Vulnerability Report – September 2026: the month of the network edge

Vulnerability-Lookup is an open-source platform run by CIRCL that aggregates vulnerability advisories from many sources (CVE, GitHub, PySec, and more), enriches them with sightings from MISP, Exploit-DB, Mastodon, Telegram, Nuclei and others, and federates five Known Exploited Vulnerabilities catalogs (CISA, CIRCL, ENISA / EU CSIRTs Network, The Shadowserver Foundation, Previdian) through the GCVE initiative.

Every month we publish a report built from that data. September 2026 in short:

• 14,959 CVEs published, +21.5% over August and the highest monthly volume ever recorded
• 43,109 sightings across 15,296 distinct vulnerabilities
• 166 vulnerabilities entered at least one tracked KEV catalog, up from 102 in August
• CISA added 43 entries, its busiest month of the year; the ENISA feed had 19 reports, three times August
• The story is the security appliance: Citrix NetScaler (three CISA entries), Check Point, F5 BIG-IP APM, four Cisco products, Fortinet, SonicWall, MikroTik, Zyxel and Arista. The two NetScaler RCEs of 27 September reached four catalogs within a day.
• CERT.PL's "MikroTrick" RouterOS research reached the ENISA feed five days before CISA listed it
• CIRCL confirmed seven exploitations, including a PAN-OS GlobalProtect ransomware case
• Previdian (formerly KEVIntel) covered all 43 CISA additions and was ahead on 18 of them
• The Shadowserver honeypot feed stopped delivering observations after 7 September, so that section is partial

The report includes a coverage matrix showing which catalogs cover each of the 166 vulnerabilities, per-catalog tables, the exploited-CVE ratio per month of 2026, top vendors, assigners, credits and weaknesses, and a summary of community comments and bundles.

It was generated with the help of AI using VulnMCP, with VLAI severity levels from the AIPITCH models. Feedback welcome on the GitHub issue tracker.