Topic
The operational gap between a fix shipping and estates applying it, sharpened when remediation requires rebuilding and redeploying an application.
CERT-BUND has rated 36 CVEs in 16 contributed Drupal projects high risk, and Drupal core is not listed as affected. Each site team has to check the modules it has installed against 19 fixed releases and confirm that the code serving requests actually changed.
Reality
GitLab patched CVE-2026-90970, a sandbox escape that lets any authenticated Duo Agent Platform user run arbitrary commands on a self-hosted AI Gateway. Customers on GitLab's hosted gateway are already protected, so the upgrade falls to Self-Managed shops that run their own.
Perspective Coverage
4 publishersReality
WordPress released 7.1.2 on 22 September 2026 to fix remote file inclusion flaw CVE-2026-87902, and the first exploit attempt was recorded the same day. The fix was back-ported to every maintained branch down to 4.7, so an exposed site has hours before scanners find it.
Reality
TECH VEDA counts 36 actionable device CVEs across 14 non-kernel packages in September, two of them Chromium V8 bugs on CISA's exploited list. How many apply to a given fleet depends on each image's SBOM and on which scorer a team trusts.
Reality
Microsoft says attackers are exploiting SharePoint flaw CVE-2026-65660, roughly six weeks after it shipped a fix in August. Any server still missing that update should be treated as possibly compromised, checked for webshells and patched.
Perspective Coverage
5 publishersReality
The kernel fixed CVE-2026-80521 on August 6. Ubuntu has shipped nothing for 22.04, 24.04 or 26.04, including its AWS, Azure and GCP kernels, and DepthFirst's exploit for 26.04 went public on September 22.
Reality
CISA added Linux kernel flaw CVE-2026-53266 to its Known Exploited Vulnerabilities catalog on 18 September 2026. Affected versions and fixed builds come from each distribution's security notice, and a host is protected only once it reboots into the fixed kernel.
Reality
Adobe's September Connect patch fixes a CVSS 9.9 SQL injection that lets a low-privileged user run arbitrary code. Connect gives accounts to outside students and partners, so that bar is low enough to justify a separate 12.12 window even with no exploitation reported.
Reality
The August 2026 Critical Security Patch Update carried 943 fixes across 23 product families, roughly 65% of Oracle's largest quarterly release. Monthly windows now need quarterly-sized capacity.
Reality
WatchTowr reproduced CVE-2026-19478 from the advisory and patch alone, then caught the first exploitation attempts on its honeypots. Self-managed owners do not get a week to schedule this.
Perspective Coverage
7 publishersReality
CVE-2026-21962 reached CISA's exploited-vulnerabilities catalog on August 24 with an August 27 deadline. Honeypots logged attempts in March, and Oracle's fix has been available since January.
Reality
Plex Media Server 1.43.3 and Desktop 1.115.0 fix flaws that still carry no CVE IDs and no description, which leaves anyone running the server on a NAS waiting on a package manager while the patched builds are already public.
Perspective Coverage
3 publishersReality
CVE-2026-73749 lets an unauthenticated attacker run privileged code on HPE Aruba switches by sending malformed packets to a daemon the bulletin never names. The oldest affected branch is already out of maintenance.
Perspective Coverage
3 publishersReality
CVE-2026-20212 needs no credentials and returns root on ten Silicon One Nexus 9000 models. Cisco named no fixed release with the advisory. Remediation starts with a web lookup and an access list.
Perspective Coverage
4 publishersReality
Metabase published a critical fix on August 6, Mathspace's escalation process never surfaced it, and by the time the update went in on August 29 an intruder had been inside the reporting instance for 19 days and had already exported 1,079,819 records.
Perspective Coverage
4 publishersReality
CVE-2026-87491 gives a crafted web page code execution inside Chrome's sandbox. The fix only takes effect when the browser restarts, and long-running sessions carry that exposure until they do.
Perspective Coverage
5 publishersReality
PaperCut NG/MF 26.0.5, 25.0.13 and 24.1.10 carry every fix from three emergency patch rounds plus two regression fixes, while GreyNoise and Blackpoint Cyber count at least 395 organizations already breached.
Reality
Wiz observed multiple actors chaining CVE-2026-42018 and CVE-2026-42016 against self-hosted JFrog Artifactory between August 15 and September 8, creating admin accounts, loading Groovy plugins and dropping a Rust backdoor.
Perspective Coverage
4 publishersReality
Check Point assigned the CVE identifiers and the 9.8 scores itself and shipped fixes on September 9, so there is no outside read on how reachable the bugs are. Customers on R81.10 get neither a hotfix nor Live Patch.
Perspective Coverage
5 publishersReality
cPanel's September 14 advisory covers every LiteSpeed Web Server Enterprise build before 6.3.7. The fix shipped on September 11; because auto-update may lag, administrators have to force it onto servers by hand.
Reality
Security · September 24, 2026 · 2 publishers
Security · September 24, 2026 · 1 publisher
Security · September 23, 2026 · 1 publisher
Security · September 23, 2026 · 1 publisher
Build · September 22, 2026 · 1 publisher
Security · September 22, 2026 · 1 publisher
Build · September 22, 2026 · 1 publisher
Build · September 21, 2026 · 1 publisher
Security · September 21, 2026 · 1 publisher
Security · September 21, 2026 · 1 publisher
Security · September 20, 2026 · 1 publisher
Product · September 20, 2026 · 1 publisher
Build · September 19, 2026 · 1 publisher
Build · September 19, 2026 · 1 publisher
Build · September 19, 2026 · 2 publishers
Security · September 19, 2026 · 1 publisher
Product · September 19, 2026 · 1 publisher
Build · September 16, 2026 · 1 publisher
Build · September 18, 2026 · 1 publisher
Security · September 18, 2026 · 1 publisher
Security · September 18, 2026 · 1 publisher
Security · September 18, 2026 · 1 publisher
Build · September 17, 2026 · 1 publisher
Security · September 18, 2026 · 1 publisher
Security · September 17, 2026 · 1 publisher
Build · September 17, 2026 · 1 publisher
Build · September 17, 2026 · 1 publisher
Security · September 17, 2026 · 1 publisher
Security · September 16, 2026 · 1 publisher
Security · September 16, 2026 · 4 publishers
Security · September 16, 2026 · 2 publishers
Security · September 16, 2026 · 1 publisher
Security · September 16, 2026 · 2 publishers
Build · September 15, 2026 · 2 publishers
Security · September 15, 2026 · 1 publisher
Leadership · September 15, 2026 · 1 publisher
Product · September 15, 2026 · 1 publisher
Product · September 14, 2026 · 1 publisher
Build · September 14, 2026 · 1 publisher
Security · September 14, 2026 · 1 publisher