Monthly exploitation report · September 2026
Executive analysis of KEV additions, sensor-observed exploitation activity, CISA visibility gaps, and the vulnerabilities that drove September 2026.
148 were outside CISA KEV when added
Up 30.4% from August
Share of events tied to five vulnerabilities
Across 35 vulnerabilities added by Previdian first
Executive brief
Five vulnerabilities produced 80.1% of September events. Prioritize asset discovery and remediation around PHPUnit, react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel, PHP, IP Camera, and vite, vite-plus.
Previdian added 148 exploited vulnerabilities outside CISA KEV during September; 113 were still absent at month-end.
Event volume and source breadth help identify pressure, but observations do not prove that a real-world target was compromised or represent all exploitation activity worldwide.
Exploitation activity
Previdian sensors recorded 214,577 exploitation events in September, up from 164,539 in August. A small set of vulnerabilities drove most of the observed volume.
Observed exploitation events
August versus September 2026
208
Vulnerabilities observed
4,280
Source IPs
27
First observed
For CISOs, this concentration supports a focused exposure-validation and remediation sprint rather than treating every observed CVE as equally urgent.
Early Warning
14 of the KEVs added during September 2026 were already on the autonomous watchlist. The median lead time was 1.7 days; the longest was 34.3 days.
1.7 days
Median lead
9.0%
Share of new KEVs
CVE Publication to KEV
155 of the KEVs added during September 2026 had a CVE publication date. 31 were concurrent disclosures (CVE record and KEV on the same UTC day) and are excluded from the median. 6 were added before the CVE record was published. The median among the remaining 118 was 216 days, up from 90 days in August.
216 days
Median after publication (126 days slower than August)
20.0%
Concurrent same-day share
Visibility before CISA KEV
35 vulnerabilities were added by Previdian before later inclusion in CISA KEV. The median lead time was 0.8 days; the longest was 14.6 days.
0.8 days
Median positive lead
113
Still absent at month-end
Most targeted
Ranked by sensor-observed exploitation events. Event volume shows intensity; unique source IPs help indicate breadth.
51.1% of monthly events
Meta · react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel
In CISA KEV
11.7% of monthly events
7.6% of monthly events
5.1% of monthly events
4.6% of monthly events
2.8% of monthly events
2.6% of monthly events
2.4% of monthly events
2.0% of monthly events
1.5% of monthly events
Vendor exposure
Car_rental_management_system_project
4 outside CISA KEV when added
Cisco
4 outside CISA KEV when added
Mikrotik
3 outside CISA KEV when added
Yonyou
4 outside CISA KEV when added
3 outside CISA KEV when added
Weakness patterns
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Most common newly added weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
11 newly added KEVs
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
10 newly added KEVs
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
9 newly added KEVs
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
8 newly added KEVs
51.3%
Critical severity
259
Public PoC references
216
Nuclei references
207
Observed request paths
Methodology and limitations
These notes define the reporting window, what sensor observations mean, and where the dataset should not be generalized.
Full Previdian methodology1 September 2026 00:00 UTC through 30 September 2026 23:59 UTC.
Previdian telemetry represents activity observed by the Previdian sensor network; it does not represent all exploitation activity globally.
An observed exploitation attempt does not by itself demonstrate that a real-world target was successfully compromised.
Month-end status is reconstructed from stored CISA addition dates. Removals are not tracked.
Unique source-IP counts require raw sensor rows. When only daily rollups exist, the metric is unavailable.
Historical or backfilled KEV records cannot be identified reliably from existing fields and are not listed as a separate category.
Public reports do not disclose Previdian sensor network size or per-CVE sensor counts.
Early-warning lead time is the gap from first autonomous-watchlist listing to first Previdian KEV. Only positive gaps are counted. Listings after a KEV already existed are excluded.
Time from CVE publication to KEV uses UTC calendar days from the CVE publication date to the first Previdian KEV. Same-day concurrent disclosures (CVE record and KEV on the same UTC day) are counted separately and excluded from the median, as are KEVs added before the CVE record was published.
Prefer deep links to individual CVE reports and this methodology when citing sensor-observed vulnerabilities.