https://exploit-radar.com/en/flux/tout.xml Exploit Radar: actively exploited vulnerabilities The latest additions to CISA’s catalog of exploited vulnerabilities, across all products. 2026-09-29T00:00:00Z Exploit Radar https://exploit-radar.com/en/cve/CVE-2026-86950/ CVE-2026-86950 — Apple iOS / iPadOS / macOS 2026-09-29T00:00:00Z Apply the patches or mitigations from Apple; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 29, 2026. https://exploit-radar.com/en/cve/CVE-2026-88771/ CVE-2026-88771 — Citrix NetScaler ADC / Gateway 2026-09-27T00:00:00Z Apply the patches or mitigations from Citrix; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Active CERT-FR alert. Added to CISA’s catalog of exploited vulnerabilities on September 27, 2026. https://exploit-radar.com/en/cve/CVE-2026-88772/ CVE-2026-88772 — Citrix NetScaler ADC / Gateway 2026-09-27T00:00:00Z Apply the patches or mitigations from Citrix; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Active CERT-FR alert. Added to CISA’s catalog of exploited vulnerabilities on September 27, 2026. https://exploit-radar.com/en/cve/CVE-2026-65660/ CVE-2026-65660 — Microsoft SharePoint Server 2026-09-25T00:00:00Z Apply the patches or mitigations from Microsoft; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 25, 2026. https://exploit-radar.com/en/cve/CVE-2026-87902/ CVE-2026-87902 — WordPress Core 2026-09-25T00:00:00Z Apply the patches or mitigations from WordPress; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 25, 2026. https://exploit-radar.com/en/cve/CVE-2026-67279/ CVE-2026-67279 — MikroTik RouterOS 2026-09-25T00:00:00Z Apply the patches or mitigations from MikroTik; if none are available, stop using the product. Start with internet-facing devices. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 25, 2026. https://exploit-radar.com/en/cve/CVE-2026-5430/ CVE-2026-5430 — WSO2 API Manager, Identity Server, Integrator 2026-09-24T00:00:00Z Apply the patches or mitigations from WSO2; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 24, 2026. https://exploit-radar.com/en/cve/CVE-2026-71362/ CVE-2026-71362 — Adobe Commerce (Magento) 2026-09-24T00:00:00Z Apply the patches or mitigations from Adobe; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 24, 2026. https://exploit-radar.com/en/cve/CVE-2026-93952/ CVE-2026-93952 — Arista SD-WAN (VeloCloud) 2026-09-22T00:00:00Z Apply the patches or mitigations from Arista; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 22, 2026. https://exploit-radar.com/en/cve/CVE-2026-85102/ CVE-2026-85102 — Check Point Quantum Security Gateway 2026-09-22T00:00:00Z Apply the patches or mitigations from Check Point; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 22, 2026. https://exploit-radar.com/en/cve/CVE-2026-93616/ CVE-2026-93616 — Check Point Security Management / SmartConsole 2026-09-22T00:00:00Z Apply the patches or mitigations from Check Point; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 22, 2026. https://exploit-radar.com/en/cve/CVE-2026-94127/ CVE-2026-94127 — F5 BIG-IP 2026-09-22T00:00:00Z Apply the patches or mitigations from F5; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 22, 2026. https://exploit-radar.com/en/cve/CVE-2026-7273/ CVE-2026-7273 — Zyxel Switches (GS, XGS) 2026-09-21T00:00:00Z Apply the patches or mitigations from Zyxel; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 21, 2026. https://exploit-radar.com/en/cve/CVE-2025-39682/ CVE-2025-39682 — Linux Kernel 2026-09-18T00:00:00Z Apply the patches or mitigations from Linux; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 18, 2026. https://exploit-radar.com/en/cve/CVE-2026-53266/ CVE-2026-53266 — Linux Kernel 2026-09-18T00:00:00Z Apply the patches or mitigations from Linux; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 18, 2026. https://exploit-radar.com/en/cve/CVE-2025-39964/ CVE-2025-39964 — Linux Kernel 2026-09-18T00:00:00Z Apply the patches or mitigations from Linux; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 18, 2026. https://exploit-radar.com/en/cve/CVE-2026-76460/ CVE-2026-76460 — Cisco Identity Services Engine (ISE) 2026-09-16T00:00:00Z Apply the patches or mitigations from Cisco; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 16, 2026. https://exploit-radar.com/en/cve/CVE-2026-58704/ CVE-2026-58704 — Google Pixel 2026-09-16T00:00:00Z Apply the patches or mitigations from Google; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 16, 2026. https://exploit-radar.com/en/cve/CVE-2026-87886/ CVE-2026-87886 — Acronis Backup 2026-09-16T00:00:00Z Apply the patches or mitigations from Acronis; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 16, 2026. https://exploit-radar.com/en/cve/CVE-2026-76461/ CVE-2026-76461 — Cisco Secure Email Gateway 2026-09-14T00:00:00Z Apply the patches or mitigations from Cisco; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 14, 2026. https://exploit-radar.com/en/cve/CVE-2026-85706/ CVE-2026-85706 — GitLab Community / Enterprise Edition (CE/EE) 2026-09-11T00:00:00Z Apply the patches or mitigations from GitLab; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 11, 2026. https://exploit-radar.com/en/cve/CVE-2026-84869/ CVE-2026-84869 — ConnectWise ScreenConnect 2026-09-11T00:00:00Z Apply the patches or mitigations from ConnectWise; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 11, 2026. https://exploit-radar.com/en/cve/CVE-2026-42016/ CVE-2026-42016 — JFrog Artifactory 2026-09-11T00:00:00Z Apply the patches or mitigations from JFrog; if none are available, stop using the product. Start with internet-facing devices. CISA deadline: 14 days. Added to CISA’s catalog of exploited vulnerabilities on September 11, 2026. https://exploit-radar.com/en/cve/CVE-2026-42018/ CVE-2026-42018 — JFrog Artifactory 2026-09-11T00:00:00Z Apply the patches or mitigations from JFrog; if none are available, stop using the product. Start with internet-facing devices. CISA deadline: 14 days. Added to CISA’s catalog of exploited vulnerabilities on September 11, 2026. https://exploit-radar.com/en/cve/CVE-2026-86060/ CVE-2026-86060 — MikroTik RouterOS 2026-09-10T00:00:00Z Apply the patches or mitigations from MikroTik; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 10, 2026. https://exploit-radar.com/en/cve/CVE-2026-67277/ CVE-2026-67277 — MikroTik RouterOS 2026-09-10T00:00:00Z Apply the patches or mitigations from MikroTik; if none are available, stop using the product. Start with internet-facing devices. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 10, 2026. https://exploit-radar.com/en/cve/CVE-2026-20079/ CVE-2026-20079 — Cisco Secure Firewall Management Center (FMC) 2026-09-09T00:00:00Z Apply the patches or mitigations from Cisco; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 9, 2026. https://exploit-radar.com/en/cve/CVE-2025-25249/ CVE-2025-25249 — Fortinet FortiOS / FortiProxy (FortiGate) 2026-09-09T00:00:00Z Apply the patches or mitigations from Fortinet; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 9, 2026. https://exploit-radar.com/en/cve/CVE-2026-19490/ CVE-2026-19490 — Citrix NetScaler ADC / Gateway 2026-09-09T00:00:00Z Apply the patches or mitigations from Citrix; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 9, 2026. https://exploit-radar.com/en/cve/CVE-2026-87491/ CVE-2026-87491 — Google Chrome / Chromium 2026-09-09T00:00:00Z Apply the patches or mitigations from Google; if none are available, stop using the product. Start with internet-facing devices. CISA deadline: 14 days. Added to CISA’s catalog of exploited vulnerabilities on September 9, 2026. https://exploit-radar.com/en/cve/CVE-2026-75650/ CVE-2026-75650 — Adobe Commerce (Magento) 2026-09-08T00:00:00Z Apply the patches or mitigations from Adobe; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 8, 2026. https://exploit-radar.com/en/cve/CVE-2026-86218/ CVE-2026-86218 — N-able N-central 2026-09-08T00:00:00Z Apply the patches or mitigations from N-able; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 8, 2026. https://exploit-radar.com/en/cve/CVE-2026-81963/ CVE-2026-81963 — Microsoft Windows 2026-09-08T00:00:00Z Apply the patches or mitigations from Microsoft; if none are available, stop using the product. Start with internet-facing devices. CISA deadline: 14 days. Added to CISA’s catalog of exploited vulnerabilities on September 8, 2026. https://exploit-radar.com/en/cve/CVE-2026-85880/ CVE-2026-85880 — Microsoft Windows 2026-09-08T00:00:00Z Apply the patches or mitigations from Microsoft; if none are available, stop using the product. Start with internet-facing devices. CISA deadline: 14 days. Added to CISA’s catalog of exploited vulnerabilities on September 8, 2026. https://exploit-radar.com/en/cve/CVE-2026-85046/ CVE-2026-85046 — Google Chrome / Chromium 2026-09-04T00:00:00Z Apply the patches or mitigations from Google; if none are available, stop using the product. Start with internet-facing devices. CISA deadline: 14 days. Added to CISA’s catalog of exploited