Exposure Signal Digest · Archive

What moved
that week

Week of September 15, 2026

By Jonathan Risto

This is an archived issue. See the latest digest or all issues.

Why this digest exists

Most CVEs never move.
We watch the ones that do.

Exploitation probability spikes overnight. Public exploits land. CVEs cross into confirmed in-the-wild use. That movement, the change, is what ESIP scores and surfaces.

Silence is not clearance: a CVE that didn't move isn't a safe one, just one nothing has happened to that week. When something does move, that change is the exposure signal.

7

Escalating this week

15

New KEV additions

4

Newly weaponized

What moved

The movers.

Mover #1 · EUVD-confirmed exploitation

CVE-2026-75650

Adobe Commerce

CriticalConfirmedVerified

Weakness: CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine

What changed

ENISA EUVD confirmed exploitation on September 9; the signal crossed into Confirmed.

Why it matters

A template-engine injection in Adobe Commerce, now government-confirmed as exploited and corroborated by ENISA EUVD. Confirmed at critical severity. Act now.

Mover #2 · EUVD-confirmed exploitation

CVE-2026-86218

N-able N-central

CriticalConfirmedVerified

Weakness: CWE-96 Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')

What changed

ENISA EUVD confirmed exploitation on September 9; the signal crossed into Confirmed.

Why it matters

A pre-authentication RCE in N-able N-central, now government-confirmed as exploited and corroborated by ENISA EUVD. Confirmed at critical severity. Act now.

Mover #3 · EUVD-confirmed exploitation

CVE-2026-81963

Windows Update (link following)

CriticalConfirmedVerified

Weakness: CWE-59 Improper Link Resolution Before File Access ('Link Following'); CWE-284 Improper Access Control

What changed

ENISA EUVD confirmed exploitation on September 9; the signal crossed into Confirmed.

Why it matters

A link-following privilege escalation in Windows Update, now government-confirmed as exploited and corroborated by ENISA EUVD. Confirmed at critical severity. Act now.

Mover #4 · Confirmed, now weaponized

CVE-2026-83548

SonicWall SMA1000

CriticalConfirmedVerified

Weakness: CWE-918 Server-Side Request Forgery (SSRF); CWE-441 Unintended Proxy or Intermediary ('Confused Deputy')

What changed

A Metasploit module landed (sonicwall_sma1000_couchdb_rce), on top of confirmed exploitation.

Why it matters

The confirmed-exploited SonicWall SMA1000 SSRF now has a public Metasploit module. High velocity, evidence accumulating fast. Treat as immediate.

Mover #5 · Newly weaponized

CVE-2026-19295

IBM Langflow (eval injection)

HighActiveHigh

Weakness: CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

What changed

A Metasploit module landed (langflow_auth_rce_cve_2026_19295).

Why it matters

An authenticated eval-injection RCE in IBM Langflow, now weaponized with a Metasploit module. Active and escalating. Review against your inventory.

Mover #6 · Newly weaponized

CVE-2026-75604

Next.js

HighActiveHigh

Weakness: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

What changed

A Metasploit module landed (nextjs_unauth_rce_cve_2026_75604).

Why it matters

A path-traversal RCE in the Next.js framework, now weaponized with a Metasploit module. Active and escalating. Review against your inventory.

Mover #7 · Newly weaponized

CVE-2026-18729

IBM Langflow (code injection)

HighActiveHigh

Weakness: CWE-94 Improper Control of Generation of Code ('Code Injection')

What changed

A second Langflow Metasploit module landed just three days ago (langflow_auth_rce_cve_2026_18729).

Why it matters

A second IBM Langflow RCE, code injection this time, weaponized just three days ago. The threat picture is actively changing. Review against your inventory.

New confirmed exploitation