KEV Volume Doubles as Exploited Flaws Hit Edge, Developer, and AI Infrastructure

Fourteen vulnerabilities entered CISA's Known Exploited Vulnerabilities catalog during the reporting period, twice the seven additions recorded during the preceding week.

The affected technology footprint was unusually broad: Adobe Commerce and Magento, Microsoft Windows, N-able N-central, Fortinet products, NetScaler ADC and Gateway, Google Chrome, Cisco Secure Firewall Management Center, MikroTik RouterOS, JFrog Artifactory, ConnectWise ScreenConnect, and GitLab.

At the same time, CISA, NSA, and FBI warned about what they describe as industrial-scale AI model-distillation campaigns, while CISA published a separate medical-device advisory covering three vulnerabilities in NextGen Healthcare Mirth Connect.

The common thread is not any single vendor or vulnerability class. It is the growing need to correlate known exploitation, external exposure, business criticality, identity and administrative privilege, exploitability, remediation ownership, and proof of closure across a rapidly expanding attack surface.

The Week at a Glance

CISA recorded seven KEV additions on September 2 during the preceding reporting period, compared with 14 additions during this reporting period, producing the 100% increase in weekly KEV intake.

That increase should not be interpreted as evidence that overall cybersecurity risk literally doubled. It is an increase in the number of vulnerabilities newly entering CISA's known-exploited catalog.

A reliable, date-aligned September 13 EPSS snapshot was not available across the complete 17-CVE dataset. Rather than combine scores captured on different dates, average EPSS is reported as N/A.

CISA Added 14 Known-Exploited Vulnerabilities

CISA KEV activity arrived in four waves:

• September 8: 4 CVEs
• September 9: 4 CVEs
• September 10: 2 CVEs
• September 11: 4 CVEs

*CVSS v3.x scores are used for consistency where available. Some vendors also publish CVSS v4 ratings, so readers may encounter different scores in vendor advisories. NetScaler, for example, assigns a CVSS v4 score of 9.3 to CVE-2026-19490, while CVSS v3.1 enrichment places it at 9.8. MikroTik-related scoring similarly differs between CVSS generations.

New Disclosure Does Not Mean New Exploitation

One of the most useful lessons from this week's KEV activity is that a vulnerability can become operationally urgent months after its original disclosure. Several of the 14 vulnerabilities had existed publicly before this reporting period.

Newly disclosed vulnerabilities rapidly elevated to KEV

CVE-2026-75650 — Adobe Commerce and Magento

Adobe issued its bulletin on September 7 and reported that the vulnerability had been exploited in the wild. The flaw can allow unauthenticated arbitrary code execution and carries a CVSS score of 10.0. Adobe released a hotfix and subsequently emphasized credential and encryption-key rotation as part of comprehensive remediation.

CVE-2026-81963 and CVE-2026-85880 — Microsoft Windows

Both vulnerabilities were addressed during Microsoft's September security updates and were identified as exploited. Each carries a CVSS 7.8 rating and can lead to local elevation of privilege under applicable conditions.

CVE-2026-86218 — N-able N-central

This vulnerability affects N-central versions before 2026.3.1.14 and enables pre-authentication remote code execution. Its CVSS v3.1 score is 9.8, while CVSS v4 scoring reaches 10.0. CISA added the flaw to KEV on September 8.

CVE-2026-87491 — Google Chrome

Google confirmed that an exploit for this V8 out-of-bounds-write vulnerability existed in the wild. Updated Chrome builds were released for Windows, macOS and Linux.

CVE-2026-84869 — ConnectWise ScreenConnect

ConnectWise disclosed the issue September 8. Under certain conditions, ScreenConnect clients could allow actions including file transfer or execution during active sessions without the expected authorization or host confirmation. ConnectWise recommends updating clients to 26.6.5 or later.

