CVE Volume Surges This Week, But Exploitation Stays Focused on High-Value Enterprise Systems

By SAFE Threat Research Team

This week’s vulnerability landscape is noisy, but attacker activity is not. Real-world exploitation is clustering around technologies that control access, software delivery, and endpoint execution, turning individual flaws into paths for root access, administrative control, persistence, and downstream compromise.

Across Cisco, JFrog Artifactory, GitLab, and BlueMoon activity, attackers are gaining leverage from systems that already hold privileged access, credentials, secrets, or execution paths into the wider environment. The result is a smaller set of exploited vulnerabilities with the potential for disproportionate downstream impact.

Vulnerability Landscape

This week saw a sharp increase in disclosure volume, with 4,333 CVEs published and 2,124 rated high or critical. Public exploit availability, however, remained comparatively limited: only 12 vulnerabilities showed public exploit or PoC signals, with no weaponized signals recorded in this week’s dataset.

Trending Vulnerabilities

20 CVEs showed confirmed exploitation signals, including six newly published vulnerabilities and 14 pre-existing CVEs.

The heavier concentration in older vulnerabilities is significant. Attackers continue to extract value from flaws that remain exposed in enterprise infrastructure even after disclosure and patch availability. At the same time, this week’s newer exploitation activity shows rapid movement against products positioned at high-trust points in the environment, including security infrastructure, software-delivery platforms, and endpoint software.

Top CVEs to Watch

Cisco Secure Email Gateway CVE-2026-76461: Crafted Emails Lead Directly to Root Command Execution

CVE-2026-76461 is a critical SQL injection vulnerability in Cisco Secure Email Gateway that is being actively exploited. The flaw sits in AsyncOS email-parsing logic and can be triggered simply by sending a specially crafted email through an affected gateway. No authentication or management-interface access is required. Successful exploitation allows arbitrary SQL execution and can progress to OS command execution with root privileges. Cisco disclosed the vulnerability on September 14, assigned it a CVSS score of 9.8, and confirmed exploitation in the wild; CISA added it to KEV the same day.

The exposure model makes this particularly significant: the malicious input reaches the vulnerability through the appliance’s core mail-processing function rather than through an administrative interface. Cisco has identified malicious activity on some Secure Email Cloud devices and warns that root-level access could allow attackers to remove or conceal evidence of compromise. Administrators can inspect mail_logs for suspicious SQL activity, but external firewall and network telemetry are also important because evidence on the appliance itself may be incomplete. There is no workaround; affected on-premises deployments should move to fixed releases, and suspected compromises should trigger the renewal of credentials and cryptographic materials in addition to patching.

GitLab CVE-2026-85706: Actively Exploited File Read Exposes CI/CD Secrets

CVE-2026-85706 is a critical path-traversal vulnerability affecting self-managed GitLab CE and EE. Under affected conditions, missing authentication enforcement and improper path confinement in the repository commits API allow an unauthenticated remote attacker to read arbitrary files from the GitLab server. GitLab released fixes in versions 19.3.2, 19.2.6, and 19.1.8 on September 10; the vulnerability was added to CISA KEV the following day after confirmation of active exploitation.

The impact extends beyond disclosure of individual files. GitLab servers can contain application configuration, database credentials, tokens, signing material, CI/CD secrets, and integration credentials used to access downstream infrastructure. Successful exploitation can therefore expose credentials that remain useful even after the underlying vulnerability is patched.

Organizations running affected self-managed GitLab instances should upgrade immediately and review requests to the repository commits API for exploitation attempts. Where sensitive configuration files may have been accessed, associated credentials and secrets should be rotated rather than treating the GitLab upgrade alone as complete remediation.

Cisco Secure FMC CVE-2026-20079 and CVE-2026-20316: Management-Plane Compromise Progresses to Espionage and Ransomware

Active exploitation of Cisco Secure Firewall Management Center provides one of the clearest examples this week of why the compromise of a security management platform can extend well beyond the appliance itself. CVE-2026-20079 is a CVSS 10.0 authentication-bypass vulnerability that allows an unauthenticated remote attacker to execute scripts and obtain root access. CVE-2026-20316 exposes a static credential that grants low-privilege access and can be combined with other FMC weaknesses to extend access. Both vulnerabilities are being abused in real intrusions.

The post-exploitation activity is substantial. One cluster deployed JSP web shells and a Java-based command executor to query FMC databases for authentication data. A second used reverse shells, configuration harvesting, tunneling, and Cyclops Blink malware associated with Sandworm-linked activity. In a separate intrusion, a ransomware group used FMC access for network reconnaissance, credential harvesting, SOCKS and reverse SSH tunneling, endpoint discovery, disruption of security controls, and eventual deployment of Qilin ransomware on selected systems.

For previously exposed FMC systems, remediation therefore needs to extend beyond applying the available hotfixes. Teams should investigate unexpected web shells or package files, configuration exports, new tunnels, credential access, and connections originating from the management appliance into internal services. FMC compromise should be treated as a potential pathway into the broader environment rather than as an isolated appliance incident.

JFrog Artifactory CVE-2026-42018 and CVE-2026-42016: New Exploit Chain Expands Existing Artifactory Attack Paths

Artifactory exploitation has expanded beyond the previously covered CVE-2026-82329. Recent activity shows attackers chaining CVE-2026-42018 and CVE-2026-42016 against self-hosted JFrog Artifactory deployments. CVE-2026-42018 can expose a token associated with Artifactory’s internal anonymous user, while CVE-2026-42016 fails to correctly restrict the scope of a valid token. Chained together, the vulnerabilities allow an unauthenticated attacker to obtain a low-privileged token and exchange it for administrative privileges.

Observed exploitation progressed beyond initial privilege escalation. Attackers created persistent administrator accounts, deployed malicious Groovy plugins to execute server-side code, executed reconnaissance commands, installed a custom Rust-based backdoor, and, in some cases, uploaded web shells. This expands the Artifactory exploitation landscape beyond CVE-2026-82329, which SAFE previously covered after it entered active exploitation, by introducing another confirmed path from unauthenticated access to administrative control.

The important development is therefore not another isolated Artifactory flaw, but the emergence of multiple independent paths to administrative control of the same software-supply-chain platform. Compromise can expose artifact repositories, access tokens, credentials, build integrations, and packages consumed by downstream systems. Organizations should validate remediation for all applicable Artifactory vulnerabilities and review administrator creation, token issuance, plugin activity, repository changes, and any unexpected outbound connections for evidence of exploitation prior to patching.

Fortinet CVE-2025-25249: Exploitation Deploys PivotC2 to Turn FortiGate Into an Internal Access Point

CVE-2025-25249 is a heap-based buffer overflow in the cw_acd daemon affecting FortiOS, FortiSwitchManager, and FortiSASE. Although Fortinet patched the vulnerability earlier in 2026, new research has confirmed that it was exploited dating back to at least July. CISA added the vulnerability to KEV on September 9.

Successful exploitation has been used to deploy PivotC2, a Node.js remote-access tool built specifically for FortiGate post-exploitation. Its capabilities include interactive shell access, file transfer, internal network scanning, SOCKS and HTTP proxying, port forwarding, configuration collection, and credential recovery. This gives operators more than persistence on the firewall: the compromised appliance can become a staging point for reaching internal systems. The activity is notable because PivotC2 can also leverage software already present on FortiOS, reducing the need to introduce a conventional standalone runtime.

This is also a case where patch status alone is insufficient. Organizations that exposed affected FortiGate devices while they were vulnerable should investigate for unexpected Node.js activity, newly created files, outbound C2 traffic, configuration access, proxy or tunnel creation, and credential theft. Credentials stored or recoverable from compromised firewall configurations should be considered potentially exposed where exploitation is confirmed.

BlueMoon Exploit Kit Chains Chrome and Windows Zero-Days

The Chrome exploitation story has evolved beyond last week’s coverage of CVE-2026-85046. New analysis of the BlueMoon exploit kit shows attackers chaining it with CVE-2026-87491 and Windows CVE-2026-85880 to move from browser exploitation to code execution outside Chrome’s renderer sandbox.

Multiple espionage-focused threat clusters have been observed adopting the same exploit chain within days, targeting organizations across the U.S. and Asia and deploying payloads including credential-stealing browser extensions and ShadowPad. The activity shows how quickly a browser exploit chain can be operationalized across different campaigns once a reliable exploitation framework becomes available.

The chain also highlights the risk of patch-gap exploitation, where fixes or relevant code changes may be visible upstream before reaching all stable Chromium-based browsers. Security teams should therefore track patch status across the broader Chromium ecosystem and correlate browser exploitation with Windows privilege-escalation activity.

