Threats exploiting CISA KEV-listed CVEs: April to September 2026

Summary

Between April 1 and September 30, 2026, CISA added 175 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, up from 110 in the same months of 2025. Network edge devices and IT management tools make up nearly half of them. Most are new: 80% were published in 2026, the median time from CVE publication to KEV listing is 5 days for those, and 20% of all entries were listed on the day of publication or earlier.

The exploitation behind these listings is attributed to state-linked groups such as UAT-8616, CL-STA-1132, TA412 (APT31) and Lazarus, ransomware affiliates such as Qilin and INC, extortion crews such as ShinyHunters and Cl0p, and hacktivists such as Head Mare and Hacking Cat. Many of them used the bugs as zero-days, weeks before a fix existed. Patching KEV entries first, starting with exposed edge and admin systems, is the most effective response.

Background

CISA's Known Exploited Vulnerabilities catalog lists only CVEs with evidence of exploitation in the wild. If a CVE is on KEV, someone is already using it. This post looks at the six months from April 1 to September 30, 2026: who is exploiting these CVEs, which products they go after, how old the bugs are, and how fast CISA lists them.

Source and method. All counts come from the CISA KEV catalog, pulled from CISA's official GitHub mirror (catalog version 2026.10.15, 1,746 entries total).

The six months at a glance

The same six months of 2025 saw 110 additions, so listings are up roughly 60% year over year, and September was the busiest month of the period. Of the 175, 21 (12%) are flagged by CISA as known to be used in ransomware campaigns.

This pace follows CISA's Binding Operational Directive 26-04, issued June 10, 2026. It replaced the older KEV directive (BOD 22-01) with a risk-based model. The shortest remediation window for federal agencies is now three days for exposed, exploited, automatable bugs that give full control. This shows in the data: 26% of April's additions carried a 3-day due date, compared with 79% of September's.

Who is exploiting KEV CVEs?

More than a dozen named threat actors are behind the exploitation of KEV-listed CVEs in this period. KEV itself does not name attackers, so the names below come from vendor and researcher reports on the CVEs listed in the window. Each one is covered in the next section.

• State-linked espionage: CL-STA-1132, UAT-8616, TA412 (APT31, JungleBamboo), UTA0560, UTA0565, Lazarus, TA488 (Laundry Bear), UAT-11823, UAT-12197 and Red Heron (suspected China-linked)
• Ransomware and extortion: Qilin affiliates (including UAT-11988), INC ransomware, ShinyHunters (UNC6240) and Cl0p
• Hacktivists: Head Mare and Hacking Cat
• Zero-day operators with no public motive: UTA0533, and the unnamed actor behind the NetScaler zero-days

Four things stand out:

• Zero-days come first. UTA0533 was inside SonicWall appliances about three weeks before the July 14 fix. ShinyHunters hit PeopleSoft before Oracle published an advisory. NetScaler exploitation began about three weeks before the September 27 disclosure.
• Exploits spread between groups. Four clusters used BlueMoon within 12 days. INC followed UTA0533 onto SonicWall. Three unrelated clusters, one of them Qilin, hit the same two Cisco FMC flaws.
• Edge devices are the door, Active Directory is the target. CL-STA-1132 and the Qilin affiliates both went straight for domain credentials once on the firewall or VPN.
• Patch gaps and public PoCs shrink the window. The Chromium fix was committed on August 7 but reached stable Chrome only on September 3, and Red Heron automated a public Gitea PoC within days.

Opportunists are in the mix too. Cisco Talos described 10 activity clusters on the SD-WAN flaws alone, delivering miners, credential stealers, backdoors and web shells alongside the espionage activity.

Pattern 1: Most exploited product categories

By vendor, Microsoft led with 27 entries (Windows, SharePoint and Defender made up most of them), followed by Cisco with 14, then the Linux kernel with 7. Adobe and Fortinet each had 6.

Takeaways:

• Roughly half of all entries (83 of 175) are edge devices or admin tooling. These systems are internet-facing, hold privileged credentials and often cannot run EDR. Compromise here means instant network-wide access.
• AI tooling is new. 12 entries (Langflow, LiteLLM, Ray, MLflow, Kestra, Marimo and Metabase) show fast-moving AI and data platforms being exploited like any other exposed server.
• The bug classes are basic. The most common weaknesses were improper authentication (CWE-287, 13 entries), code injection (CWE-94, 11), path traversal (CWE-22, 10), missing authentication (CWE-306, 10) and OS command injection (CWE-78, 9). Many were unauthenticated and remote.

Pattern 2: The age of exploited CVEs

• 80% are new. 140 of the 175 CVEs were published in 2026.
• 20% are older. 35 were published before 2026: 11 from 2025, 11 from 2022 to 2024, and 13 from 2021 or earlier.
• 29 CVEs were listed a year or more after publication, 12 after five years or more, and 10 after a decade or more.

The oldest entries are a reminder that attackers keep every tool they own. On May 20, CISA added MS08-067 (CVE-2008-4250), two Internet Explorer use-after-free bugs from 2010, a 2009 DirectX bug and a 2009 Acrobat bug in one batch. On July 13 it added CVE-2008-4128 in Cisco IOS, which is about 18 years old. Old bugs are exploited where legacy systems still live: unpatched appliances, compatibility environments and forgotten servers.

Pattern 3: Time from disclosure to KEV listing

• Median across all 175 entries: 12 days. For CVEs published in 2026, the median is 5 days. For older CVEs it is about 1,051 days (almost three years).
• 35 entries (20%) were listed on the day the CVE was published, or a day before it. These are typically zero-days or bugs already exploited before the patch. Examples are the Palo Alto PAN-OS flaw CVE-2026-0300, the SonicWall SMA1000 pair and Cisco SD-WAN CVE-2026-20262.
• Speed varies by category. Edge devices and IT management tools both have a median of just 5 days. AI/ML tooling took about 25 days, and OS and endpoint software a median of about 105 days, because that group includes the many decade-old entries.