Older vulnerabilities newly elevated because the threat changed

CVE-2025-25249 — Fortinet

This heap-buffer-overflow vulnerability was originally published months before this reporting period. CISA's September 9 KEV addition changed its operational priority because known-exploitation evidence had emerged. The vulnerability carries a CVSS 9.8 rating and affects multiple Fortinet product families.

CVE-2026-19490 — NetScaler

The vulnerability had already been disclosed in August. It can permit authentication bypass on affected NetScaler ADC and Gateway deployments. NetScaler's bulletin states that there is no mitigation that substitutes for upgrading and identifies corrected builds across supported branches.

CVE-2026-20079 — Cisco Secure Firewall Management Center

Cisco disclosed this flaw in March 2026. An unauthenticated remote attacker can potentially bypass authentication and execute commands or scripts with elevated privileges on affected systems. Cisco assigned the vulnerability the maximum CVSS 10.0 score and reported no workaround beyond installing fixed software. CISA's September 9 KEV addition made an older disclosure newly urgent.

CVE-2026-42016 and CVE-2026-42018 — JFrog Artifactory

These vulnerabilities were originally published during July and August respectively. Their September 11 addition to KEV illustrates how vulnerability priority can change long after initial disclosure when new exploitation intelligence becomes available.

This is why vulnerability-management programs should continuously re-enrich old findings with new threat intelligence rather than assigning a severity once and treating it as static.

Threat Theme #1: Administrative Infrastructure Remains a High-Value Target

Seven of the 17 vulnerabilities analyzed for this report fall into a broad category encompassing security appliances, network infrastructure, edge systems, or remote-administration technologies.

The affected products include N-able N-central, Fortinet infrastructure, NetScaler ADC / Gateway, Cisco Secure Firewall Management Center, MikroTik RouterOS, and ConnectWise ScreenConnect.

That concentration matters because administrative infrastructure frequently operates with elevated privileges or provides access to large numbers of systems. Compromise of a management platform may therefore create a different risk profile than compromise of an isolated user application.

CVE-2026-20079 illustrates the issue particularly well: Cisco's security-management platform itself could become a pathway to privileged command execution.

The practical question is not simply:

“Do we have the CVE?”

It is:

“Where is the management plane, who can reach it, what can it control, and what happens if that trust boundary fails?”

Threat Theme #2: MikroTik Moves from Disclosure to Known Exploitation

CISA added two RouterOS vulnerabilities on September 10. CVE-2026-67277 concerns missing authentication for a critical function, while CVE-2026-86060 involves improper neutralization of argument delimiters associated with SSH handling.

MikroTik released fixes across supported branches, including RouterOS 7.24.2, 7.23.4 and 6.49.21, with fixes also present in later development builds. MikroTik additionally recommends limiting direct internet exposure of administrative services and using VPN-based management where practical.

Organizations operating distributed branch, telecom, ISP or remote-network environments should prioritize:

• Internet-facing RouterOS devices
• Administrative interfaces reachable from untrusted networks
• Unexpected accounts or configuration changes
• Unusual SSH activity
• Devices running outdated release branches
• Post-update validation of configuration and access policies

CISA assigned both vulnerabilities a September 13 remediation deadline for covered federal environments.

Threat Theme #3: Developer Platforms and Software Infrastructure Are Increasingly Security-Critical

Three KEV additions involved developer or software-management platforms: JFrog Artifactory (CVE-2026-42016, CVE-2026-42018) and GitLab (CVE-2026-85706).

GitLab's vulnerability is particularly significant. CVE-2026-85706 can allow an unauthenticated attacker to exploit a path-traversal condition in the repository commits API and read arbitrary files under applicable configurations. GitLab released patched versions including 19.1.8, 19.2.6 and 19.3.2 for affected branches.

The larger operational concern is what resides around these platforms. Developer infrastructure can contain source code, build artifacts, API credentials, deployment secrets, signing material, CI/CD tokens, cloud credentials, and service-account permissions.