Citrix NetScaler CVE-2026-19490: Authentication Bypass Moves Into Active Exploitation

CVE-2026-19490 is a critical authentication-bypass vulnerability affecting customer-managed NetScaler ADC and NetScaler Gateway systems configured in specific Gateway or AAA scenarios. Depending on the affected release, exploitation requires configurations such as SSL VPN, ICA Proxy, CVPN, RDP Proxy, AAA virtual servers, or SAML authentication. CISA added the vulnerability to KEV on September 9.

The distinction between affected and non-affected NetScaler deployments is configuration-dependent, which makes asset-level validation particularly important. Administrators should verify both software versions and whether the relevant Gateway, AAA, or SAML preconditions are present rather than prioritizing solely from product inventory. Cloud Software Group has released fixed builds including 14.1-73.32 and 13.1-63.21 for the primary supported branches, with corresponding updates for FIPS and NDcPP deployments; Citrix-managed cloud services have already been updated.

Because NetScaler systems often sit directly on remote-access paths, successful authentication bypass should also trigger investigation of session activity and subsequent access into internal services. An appliance that has already been exploited remains relevant after patching if the attacker obtained credentials, sessions, or another persistence mechanism before the update was applied.

N-able N-central CVE-2026-86218: Pre-Authentication RCE Targets a Platform With Downstream Reach

CVE-2026-86218 is a pre-authentication remote code execution vulnerability affecting N-able N-central before version 2026.3.1.14. The vulnerability carries a CVSS v4 score of 10.0 and requires neither authentication nor user interaction. CISA now classifies exploitation as active and added it to KEV on September 8.

The significance is amplified by N-central’s role as a remote monitoring and management platform. A compromise of the management server can provide an attacker with access to infrastructure, credentials, administrative functions, and potentially large numbers of managed endpoints. That downstream reach makes a management-plane RCE materially different from the compromise of an isolated application server.

Sogou Input Method CVE-2026-51990: One-Click RCE Exposes Risk Hidden Inside Trusted Desktop Software

CVE-2026-51990 provides a different exploitation pattern from this week’s appliance-heavy activity. The vulnerability affects Tencent’s Sogou Input Method for Windows, one of the most widely deployed Chinese-language input method editors. UNC3569 has been observed exploiting it to deploy the GRAYRABBIT backdoor.

The exploit combines three weaknesses: insufficient validation in Sogou’s sgbiz: custom protocol handler, unrestricted navigation inside a Chromium Embedded Framework webview, and an outdated Chromium 80 engine operating without its sandbox. A victim only needs to click a crafted link; the chain then reaches attacker-controlled content and achieves code execution through the embedded browser environment. Tencent patched the exposed protocol-handler path in version 16.3.0.3498 after the vulnerability was reported in April.

The broader lesson is the attack surface created when desktop applications embed browsers, custom URI handlers, and web-facing functionality. Even when the primary application is not considered a browser, bundled browser components can inherit years of exploitable functionality and may operate with weaker isolation. In this case, the patched protocol validation blocks the demonstrated attack path, but Gen’s analysis found that the bundled Chromium engine itself remains outdated and continues to run with its sandbox disabled.

From Exploitation Signals to Remediation Priorities

This week reinforces that exposure does not end when a CVE is patched. Several of the highest-priority vulnerabilities affect systems that already hold privileged positions in the environment – security gateways, management platforms, software repositories, CI/CD infrastructure, and endpoint execution layers. Once exploited, they can leave behind credentials, administrative accounts, web shells, tunnels, stolen secrets, or other access that remains relevant after remediation.

Security teams should prioritize:

• Internet-facing and control-plane systems: Cisco Secure Email Gateway, Cisco FMC, Citrix NetScaler, Fortinet, and N-able N-central where affected versions are externally reachable or manage downstream infrastructure.
• Software delivery and development infrastructure: JFrog Artifactory and GitLab, where exploitation can expose repositories, credentials, access tokens, CI/CD secrets, integrations, or artifacts consumed by downstream systems.
• Endpoints exposed to exploit chains: Chrome and other Chromium-based browsers alongside affected Windows systems, where browser exploitation can progress into privilege escalation and host-level execution.
• Post-exploitation validation: For systems exposed before patching, verify whether attackers created persistence, accessed credentials or secrets, changed configurations, or established secondary access. Where sensitive material may have been exposed, rotation should be part of remediation.

SAFE CTEM helps translate changing exploitation signals into remediation priorities by combining exploitability, business context, potential impact, and compensating controls. As new evidence emerges, affected exposures can be reprioritized so teams can focus first on vulnerabilities that are both exploitable and capable of materially affecting critical systems.