September's exploited flaws clustered at the network edge. CISA gave agencies three days.

In brief

Between 2 and 25 September, CISA added 39 actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue. About half sit in the products organisations deliberately expose to the internet: VPN gateways, firewall and email-security appliances, identity services and remote-management tools. Every one of those edge entries carries a three-day federal deadline. Under Binding Operational Directive 26-04, agencies must also check whether each device was compromised before it was fixed.

Microsoft's record Patch Tuesday took the headlines. But only two of its roughly 970 fixes were for flaws already under attack, and both need an attacker who is already on the machine. September's proven exposure was at the edge, and in several cases attackers were in before the patch.

What was exploited at the edge

These are the internet-facing and remote-management products CISA listed as exploited in September, with the date each entered the catalogue.

Two web platforms joined them on 25 September. WordPress core CVE-2026-87902, fixed in version 7.1.2 on 22 September, was being exploited within hours. SharePoint CVE-2026-65660 was first published in August as a moderate spoofing flaw. It is in fact authenticated remote code execution. Exploit code was public by 22 September, and CISA listed it as exploited three days later.

Why it matters

Three days is now the federal standard, and it includes a compromise check. BOD 26-04, issued in June, replaced the older BOD 22-01 timelines. Each September entry's required action cites its forensic-triage requirement: fix or mitigate within the deadline, then assess whether the system was already compromised. CISA's note on the F5 flaw spells out the order. Apply F5's temporary iRule first "to allow for proactive forensic triage", then install the final patch. Private companies are not bound by the directive, but it is the clearest public benchmark for how fast exposed appliances now need fixing.

The gap between fix and attack has closed, and sometimes reversed. Truesec reports that attacks on Check Point's VPN flaw began on 12 September, three days after the fix shipped. It also reports targeted attacks on the management-server flaw as early as 23 July, two months before Check Point's emergency hotfix. Patchstack saw the WordPress flaw exploited within hours of disclosure, and the attempts had turned into compromises by the next evening. A monthly patch cycle cannot keep up with that for anything reachable from the internet.

The record patch count measured volume, not threat. Microsoft's release on 8 September fixed 964 CVEs by Tenable's count, 966 by BleepingComputer's, 972 by ZDI's and CrowdStrike's, and 974 by SecurityWeek's. Each calls it the largest monthly release on record. ByteNib found no Microsoft statement making that claim. Only two of those flaws were being exploited: CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in ALPC. Both are local privilege escalations. The ALPC flaw mattered because an espionage kit that Proofpoint attributes to the China-linked APT31 chained it behind two Chrome zero-days. Tenable's Satnam Narang summed up the month: AI-assisted discovery is "creating larger haystacks, but isn't finding more needles."

Edge exploitation feeds ransomware later. As of 25 September, the catalogue marked none of the 39 September entries as known ransomware use. But Cisco Talos tied the Firewall Management Center exploitation to three clusters, and in some cases the intruders deployed Qilin ransomware. Over the month, BleepingComputer also reported CISA re-marking older entries for VMware vCenter, JetBrains TeamCity and WatchGuard Firebox as used by ransomware gangs. An edge flaw exploited quietly this month can become someone else's ransomware entry point later.

What leaders should do next

1. Check the table against your estate this week. For each product you run, confirm the version and whether its management or VPN interface is reachable from the internet. Anything on that list and exposed is the priority, ahead of the Patch Tuesday backlog.
2. Treat "patched" as half the job. Where a flaw was exploited before you patched, look for signs of compromise before closing the ticket, as the federal directive now requires. For Check Point management servers, that means looking back to July, not September.
3. Give exposed appliances their own clock. A 72-hour internal target for KEV-listed edge flaws, with pre-approved emergency change windows, is the practical private-sector version of the federal rule.
4. Triage Patch Tuesday by exposure. Deploy the two exploited privilege escalations first. Then patch the Windows DNS Server flaw on domain controllers (CVE-2026-69730, CVSS 9.8), Exchange (CVE-2026-55007) and Remote Desktop Services (CVE-2026-69525). If Remote Desktop or Hyper-V broke after the 8 September release, Microsoft's out-of-band update of 14 September fixes it.
5. Handle the Kiteworks warning on its merits. On 25 September Kiteworks asked customers to shut their servers down for six hours on 26 September. It cited threat intelligence from "federal intelligence authorities", named no vulnerability and said it was "not aware of any compromise". Follow the vendor's instructions and run its current release, 9.5.1. Until more is published, the threat itself is unverified.

Sources and scope

The catalogue additions, dates and deadlines come from CISA's Known Exploited Vulnerabilities feed, version 2026.09.25, so anything added on 26 September is not included. The directive is BOD 26-04.

Vendor advisories: Cisco for ISE, Secure Email Gateway and Firewall Management Center; F5 K000162605; Arista; Check Point sk1000117 and sk1000171; and the WordPress advisory. Check Point exploitation dates are from Truesec, a single security firm. WordPress exploitation timing is from Patchstack as reported by SecurityWeek.

Patch Tuesday counts come from Tenable, BleepingComputer, ZDI, CrowdStrike and SecurityWeek. The Talos ransomware link is from BleepingComputer, and the Kiteworks request is from The Record.

The count of edge products, the comparison between patch volume and exploitation, and the recommendations are ByteNib editorial analysis. ByteNib covered August's additions in CISA catalogued nine exploited vulnerabilities in ten days.

Continue exploring: Cybersecurity analysis, the related implementation tutorial, and the structured learning path.