A vulnerability in a development platform should therefore be evaluated not only by its technical score, but also by the blast radius associated with the secrets, automation and downstream systems accessible from that platform.

Threat Theme #4: AI Abuse Expands the Attack Surface Beyond Traditional Vulnerabilities

Not every significant cybersecurity development this week involved a CVE.

On September 8, CISA, NSA and FBI issued a joint advisory stating that several China-based artificial-intelligence companies were conducting systematic, industrial-scale model-distillation activity targeting proprietary capabilities of U.S. frontier AI systems.

The agencies attribute the activity to organizations including DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI and state that the activity may occur with Chinese government knowledge or support. Those attribution judgments belong to the issuing agencies and should be treated as their assessment rather than independently established conclusions.

The advisory's defensive guidance focuses heavily on telemetry rather than traditional patching. Organizations operating AI services are encouraged to monitor for:

• Abnormal prompt volumes
• Coordinated account behavior
• Subscription-to-consumption anomalies
• New accounts immediately consuming maximum capacity
• Distributed usage across cloud or API aggregators
• Enterprise-scale throughput inconsistent with normal customer patterns
• Repeated prompts designed to reconstruct model capabilities

The agencies also recommend strong authenticated API access, rate limiting, AI-specific logging, targeted response controls and greater intelligence sharing among model providers, cloud providers and API aggregators.

This is an important evolution in exposure management. An organization can have fully patched servers and still face material risk through API economics, account abuse, AI-service misuse, cloud consumption patterns and third-party aggregation channels.

Threat Theme #5: Healthcare Integration Engines Remain High-Impact Infrastructure

CISA's September 10 medical advisory addressed three vulnerabilities in NextGen Healthcare Mirth Connect versions 4.7.1 and earlier. Unlike the KEV vulnerabilities discussed above, CISA reported no known public exploitation specifically targeting these Mirth Connect vulnerabilities at the time of publication.

CISA and NextGen recommend upgrading to Mirth Connect 4.7.2 or later.

Integration engines deserve particular attention because they often broker data between electronic-health-record systems, laboratories, pharmacies, imaging systems and other clinical applications. A vulnerability affecting the integration layer can therefore present a risk to confidentiality, integrity and availability across multiple downstream systems, even when the integration server itself is not patient-facing.

Why KEV Deadlines Differ

The week's CISA deadlines provide another useful security-program lesson. Federal remediation dates were not uniform. Examples included:

• Adobe CVE-2026-75650: September 11
• N-able CVE-2026-86218: September 11
• Fortinet CVE-2025-25249: September 12
• NetScaler CVE-2026-19490: September 12
• Cisco FMC CVE-2026-20079: September 12
• MikroTik CVEs: September 13
• ScreenConnect and GitLab: September 14
• Windows CVEs: September 22
• Chrome CVE: September 23
• JFrog CVEs: September 25

That reflects the risk-based approach introduced under CISA Binding Operational Directive 26-04. The directive superseded earlier federal vulnerability-remediation directives and incorporates factors such as asset exposure, KEV status, exploit automation, and technical impact. It also introduces forensic-triage expectations for certain designated high-risk scenarios.

BOD 26-04 is binding on applicable Federal Civilian Executive Branch agencies. Commercial organizations can use its prioritization logic as a useful security-management model, but the directive should not be presented as a legal requirement for private-sector organizations.

Industries Potentially Most Affected

Federal Government and Federal Contractors

Federal organizations face the clearest operational impact because applicable FCEB agencies must respond to risk-based CISA remediation deadlines under BOD 26-04. The diversity of the week's vulnerabilities also creates a broad inventory challenge: endpoints, browsers, network appliances, developer systems, security-management infrastructure and externally facing applications all appear in one reporting period.

Managed Service Providers and IT Service Providers

N-able N-central and ConnectWise ScreenConnect directly touch technologies widely used for remote monitoring, management and support. Administrative systems of this type deserve particularly aggressive exposure review because a successful compromise may provide privileged access to many downstream systems.

