Vulnerabilities

Vulnerabilities are flaws in software, hardware or configuration that let an attacker bypass authentication, run code or read data that should be out of reach. Much of the exploitation recorded in 2026 hit internet-facing appliances, the VPN gateways, firewalls and mail filters at the edge of a network, often before a fix existed.

The fullest case is Citrix NetScaler, where two critical zero-days were exploited for about three weeks before Citrix's bulletin. Cisco, SonicWall and Ivanti products were hit repeatedly, and one attacker chained three zero-days to reach root on a fully patched Ivanti VPN. Attacks often followed disclosure within hours or days, and some fixes failed or went unapplied for months. Microsoft's patch counts more than tripled between August and October, and the company tied October's record count to AI-assisted bug hunting. CISA repeatedly gave federal agencies three days to remediate. Flaws also surfaced in cloud storage and processor branch predictors, and hardware wallets were tampered with in the supply chain.

As of October 2026, the privilege-escalation flaw in the Ivanti chain had no patch, Microsoft had fixed a record 1,411 flaws in one release, and Ledger had asked resellers across Southeast Asia and Hong Kong to halt sales over tampered wallets.

Zero-days in edge appliances

Citrix NetScaler is the fullest case of an edge appliance attacked before a fix existed. Citrix's 27 September bulletin patched two flaws rated CVSS 9.5: CVE-2026-88771, which gives an unauthenticated attacker root with a single request, and CVE-2026-88772, a memory overflow on appliances with DTLS enabled. Exploitation was confirmed from 3 September, roughly three weeks before the bulletin, and Palo Alto Networks estimated that about 50,000 instances remained potentially exposed as of 27 September. Mandiant said dozens of organisations had been hit, including by suspected state-sponsored actors, and eSentire later counted four separate attacker clusters.

The fix did not end the incident. Citrix's own guidance called for isolating and rebuilding compromised devices rather than patching alone, and Unit 42 later warned that the fix left behind web shells and other changes from earlier intrusions. Citrix shipped two more emergency fixes within two weeks: on 4 October for a SAML denial-of-service flaw attackers used to force repeated reboots, and on 9 October for a SAML memory overflow that had not been seen exploited when it was patched.

Other gateways and firewalls followed the same pattern. F5 patched a BIG-IP Access Policy Manager zero-day used for unauthenticated code execution on systems acting as OAuth authorisation servers. Fortinet's FortiMail file-write flaw was under attack before fixes existed for three of its four affected branches, and Palo Alto Networks reported "very limited exploitation" of a PAN-OS flaw that gives an attacker holding credentials root on its firewalls. All three vendors said their own researchers had found the flaw, yet each confirmed attacks in the wild.

Repeat targets and exploit chains

Several product lines were exploited again and again within months. Cisco's Catalyst SD-WAN Manager took its fifth exploited zero-day of 2026 in September, an authentication bypass rated CVSS 9.8, and watchTowr's Jake Knott counted eight 2026 SD-WAN CVEs on CISA's Known Exploited Vulnerabilities (KEV) catalogue. Cisco's Secure Email Gateway received its second root-level zero-day in two months, triggered by a single email with a crafted attachment. SonicWall's SMA1000 gateway drew exploitation attempts three days after a patch for the third maximum-severity request-forgery flaw in its WorkPlace interface in nine months. By October 2026, CISA had added 19 SonicWall flaws to KEV over four years and flagged 13 of them as used by ransomware gangs.

A group Volexity tracks as UTA0576 chained three Ivanti Connect Secure zero-days to gain unauthenticated root on a VPN appliance patched against every previously known Connect Secure flaw. The attacker wiped logs, ran its commands in memory, which CISA warned Ivanti's Integrity Checker Tool may miss, and went after Active Directory credentials and BitLocker recovery keys. Ivanti patched two of the flaws, tracked together as CVE-2026-104935, the sixth Ivanti flaw added to KEV in 2026, but the privilege-escalation flaw remained unpatched as of 15 October. On MikroTik routers, CERT Polska and Bishop Fox showed that a pair of flaws dubbed "MikroTrick" gave an unauthenticated client full administrative access. MikroTik fixed them without publishing details, and CERT Polska found the second flaw within an hour by comparing the patched code with logs administrators had posted.