Two cases show how short the window is. ShinyHunters hit PeopleSoft before Oracle published an advisory. Cl0p's Windchill exploitation was reported about a month after PTC began shipping patches on June 17, and the flaw was already on KEV by June 25, a week after publication.

Pattern 4: The Head Start Attackers Had Before a Fix

The table shows, for each attributed actor, when it was first reported exploiting the CVE, when the vendor disclosed or fixed it, and when CISA listed it. Days before fix counts the days from first reported exploitation to the disclosure or fix date, and is 0 when exploitation was reported after the fix. Disclosure dates are the CVE record or vendor advisory date. Where a report gives only a range, the range is shown.

• Seven actors used zero-days. They had between 2 days and about 10 weeks before a fix existed, and CISA listed each of those CVEs within 2 days of disclosure. The longest head starts, Lazarus on Windows and CL-STA-1132 on PAN-OS, belonged to state-linked actors. ShinyHunters is the only extortion crew in the table with a confirmed zero-day.
• Five actors arrived after the fix. Red Heron exploited Gitea two days after version 1.27.1 shipped, and the Qilin affiliates, INC, Cl0p and TA488 all attacked bugs that were already disclosed or patched. A patch applied on the day it shipped would have stopped these.
• KEV lagged most when exploitation came after the fix. Gitea reached KEV 29 days after its fix, the PAN-OS GlobalProtect bug 16 days after disclosure, and Cisco FMC CVE-2026-20079 six months after its March patch.
• Exploitation dates are the earliest reported, not the true start. UTA0565 and JungleBamboo used the same BlueMoon chain in the same window and have no separate start date, so they are not listed.

Pattern 5: Products Targeted by Multiple Types of Threat Actors

Twelve products drew named actors in this period. Five of them drew more than one actor type, so a gap on those products was open to espionage and criminal use at the same time. The table groups actors by type for each product.

• Edge and mail systems attract everyone. All five multi-type products are firewalls, VPN and SD-WAN gateways, management consoles or mail servers. These systems hold credentials and sit in front of the network, which suits both spies and ransomware crews.
• State-linked and ransomware actors hit the same bugs. PAN-OS and Cisco FMC each had one of each. An incident on these products should check for more than one intruder, because a ransomware cleanup does not rule out earlier espionage access.
• One type does not mean one actor. BlueMoon was used by three named state-linked clusters within about 12 days, which shows how quickly a working exploit chain spreads inside one type.
• Business applications drew extortion crews only. Oracle PeopleSoft and PTC Windchill were exploited by ShinyHunters and Cl0p respectively, both for mass data theft, with no state-linked actor reported on either.

Immediate Actions to Take

Treat the first days after a KEV listing as an incident window, not a patch cycle. Several actors above were inside devices for weeks before a fix existed, so on the products listed in this post, patching alone is not enough.

Within 24 hours

• Match KEV to your assets. Download the KEV feed, or use the April to September CVE list that goes with this post, and match it to your inventory. Start with internet-facing PAN-OS, Cisco Catalyst SD-WAN and Secure FMC, SonicWall SMA1000, Citrix NetScaler, Exchange OWA, Gitea, TrueConf Server, Oracle PeopleSoft and PTC Windchill.
• Close management exposure. Limit management consoles, the PAN-OS captive portal and SD-WAN and FMC administration to trusted networks. Several of these flaws gave root or administrator access with no credentials.
• Apply the vendor fix or mitigation. For example Gitea 1.27.1 or later, Chrome builds released on or after September 3, the August and September Windows updates for CVE-2026-68820 and CVE-2026-85880, and the vendor fixes for the PAN-OS, Cisco, SonicWall, Citrix and TrueConf CVEs listed here.

Within 72 hours

• Hunt for prior compromise on anything that was exposed and unpatched. Look for web shells (JSP files on PeopleSoft and Windchill, PHP on NetScaler), new administrator accounts, unexpected VPN sessions, tunneling tools such as EarthWorm, ReverseSocks5 and Ngrok, remote-access tools such as AnyDesk, LogMeIn and MeshCentral, and ntdsutil or other Active Directory credential dumping.
• Rotate what the device could see. Reset service accounts the firewall used to query Active Directory, any static or default credentials (Cisco FMC CVE-2026-20316), VPN and API keys, and end active VPN sessions.
• Check endpoints for stored copies. On OWA, inspect browser storage on affected users' machines, because OWAReaper reinfected hosts, even re-imaged ones, from copies it kept there.

Within 7 days

• Restrict outbound traffic from edge devices. Most of the implants above tunnel or call out, so egress filtering on firewalls, gateways and servers can break the attack even after a foothold.
• Do not rely on a WAF as the fix. ShinyHunters bypassed WAF rules on PeopleSoft by URL-encoding one character in the request path.
• Set a 72-hour target for KEV items on exposed systems. This matches the shortest remediation window in BOD 26-04. Keep an inventory of end-of-life appliances and isolate or retire any you cannot patch.

Caveats

• KEV is evidence of exploitation, not a count of all attacks. CISA lists only what it can confirm and issue clear mitigation guidance for.
• Attribution comes from vendor and researcher reports and varies in confidence.
• Publication-date gaps use the CVE record date. A vendor advisory or private patch may have come earlier.
• First-exploitation dates are the earliest reported by vendors and researchers, not the true start. "Days before fix" is therefore a minimum, and it is longer where a fixed build shipped after the advisory.