Financial Services

Financial institutions often operate large Windows estates, network-security infrastructure, developer environments and externally accessible applications. PCI DSS organizations should also consider whether affected assets fall within or can materially affect the cardholder-data environment. PCI SSC guidance requires timely remediation of critical vulnerabilities and expects organizations to assess vulnerability severity in the context of their own environment.

Healthcare and Health Technology

Healthcare carries two separate signals this week. First, healthcare organizations share exposure to many of the same Windows, network and remote-management products found elsewhere. Second, the Mirth Connect advisory directly affects healthcare interoperability infrastructure.

HHS OCR has advised HIPAA-regulated organizations to maintain accurate asset inventories, monitor authoritative vulnerability sources including CISA KEV and incorporate known unpatched vulnerabilities into Security Rule risk-analysis and risk-management activities.

Ecommerce and Digital Retail

Adobe Commerce and Magento are frequently internet-facing and directly support business revenue. CVE-2026-75650 therefore combines several priority indicators: known exploitation + public exposure + remote code execution + business-critical application + CVSS 10.0. Organizations should apply Adobe's remediation guidance and validate whether compromise occurred before the patch was installed.

Software Development and SaaS Providers

GitLab and JFrog Artifactory highlight the security importance of software-development infrastructure. The operational question extends beyond patching the platform itself to determining whether an exploited vulnerability could have exposed repositories, CI/CD secrets, package repositories, deployment credentials, cloud tokens, signing infrastructure, or downstream production environments.

Telecommunications, ISPs and Distributed Enterprises

MikroTik RouterOS exposure is particularly relevant to telecom providers, branch-heavy organizations, service providers and environments with large populations of remotely managed network devices. Internet-accessible administrative interfaces should receive immediate attention.

AI Companies, Cloud Providers and API Platforms

The joint CISA/NSA/FBI advisory expands this week's risk discussion beyond CVEs entirely. Frontier-model providers, cloud providers, API gateways, inference providers and AI aggregators should evaluate whether they have sufficient service telemetry to distinguish legitimate heavy usage from coordinated model-extraction behavior.

Regulatory, Compliance and Framework Considerations

None of these vulnerabilities automatically means an organization is noncompliant. The more meaningful question is whether relevant security obligations require the organization to maintain an effective process for identifying, evaluating, remediating and documenting vulnerabilities and exposure.

CISA BOD 26-04: Applicable FCEB agencies must use CISA's risk-based remediation framework. The directive incorporates known exploitation, asset exposure, exploit automation and potential technical impact rather than relying exclusively on CVSS.

HIPAA Security Rule: HHS OCR guidance emphasizes vulnerability identification, asset inventory, patching, risk analysis and monitoring of authoritative sources such as CISA KEV. For organizations using Mirth Connect to move protected health information, vulnerability management around the integration layer may therefore be relevant to broader confidentiality, integrity and availability safeguards.

PCI DSS: PCI DSS vulnerability-management requirements include timely installation of security patches for critical vulnerabilities and remediation of critical and high-risk findings identified through vulnerability scanning. PCI SSC also emphasizes that organizations should evaluate risk using environmental context rather than automatically inheriting an external severity ranking.

AI Security Governance: The joint federal advisory recommends operational controls including AI-specific logging, authenticated API access, monitoring of abnormal usage, rate limiting, red teaming and cross-provider intelligence sharing. For organizations operating AI platforms, these controls extend cybersecurity governance into areas that traditional vulnerability scanning alone cannot measure.

