Insikt Group Reports 29% Surge in High-Impact Vulnerabilities for September 2026

Insikt Group researchers identified 94 high-impact vulnerabilities requiring prioritized remediation in September 2026, according to Recorded Future. This total represents a 29% increase from the previous month, with 59 of the flaws receiving a Very Critical Recorded Future Risk Score. The surge highlights an accelerating threat landscape for enterprise security teams.

Of these 94 vulnerabilities, 43 were listed in the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog. Another 37 were reported in open sources and validated by Insikt Group, while 14 were exclusively surfaced through honeypot data. The exposures affected products from 58 different vendors, indicating widespread risk across the technology supply chain.

Exploitation Trends and Threat Actor Activity

September reporting highlighted zero-day exploitation of CVE-2026-88771 and CVE-2026-88772 affecting NetScaler appliances. Researchers also noted renewed exploitation of CVE-2026-35273 against unpatched PeopleSoft systems. Additionally, exploitation of Cisco Firepower Management Console by three threat clusters led to credential theft and the deployment of Cyclops Blink and Qilin ransomware.

A suspected Chinese-speaking actor utilized a SecFlow-based environment with AI workers from Claude, Qwen, and DeepSeek to support operations. This group staged workflows for eight older vulnerabilities, including CVE-2014-6271 and CVE-2021-44228, targeting Asian entities. Not every attempt resulted in confirmed access, but the use of AI for reconnaissance and exploitation staging was evident.

Vendor Impact and Vulnerability Characteristics

Linux and Microsoft products together accounted for approximately 13% of the identified vulnerabilities. The remaining exposures spanned network edge appliances, operating systems, collaboration platforms, AI tools, and operational technology. Network-edge and security-management products were the most affected product type, with Apache and Google representing the largest share of vendors for remote code execution flaws.

Forty-seven of the 94 vulnerabilities enabled remote code execution. Insikt Group identified public proof-of-concept exploits or scanners for 75 of the vulnerabilities. The most common weakness class was CWE-306 (Missing Authentication for Critical Function), followed by CWE-22 (Path Traversal). Eight vulnerabilities were at least five years old, with the oldest being approximately 12 years old.

What should you do?

Security teams should prioritize remediation for the 94 identified high-impact vulnerabilities, particularly those with Very Critical risk scores. Organizations using NetScaler, PeopleSoft, Cisco FMC, and PaperCut should verify patch status immediately. Monitor for AI-driven attack patterns and validate any public proof-of-concept code before testing in production environments.

What to do and how to stay safe: Insikt Group

• Cross-reference internal asset inventories against the 94 high-impact CVEs identified by Insikt Group, focusing on the 43 listed in CISA’s KEV catalog.
• Verify that NetScaler, PeopleSoft, and PaperCut NG/MF systems are patched against the specific CVEs mentioned, including zero-day and renewed exploitation targets.
• Monitor network traffic for indicators of AI-assisted reconnaissance, such as automated scanning patterns or unusual API calls from suspected threat actor tools.
• Review authentication configurations for critical functions to address CWE-306 weaknesses, which were the most common flaw class in this month’s report.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many high-impact vulnerabilities were identified in September 2026?

Insikt Group identified 94 high-impact vulnerabilities, a 29% increase from August 2026.

Which vendors were most affected by remote code execution flaws?

Apache and Google represented the largest share of vendors, with three RCE vulnerabilities each.

Did any threat actors use AI in their campaigns?

Yes, a suspected Chinese-speaking actor used AI-backed workers for workflows, and a Russian-speaking actor used hundreds of AI agents to compromise PaperCut instances.