buildOne report1 publisher Atlassian rates CVE-2026-21589 critical at CVSS 4.0 9.3, a no-login file-read flaw in every version of eight self-hosted products. Honeypots saw exploitation attempts by October 6, a day after the advisory, according to a dev.to write-up that found no public report of confirmed victims.
Reality
- Evidence62
- Adoption
- Insufficient
- Hype gap−10
- Incentives
- Insufficient
- Confidence60
Attackers began targeting SonicWall's maximum-severity SMA1000 flaw CVE-2026-102255 within three days of its patch, Previdian's honeypots show. SonicWall's advisory had not called it exploited by Friday, so owners waiting on that label are patching behind the attackers.
Perspective Coverage
6 publishers
- Builder
- Builder 11%
- Operator
- Operator 74%
- Investor
- Investor 15%
Reality
- Evidence68
- Adoption30
- Hype gap+20
- Incentives40
- Confidence72
Previdian recorded exploitation attempts against Atlassian's CVE-2026-21589 within two hours of watchTowr publishing the arbitrary file access technique. The CVSS 9.3 flaw lets an unauthenticated attacker read specific webroot files across eight Data Center products.
Perspective Coverage
6 publishers
- Builder
- Builder 27%
- Operator
- Operator 67%
- Investor
- Investor 6%
Reality
- Evidence78
- Adoption30
- Hype gap+15
- Incentives45
- Confidence70
buildOne report1 publisher Atlassian disclosed CVE-2026-21589, a 9.3-rated unauthenticated file-read flaw affecting all eight of its self-hosted Data Center products. A public proof of concept drew exploitation attempts within two hours of landing on 7 October.
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap−5
- Incentives
- Insufficient
- Confidence60
Microsoft says attackers are exploiting SharePoint flaw CVE-2026-65660, roughly six weeks after it shipped a fix in August. Any server still missing that update should be treated as possibly compromised, checked for webshells and patched.
Perspective Coverage
4 publishers
- Builder
- Builder 21%
- Operator
- Operator 79%
- Investor
- Investor 0%
Reality
- Evidence72
- Adoption
- Insufficient
- Hype gap+10
- Incentives
- Insufficient
- Confidence70
CISA listed WSO2's maximum-severity JWT bypass, CVE-2026-5430, as exploited, with a September 27 federal fix deadline. The public evidence so far is forged-token attempts from one IP against the wrong WSO2 product, a thinner record than Sansec's sighting of live Magento attacks.
Perspective Coverage
4 publishers
- Builder
- Builder 25%
- Operator
- Operator 65%
- Investor
- Investor 10%
Reality
- Evidence55
- Adoption25
- Hype gap+35
- Incentives40
- Confidence55
buildOne report1 publisher WordPress released 7.1.2 on 22 September 2026 to fix remote file inclusion flaw CVE-2026-87902, and the first exploit attempt was recorded the same day. The fix was back-ported to every maintained branch down to 4.7, so an exposed site has hours before scanners find it.
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap+20
- Incentives
- Insufficient
- Confidence40
CVE-2026-8452 shipped as a June 30 denial-of-service fix. A WatchTowr proof of concept turned it into pre-auth code execution, and in-the-wild exploitation followed.
Perspective Coverage
7 publishers
- Builder
- Builder 14%
- Operator
- Operator 80%
- Investor
- Investor 6%
Reality
- Evidence78
- Adoption50
- Hype gap−40
- Incentives
- Insufficient
- Confidence74
CISA says all four are under active exploitation, and three of them are unauthenticated flaws in edge and management appliances. Its own alert cites BOD 26-04 and prints no due date for any of them.
Perspective Coverage
4 publishers
- Builder
- Builder 14%
- Operator
- Operator 80%
- Investor
- Investor 6%
Reality
- Evidence72
- Adoption
- Insufficient
- Hype gap+10
- Incentives
- Insufficient
- Confidence70
Orkes Conductor evaluates workflow expressions on a GraalVM context with the sandbox disabled, and Fortinet blocked about 1,300 exploitation attempts against CVE-2026-58138 over two days in September.
Reality
- Evidence70
- Adoption
- Insufficient
- Hype gap+15
- Incentives
- Insufficient
- Confidence68
The flaw reaches code execution only where the active theme has a top-level directory starting with page- and a readable local .php file such as pearcmd.php sits on the server. Previdian has logged 68 attempts.
Reality
- Evidence66
- Adoption45
- Hype gap+12
- Incentives68
- Confidence60
buildOne report1 publisher Adobe shipped the out-of-band hotfix on September 8. Sansec dates exploitation to September 4, and that four-day gap is why the advisory pairs the patch with a required encryption-key rotation.
Reality
- Evidence60
- Adoption35
- Hype gap+15
- Incentives65
- Confidence55
CVE-2026-75650 scores a flat 10.0 and was already in use on September 4. Adobe's hotfix comes paired with encryption key rotation, and Sansec's Rust backdoor findings matter more than the score does.
Reality
- Evidence70
- Adoption55
- Hype gap+12
- Incentives62
- Confidence60
The mid-August Citrix advisory that many teams parked behind lower-risk work now has attack traffic behind it, and the appliances in scope are the ones fronting remote access. Role and firmware decide scope, not appliance count.
Reality
- Evidence60
- Adoption34
- Hype gap+15
- Incentives58
- Confidence58