vulnerabilities on September 4, 2026. https://exploit-radar.com/en/cve/CVE-2026-49869/ CVE-2026-49869 — Kestra OSS 2026-09-02T00:00:00Z Apply the patches or mitigations from Kestra; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 2, 2026. https://exploit-radar.com/en/cve/CVE-2026-83548/ CVE-2026-83548 — SonicWall SMA 1000 2026-09-02T00:00:00Z Apply the patches or mitigations from SonicWall; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Active CERT-FR alert. Added to CISA’s catalog of exploited vulnerabilities on September 2, 2026. https://exploit-radar.com/en/cve/CVE-2026-82329/ CVE-2026-82329 — JFrog Artifactory 2026-09-02T00:00:00Z Apply the patches or mitigations from JFrog; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 2, 2026. https://exploit-radar.com/en/cve/CVE-2026-9586/ CVE-2026-9586 — Sangoma Switchvox 2026-09-02T00:00:00Z Apply the patches or mitigations from Sangoma; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on September 2, 2026. https://exploit-radar.com/en/cve/CVE-2026-59822/ CVE-2026-59822 — BerriAI LiteLLM 2026-09-02T00:00:00Z Apply the patches or mitigations from BerriAI; if none are available, stop using the product. Start with internet-facing devices. CISA deadline: 14 days. Added to CISA’s catalog of exploited vulnerabilities on September 2, 2026. https://exploit-radar.com/en/cve/CVE-2026-83549/ CVE-2026-83549 — SonicWall SMA 1000 2026-09-02T00:00:00Z Apply the patches or mitigations from SonicWall; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Active CERT-FR alert. Added to CISA’s catalog of exploited vulnerabilities on September 2, 2026. https://exploit-radar.com/en/cve/CVE-2026-48710/ CVE-2026-48710 — Starlette 2026-09-02T00:00:00Z Apply the patches or mitigations from Starlette; if none are available, stop using the product. Start with internet-facing devices. CISA deadline: 14 days. Added to CISA’s catalog of exploited vulnerabilities on September 2, 2026. https://exploit-radar.com/en/cve/CVE-2026-81578/ CVE-2026-81578 — PaperCut NG / MF 2026-08-31T00:00:00Z Apply the patches or mitigations from PaperCut; if none are available, stop using the product. Start with internet-facing devices. CISA deadline: 14 days. Added to CISA’s catalog of exploited vulnerabilities on August 31, 2026. https://exploit-radar.com/en/cve/CVE-2026-82078/ CVE-2026-82078 — PaperCut NG / MF 2026-08-31T00:00:00Z Apply the patches or mitigations from PaperCut; if none are available, stop using the product. Start with internet-facing devices. CISA deadline: 14 days. Added to CISA’s catalog of exploited vulnerabilities on August 31, 2026. https://exploit-radar.com/en/cve/CVE-2023-49105/ CVE-2023-49105 — ownCloud Server 2026-08-27T00:00:00Z Apply the patches or mitigations from ownCloud; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on August 27, 2026. https://exploit-radar.com/en/cve/CVE-2026-53362/ CVE-2026-53362 — Linux Kernel 2026-08-27T00:00:00Z Apply the patches or mitigations from Linux; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on August 27, 2026. https://exploit-radar.com/en/cve/CVE-2026-66384/ CVE-2026-66384 — JFrog Artifactory 2026-08-27T00:00:00Z Apply the patches or mitigations from JFrog; if none are available, stop using the product. Start with internet-facing devices. CISA deadline: 14 days. Added to CISA’s catalog of exploited vulnerabilities on August 27, 2026. https://exploit-radar.com/en/cve/CVE-2021-23758/ CVE-2021-23758 — Ajax.NET Professional 2026-08-26T00:00:00Z Apply the patches or mitigations from Ajax.NET Professional; if none are available, stop using the product. Start with internet-facing devices. CISA deadline: 14 days. Added to CISA’s catalog of exploited vulnerabilities on August 26, 2026. https://exploit-radar.com/en/cve/CVE-2026-8452/ CVE-2026-8452 — Citrix NetScaler ADC / Gateway 2026-08-26T00:00:00Z Apply the patches or mitigations from Citrix; if none are available, stop using the product. Start with internet-facing devices. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on August 26, 2026. https://exploit-radar.com/en/cve/CVE-2019-1068/ CVE-2019-1068 — Microsoft SQL Server 2026-08-26T00:00:00Z Apply the patches or mitigations from Microsoft; if none are available, stop using the product. Start with internet-facing devices. CISA also asks you to hunt for signs of compromise: patching is not enough if the device has already been breached. CISA deadline: 3 days. Added to CISA’s catalog of exploited vulnerabilities on August 26, 2026.