Q3 2026 CVE Report Shows 100 New CISA KEV Additions as Exploitation Speeds Up
Do Son 
TL;DR
CISA added 100 actively exploited vulnerabilities to its KEV catalog in Q3 2026, up 33.3% from 75 in Q2. Nearly half rated critical, and Microsoft led all vendors with 12 entries. A quarter of the flaws with a known publish date came under attack within a week.
- Total: 10 CVEs
- Severity: 8 Critical · 2 High
- Actively exploited: 10 (exploited in the wild)
- Exploit Intel (PatchThis): 10 of 10 confirmed
- Highest severity: 10.0 (Critical · CVSSv3) — CVE-2026-72898
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status | PoC |
|---|---|---|---|---|---|
| CVE-2026-72898 | 10 | SQL injection via password reset endpoint | x.58.24, x.59.21, x.60.17 (+3) | Exploited | Available (Nuclei) |
| CVE-2026-85706 | 10 | CWE-22 | 18.11.12, 19.0.9, 19.1.8 (+2) | Exploited | Available (Metasploit, Nuclei) |
| CVE-2026-48908 | 10 | Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2 | — | Exploited | Available (Nuclei) |
| CVE-2026-20079 | 10 | CWE-288 | — | Exploited | Available (Metasploit, Nuclei) |
| CVE-2026-39808 | 9.8 | CWE-78 | — | Exploited | Available (Nuclei) |
| CVE-2026-63077 | 9.8 | CWE-502 | 2026.1.3, 2025.11.7 | Exploited | Available (Metasploit, Nuclei) |
| CVE-2026-8037 | 9.6 | CWE-77 | V7.2.63.2, V7.2.54.18 | Exploited | Available (Nuclei) |
| CVE-2026-71362 | 9.1 | CWE-863 | 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug, 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug, 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug | Exploited | Available (Nuclei) |
Daily CyberSecurity’s Q3 2026 CVE report covers every entry CISA added to the Known Exploited Vulnerabilities catalog between July 1 and September 30, 2026. Each CVE carries CVSS and EPSS scores drawn from our CVE Watchtower vulnerability database. Together, the two sources show where attackers spent their effort this quarter.
Why It Matters
Exploitation volume is climbing
The quarter opened slowly and finished fast. CISA added 26 flaws in July and 31 in August. In September, the count jumped to 43. That steady rise suggests defenders face more confirmed threats each month, not fewer.
Severity stays high
Of the 100 new entries, 49 scored 9.0 or higher on CVSS. The median CVSS score reached 9.2. Meanwhile, 21 flaws carried an EPSS score of 50% or more, and the average EPSS hit 25.3%. In plain terms, most of these bugs are both severe and likely to see further attacks.
The patch window keeps shrinking
Our team could parse a publish date for 58 of the 100 CVEs. Among those, the median gap between public disclosure and KEV listing was just 44 days. Worse, 15 flaws, or 26% of that group, saw exploitation within seven days of publication.
The average gap tells a different story at 443 days. A handful of old bugs pulled that figure up. For example, CVE-2021-23758 in Ajax.NET Professional made the top 10 almost five years after disclosure. Attackers clearly still mine legacy flaws that teams never patched.
How the Attacks Work
The Q3 2026 CVE report groups the flaws by weakness type. Three classes tied for first place with six CVEs each:
- CWE-78: OS command injection
- CWE-94: code injection
- CWE-287: improper authentication
Path traversal (CWE-22) and unsafe deserialization (CWE-502) followed with five each. SQL injection, unrestricted file upload, authentication bypass through an alternate path, and out-of-bounds write each appeared four times.
The pattern is familiar. Attackers favor bugs that let them run commands or skip the login step entirely. These flaws often need no user interaction, so automated scanning can find and hit them at scale.
Exploitation status
CISA lists a flaw in the KEV catalog only when it has reliable evidence of active exploitation. Therefore, every CVE in this report has confirmed in-the-wild attacks behind it.
Affected Vendors and Products
Most-targeted vendors
Microsoft topped the vendor list with 12 exploited CVEs. Cisco followed with seven, and Linux came third with five. The rest of the top 10 looked like this:
- Citrix, JFrog, Fortinet and SonicWall: 4 each
- MikroTik, WordPress and Adobe: 3 each
Edge devices stand out again. Firewalls, VPN gateways and routers from Cisco, Fortinet, SonicWall and MikroTik sit directly on the internet, which makes them easy first targets.
Top 10 exploited CVEs by EPSS
| CVE | Product | CVSS | EPSS |
|---|---|---|---|
| CVE-2026-72898 | Metabase | 10.0 | 94.2% |
| CVE-2026-85706 | GitLab CE/EE | 10.0 | 93.0% |
| CVE-2026-39808 | Fortinet FortiSandbox | 9.8 | 91.2% |
| CVE-2026-48908 | JoomShaper SP Page Builder | 10.0 | 88.5% |
| CVE-2026-20079 | Cisco Secure FMC and SCC Firewall Management | 10.0 | 88.2% |
| CVE-2026-71362 | Adobe Commerce and Magento | 9.1 | 87.5% |
| CVE-2026-63077 | JetBrains TeamCity | 9.8 | 86.5% |
| CVE-2026-81578 | PaperCut NG/MF | 8.8 | 85.6% |
| CVE-2021-23758 | Ajax.NET Professional | 8.1 | 82.6% |
| CVE-2026-8037 | Progress LoadMaster | 9.6 | 77.4% |
Metabase leads the list with a 94.2% EPSS score. GitLab and Fortinet FortiSandbox follow closely. Notably, four of the ten carry a perfect CVSS score of 10.0. Many of these products handle code, builds, analytics or payments, so a single breach can expose sensitive data quickly.
Developer tools in the crosshairs
Software pipelines feature heavily this quarter. GitLab, JetBrains TeamCity and JFrog all appear in the data. These tools store source code, secrets and build credentials. As a result, one compromised server can open a path into downstream customers.
Management consoles form a second cluster. Cisco’s firewall management platform and Progress LoadMaster control traffic for entire networks. An attacker who takes over one of these consoles can change rules, hide activity or move deeper into the environment.
Finally, the list includes business apps such as Adobe Commerce, Magento and PaperCut. Online stores hold payment data, while print servers often sit inside trusted network zones. Both make attractive targets for financially motivated groups.
Patch and Mitigation Steps
The Q3 2026 CVE report points to a few clear priorities for security teams:
- Patch all ten top EPSS flaws first, starting with Metabase, GitLab and FortiSandbox.
- Treat every KEV entry as urgent. Federal agencies must meet CISA deadlines, and other teams should match that pace.
- Aim to patch internet-facing systems within seven days of disclosure.
- Audit legacy software for old flaws such as CVE-2021-23758.
- Pull firewalls, VPNs and management consoles off the public internet where possible.
- Use EPSS alongside CVSS to rank your patch queue.
Overall, the data shows a clear trend. Exploitation rose every month, and attackers moved within days of disclosure. Teams that track the KEV catalog and EPSS together will stay ahead of the next quarter’s threats.
Download and Citation
This report is published under a free-to-reference license. When citing figures, please attribute Daily CyberSecurity and link to this page. For the underlying data, see our CVE Watchtower and Top Exploited CVEs tracker.
Next report: State of Exploited Vulnerabilities — Q4 2026, scheduled for January 2027.
Support Our Threat Intelligence
Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee