence68
buildConfirmed2 publishers Kiteworks fixed CVE-2026-54154, a CVSS 10.0 flaw letting unauthenticated attackers run code on its Email Protection Gateway, in version 9.4.1. Other EPG flaws disclosed the same day are fixed only in 9.5.1, so internet-facing gateways should go straight to that release.
Reality
- Evidence70
- Adoption35
- Hype gap+5
- Incentives
- Not scored
- Confidence68
Kiteworks lifted its worldwide shutdown advice after patching a critical flaw in a feature used by under 1% of customers. Self-hosted operators stopped and restarted on the vendor's word alone, with no CVE yet to check the fix against.
Perspective Coverage
5 publishers
- Builder
- Builder 23%
- Operator
- Operator 60%
- Investor
- Investor 17%
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+15
- Incentives70
- Confidence60
A third party published CVE-2026-63520 before the planned date, and two public gadget chains now reach the same flaw by different routes. One signature will not cover both.
Reality
- Evidence72
- Adoption40
- Hype gap+5
- Incentives45
- Confidence70
CVE-2026-8452 shipped as a June 30 denial-of-service fix. A WatchTowr proof of concept turned it into pre-auth code execution, and in-the-wild exploitation followed.
Perspective Coverage
7 publishers
- Builder
- Builder 14%
- Operator
- Operator 80%
- Investor
- Investor 6%
Reality
- Evidence78
- Adoption50
- Hype gap−40
- Incentives
- Not scored
- Confidence74
CISA now flags CVE-2025-14733 as used in ransomware attacks, nine months after WatchGuard shipped the fix. Shadowserver's scans show the exposed population fell from more than 115,000 to nearly 9,000, and that remainder is the target set.
Reality
- Evidence70
- Adoption85
- Hype gap+5
- Incentives30
- Confidence72
CVE-2026-59310 gave a suspected APT crew persistence on vCenter systems in August. CISA has now flagged the same directory traversal as abused by ransomware operators. Broadcom patched it on July 29.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+15
- Incentives40
- Confidence65
CISA said Sept. 23 that ransomware crews are exploiting CVE-2026-63077, an unauthenticated 9.8 RCE in JetBrains TeamCity patched July 25. Any build server patched late has to be handled as breached, including the credentials and signing keys it held.
Reality
- Evidence70
- Adoption75
- Hype gap+15
- Incentives35
- Confidence72
F5 disclosed CVE-2026-94127 on September 22 with hotfixes and evidence of exploitation. It is a data plane heap overflow, so a locked-down management interface still leaves the system exploitable, and federal agencies had until September 25.
Perspective Coverage
6 publishers
- Builder
- Builder 19%
- Operator
- Operator 64%
- Investor
- Investor 17%
Reality
- Evidence78
- Adoption40
- Hype gap+10
- Incentives30
- Confidence75
Some of the 50-plus Zimbra bugs Rapid7 found let attackers send mail as someone else without credentials
Rapid7's research with Zimbra turned up more than 50 vulnerabilities, several of which let an attacker send mail as another user with no password involved. The operational item today is CVE-2026-73570, the SNMP command injection CISA gave federal agencies three days to fix.
Reality
- Evidence55
- Adoption60
- Hype gap+25
- Incentives78
- Confidence55
CISA gives federal agencies three days to fix the ScreenConnect flaw already under attack
ConnectWise's stopgap is to switch off file transfers in ScreenConnect, and with CISA's exploited-flaw listing now carrying a three-day federal deadline, more than 1,000 exposed servers still run the unpatched build.
Reality
- Evidence62
- Adoption70
- Hype gap+12
- Incentives45
- Confidence60
buildOne report1 publisher Check Point ships this week's VPN fix as a live patch for three versions and an upgrade for the rest
Two unauthenticated Check Point RCEs, a CVSS 10.0 GitLab path traversal and an already-exploited N-able flaw all came due on September 11. How fast each one closes depends on the release you happen to be running.
Reality
- Evidence35
- Adoption40
- Hype gap+30
- Incentives30
- Confidence40
buildOne report1 publisher Exploitation beat CVE publication for about 256 vulnerabilities last year
VulnCheck logged 884 vulnerabilities with first-time exploitation evidence in 2025, and 28.96% of them were already being exploited by the day their CVE appeared, up from 23.6% a year earlier. The same report calls the year's timing highly consistent with 2024.
Reality
- Evidence52
- Adoption
- Not scored
- Hype gap+18
- Incentives78
- Confidence48
ConnectWise tells ScreenConnect admins to strip file-transfer rights before its patch lands
ConnectWise says the fix arrives later this week. Until it does, the only step it offers is a hand-edited per-role permission change that turns off file transfer inside support sessions, on cloud and on-premises alike.
Reality
- Evidence42
- Adoption34
- Hype gap+12
- Incentives66
- Confidence52
Exploit attempts hit NetScaler's August auth bypass 15 days after Citrix shipped the fix
The mid-August Citrix advisory that many teams parked behind lower-risk work now has attack traffic behind it, and the appliances in scope are the ones fronting remote access. Role and firmware decide scope, not appliance count.
Reality
- Evidence60
- Adoption34
- Hype gap+15
- Incentives58
- Confidence58