Defensive Priorities for the Week

1. Reconcile all 14 KEVs against asset inventory. Search for all 14 technologies across on-premises infrastructure, cloud workloads, network appliances, developer platforms, managed-service tooling, remote-access infrastructure, browsers and endpoints, and ecommerce platforms.
2. Start with externally reachable administrative infrastructure. Prioritize internet-facing N-central, NetScaler, Cisco FMC, RouterOS, ScreenConnect, GitLab, Artifactory, and Adobe Commerce / Magento. An internally deployed instance and an internet-exposed administrative interface do not carry the same operational risk.
3. Treat KEV status as threat intelligence, not just another score. CVSS describes technical severity. EPSS estimates exploitation probability. KEV indicates that sufficient evidence of exploitation already exists. Those signals answer different questions and should be combined rather than used interchangeably.
4. Re-prioritize old CVEs when exploitation changes. Fortinet, NetScaler, Cisco FMC and the JFrog vulnerabilities demonstrate why vulnerability findings cannot remain frozen at their original priority. Re-run prioritization whenever a CVE enters KEV, exploit code becomes public, exploitation is observed, an asset becomes internet-facing, business criticality changes, or a compensating control disappears.
5. Hunt where compromise could predate patching. Patching prevents future exploitation of a corrected flaw. It does not establish that exploitation did not occur beforehand. For actively exploited vulnerabilities, review relevant authentication events, administrative activity, new accounts, process execution, configuration changes, file access, web requests, network connections, and persistence mechanisms.
6. Validate remediation instead of closing tickets on intent. After maintenance, confirm installed software version, confirm the running kernel or service version, rescan the asset, verify that mitigations remain active, confirm public exposure changed where required, document approved exceptions, and preserve evidence of closure.
7. Include development infrastructure in exposure management. Repositories, package managers and CI/CD systems often contain high-value secrets and privileged automation. Prioritize them according to what they can reach, not simply the CVSS of the underlying flaw.
8. Add AI-service telemetry to security monitoring. Organizations operating AI platforms should consider account velocity, prompt and token volumes, API aggregation patterns, rate-limit evasion, geographic/network correlation, consumption anomalies, credential sharing, and coordinated account creation. The absence of a CVE does not mean the absence of an attack surface.

CVE / Threat Word Cloud

What Defenders Should Take Away

The headline number is difficult to ignore: 14 new KEV additions, up 100% from seven the week before.

But the number itself is less important than the distribution of risk. This week's exploited vulnerabilities touched operating systems, browsers, firewalls, routers, remote-management tools, developer platforms, ecommerce infrastructure, and application-delivery infrastructure.

Meanwhile, healthcare integration vulnerabilities and the federal warning about AI model distillation demonstrate that meaningful cyber exposure increasingly exists outside the traditional CVE-and-patch workflow.

The practical objective is therefore not simply to process more vulnerability tickets. Organizations need to be able to answer:

That is the difference between maintaining a vulnerability list and managing cyber exposure as an operational risk.

Methodology and Data Notes

This briefing covers September 6 through September 13, 2026, consistent with the requested reporting period. Independent review identified 14 CISA KEV additions.

The quantitative dataset contains 17 CVEs: 14 vulnerabilities added to CISA KEV during the reporting period, plus 3 Mirth Connect vulnerabilities covered by CISA's September 10 medical advisory.

Across this selected dataset: 8 of 17 are Critical, 9 of 17 are High severity, average CVSS v3.x is 8.90, and 14 of 17 (82.4%) are in CISA KEV with confirmed known-exploitation evidence. CISA reported no known public exploitation specifically targeting the three analyzed Mirth Connect vulnerabilities at advisory publication.

CVSS v3.x values were used where possible to maintain a consistent comparison. Where vendors principally publish CVSS v4 values, differences are noted rather than silently mixing scoring systems.

Average EPSS is intentionally reported as N/A. A complete, authoritative, date-aligned September 13 snapshot could not be verified for all 17 vulnerabilities. Combining historical and current EPSS values would create a misleading metric.

The week-over-week KEV comparison is supported by CISA data: seven additions during the preceding reporting week versus 14 during this period, producing a 100% increase. No other week-over-week percentages are presented without reliable comparable historical data.