Exploitation speed and the limits of patching

The time between disclosure and exploitation was often hours or days. Previdian saw attempts against a critical file-access flaw in eight self-hosted Atlassian products within two hours of watchTowr publishing its technical write-up, and where Atlassian Crowd is in use the flaw exposes credentials that let an attacker create a Jira administrator. Huntress saw attackers chain two flaws in the AhsayCBS backup platform three days after their CVE identifiers were published, then found that the version listed as fixed was still vulnerable.

A patch did not always end the exposure. Attackers linked to the ShinyHunters extortion group returned to an Oracle PeopleSoft flaw exploited as a zero-day before Oracle's June patch, URL-encoding one letter of the vulnerable path so web application firewall rules missed the request, and planted web shells on dozens of systems. A Roundcube webmail flaw patched in May was under attack by September, with Shadowserver tracking more than 523,000 exposed instances, and a suspected Chinese-speaking actor used a Zyxel switch flaw fixed in June to compromise 996 switches in 48 countries, according to GreyNoise.

Patch volume, federal deadlines and AI

Microsoft's monthly patch releases more than tripled between August and October 2026, from 421 CVEs in August to a record 1,411 in October. Each release included one actively exploited zero-day, a Windows kernel driver flaw in August and a Windows Shell bypass in October. Microsoft tied the October count to its growing use of AI to find flaws in its own products.

CISA's KEV catalogue set the pace for federal civilian agencies. When it added three exploited Linux kernel flaws on 21 September it gave agencies three days, the same deadline it set for the exploited Zyxel, F5, Cisco, Ivanti and Palo Alto Networks flaws, and it ordered FortiMail remediation before Fortinet had shipped most of its fixes. The SonicWall flaw was not listed as of 9 October, and security professionals quoted by SC Media said teams should not wait for a listing before acting.

AI appeared on both sides. Volexity found medium-confidence evidence that UTA0576 used large language models to help develop the Ivanti chain and automate post-exploitation steps, eSentire found "LLM-style comments" in a NetScaler attacker's script, and Huntress believes the PowerShell script that hid an AhsayCBS cryptocurrency miner was written with AI assistance. STAR Labs, by contrast, said it found a 14-year-old Linux kernel race condition with no help from an AI system.

Cloud platforms, processors and hardware

Flaws also surfaced below the application layer, in cloud storage, database configuration, processors and hardware. Cloudflare's Containers service skipped zeroing reused storage blocks, so one customer could have read up to 60 KiB of another's leftover data; Cloudflare found no evidence of real exposure and finished the fix by 19 September. UpGuard found more than 16,000 misconfigured Supabase databases readable by anyone because of missing or ineffective row-level security, a pattern it tied largely to AI-assisted app development. Supabase's security chief said its projects are "secure by default" and that security is a shared responsibility.

A new Spectre v2 variant, Branch Target Reuse, overturned an assumption held since 2018 that self-modifying-code protections in just-in-time compilers made such attacks impractical. Its exploit against the Linux kernel recovered a root password hash in three to five minutes on Intel processors, and the researchers confirmed the underlying branch-predictor behaviour on Intel, AMD and Arm chips. Fixes were merged into the Linux kernel.

In the hardware supply chain, Ledger confirmed that wallets sold through the Malaysian reseller CryptoBilis carried a hidden implant that captured the recovery phrase and sent it out over a concealed LTE link. Because the implant sat beside the Secure Element rather than modifying it, Ledger's own Genuine Check could not detect it. Blockchain analysts estimated losses near $86 million, a figure Ledger said it could not verify. Tampered units were also reported from other sellers in Singapore and Germany, and by 15 October Ledger had asked resellers across Southeast Asia and Hong Kong to halt sales until its investigation was complete.