September’s clearest message came from the network edge: attackers were actively exploiting an unauthenticated code-execution bug in Check Point VPN gateways, while similar flaws landed in Citrix, SonicWall and Cisco security appliances. These are not buried application servers; they are systems deliberately placed at trust boundaries, often exposed to the internet and entrusted with traffic, remote access or email.
The web stack was no quieter. Exploitation reached ecommerce platforms, WordPress and Chromium-based browsers, while an N-able management-server flaw put managed service providers and, by extension, their customers in the firing line. What made the month distinctive was the concentration of KEV-listed, pre-authentication paths to high-value systems.
Check Point VPN gateway takeover
CVE-2026-85102 is the month’s most urgent perimeter problem. Check Point Quantum Security Gateways, Gaia OS and Gaia Embedded devices using site-to-site or remote-access VPN can improperly validate certificates during VPN negotiation. An unauthenticated remote attacker can turn that trust mistake into arbitrary code execution on the gateway itself.
That is a particularly bad place to lose control: the device mediates remote access and network traffic, so compromise can hand an intruder a durable foothold at the boundary of the organisation. The flaw was publicly disclosed on September 9 and added to CISA’s Known Exploited Vulnerabilities catalog on September 22. Check Point has published an advisory and remediation; teams running affected VPN configurations should treat it as an exposure question to answer immediately, not a normal patch-window item.
Citrix NetScaler command execution
Citrix’s September release fixed an input-validation issue, CVE-2026-88771, in NetScaler ADC and NetScaler Gateway. A remote, unauthenticated attacker can execute arbitrary commands. These products commonly front applications and provide remote access, which makes an exposed unpatched instance a direct route to infrastructure that was meant to be guarded by it.
Exploitation was confirmed and the issue entered KEV on September 27, the day it was published. Fixed versions include ADC and Gateway 14.1-73.37 and 13.1-64.23, with corresponding FIPS and NDcPP builds specified by Citrix. This was also a release-level triage job, not a one-CVE exercise: the bulletin included other issues, among them CVE-2026-88772, CVE-2026-88775 and CVE-2026-88776. Apply the vendor’s applicable updated build rather than stopping after checking the headline flaw.
SonicWall and Cisco appliance compromise
SonicWall’s CVE-2026-83548 was an actively exploited, pre-authentication server-side request forgery in the SMA1000 Appliance Work Place interface. An alternate access path lets an unauthenticated remote attacker reach sensitive functionality and perform unauthorised operations. It was KEV-listed on September 2, effectively opening the month with an exploited remote-access appliance zero-day. SonicWall’s related release also addressed CVE-2026-83549; use the vendor remediation for the appliance release, not a narrowly targeted workaround.
Cisco Secure Email Gateway had an equally uncomfortable failure mode in CVE-2026-76461. Crafted email can exploit inadequate validation in AsyncOS email parsing, inject SQL statements and ultimately execute commands as root on the underlying operating system. No account or user action is needed beyond delivering the message to an affected device. The flaw was exploited and KEV-listed on September 14, and Cisco has issued an advisory and fixes. A mail gateway is supposed to inspect hostile input; here, hostile input could take over the inspector.
Web platforms under attack
Adobe Commerce and Magento Open Source installations faced exploited arbitrary code execution through CVE-2026-75650, a template-engine neutralisation error. Exploitation needs no user interaction and executes code in the context of the current user, putting internet-facing storefronts and the systems behind them at risk. Adobe released a security update, but reports of attackers backdooring servers make checking for post-compromise activity as important as applying it.
WordPress core followed later in the month with CVE-2026-87902. An unauthenticated attacker can influence page-template resolution so it includes a readable local PHP file outside active theme directories. Under the required server and theme conditions, that becomes remote code execution. The issue was patched, then attackers began probing sites within hours; it was added to KEV on September 25. WordPress’s reach turns a conditional bug into a broad operational concern, especially where themes and hosting layouts meet those preconditions.
Chromium V8 sandbox escape
CVE-2026-87491 was an out-of-bounds write in Chromium’s V8 JavaScript engine. A crafted HTML page can achieve code execution inside the browser sandbox, and Google said an exploit existed in the wild. It affected Chrome before version 153.0.8010.36 and also matters to Chromium consumers such as Microsoft Edge and Opera.
The sandbox still limits what malicious web content can do, which is why “inside the sandbox” matters, but an exploited browser engine bug is not a reason to postpone updates. Chrome shipped the fix and Edge ingested Chromium’s correction; organisations need to confirm that their managed browser channels have actually moved to fixed builds. The KEV listing on September 8 underlines that this was not merely a research finding.
The perimeter carried the month
September concentrated risk in software that brokers trust: VPN gateways authenticate users and connect networks, ADCs publish applications, remote-access appliances bridge employees to internal services, and email gateways process untrusted messages before anyone else sees them. The Check Point, Citrix, SonicWall and Cisco cases differ technically—certificate validation, input validation, SSRF and SQL injection—but converge on the same outcome: an internet-reachable system can be taken over without credentials.
Authentication and authorisation mistakes were also a wider theme, with alternate paths and weak boundary checks recurring across enterprise and open-source software. At the same time, batch advisories from major vendors made release-level patching important: a team that tracks only the most visible identifier can miss adjacent fixes. AI tooling added another growing class of command-execution, sandbox and file-access exposure, though it did not displace the much more immediate appliance problem. N-able N-central illustrated the stakes for managed environments: CVE-2026-86218 is an exploited, KEV-listed pre-authentication code-injection flaw fixed in version 2026.3.1.14, with one management server potentially representing many customer networks.
It added up to a month where exposed gateways and management planes deserved first place in patch queues, followed closely by web platforms and browsers. Start by identifying the internet-facing appliances and storefronts you actually run, verify their fixed releases, and use SecAlerts to monitor your organisation’s software stack for new vulnerabilities that apply to those products rather than sifting every item in the month’s list.
