Every year, a large share of breaches starts with an attacker exploiting a vulnerability in software the target is running, and it is now one of the most common ways into a network. What follows depends on where the flaw sits. A vulnerable VPN or mail server gives an attacker a foothold inside the network, while an exposed ERP or identity system does more damage, since those hold financial and identity records and can let an attacker authenticate as legitimate users.
Attackers move quickly on newly disclosed flaws, sometimes within hours and sometimes before a patch exists, and they keep exploiting years-old bugs that were never fixed. CISA adds new entries to its Known Exploited Vulnerabilities catalog almost every week.
| # | Vulnerability | CVE | Severity / Score |
|---|---|---|---|
| 01 | SMBGhost | CVE-2020-0796 | 10.0 |
| 02 | Equation Editor | CVE-2017-11882 | 7.8 |
| 03 | Log4Shell | CVE-2021-44228 | 10.0 |
| 04 | Exchange ProxyLogon | CVE-2021-26855 | 9.8 |
| 05 | FortiOS SSL VPN | CVE-2018-13379 | 9.8 |
| 06 | ZeroLogon | CVE-2020-1472 | 10.0 |
| 07 | SharePoint ToolShell | CVE-2025-6559 | 8.8 |
| 08 | Cisco Catalyst SD-WAN | CVE-2026-20127 | Critical |
| 09 | Oracle EBS / PeopleSoft | CVE-2026-46817 | 9.8 |
| 10 | Office Security Bypass | CVE-2026-21509 | High |
Below is our breakdown of the Top 10 Vulnerabilities Threat Actors Exploited Most in 2026. This list is not limited strictly to CVEs disclosed this year; rather, it highlights what threat actors actively weaponized in the wild throughout 2026, regardless of original disclosure date.
SMBGhost affects the SMBv3.1.1 compression mechanism. A specially crafted SMB message can trigger an integer overflow during decompression, resulting in memory corruption and potentially remote code execution.
Because SMB commonly operates on TCP port 445 and the vulnerability does not require authentication, an exposed and vulnerable system can become a valuable initial access target.
Exploitation in 2026
Although the vulnerability was disclosed in 2020, vulnerable Windows systems continued to attract automated scanning and exploitation activity in 2026. The main risk comes from internet-exposed systems that were never patched or were reintroduced into the attack surface after remediation.
The Equation Editor component, EQNEDT32.EXE, was developed without many of the modern security mitigations found in newer Office components.
A malicious Office document containing a specially crafted equation object can trigger a stack-based buffer overflow when opened, allowing an attacker to execute code in the context of the current user.
Exploitation in 2026
These vulnerabilities continue to appear in malicious document campaigns because they provide attackers with a relatively straightforward method of delivering malware through phishing.
They have historically been associated with commodity malware and targeted campaigns, demonstrating that attackers continue to reuse reliable exploitation techniques even years after disclosure.
Log4Shell abuses the way vulnerable Log4j versions process attacker-controlled input.
If an attacker-controlled value reaches a vulnerable logging function, specially crafted input can cause Log4j to perform a JNDI lookup to attacker-controlled infrastructure. Under vulnerable configurations, this can ultimately result in remote code execution.
The problem is amplified by the fact that Log4j is often included indirectly through other applications and dependencies.
Exploitation in 2026
Log4Shell remains relevant because organizations may not immediately know where vulnerable Log4j components exist in their environment. CISA has previously emphasized maintaining an inventory of vulnerable assets and conducting post-remediation monitoring because exploitation may already have occurred before patching.
In 2026, the continued presence of vulnerable applications, appliances, and legacy environments keeps Log4Shell relevant to attackers.
ProxyLogon begins with an SSRF vulnerability that can allow an unauthenticated attacker to interact with Exchange services with elevated privileges.
When chained with additional vulnerabilities, attackers can write a webshell to the Exchange server and obtain persistent code execution.
ProxyShell uses a different vulnerability chain but can similarly lead to unauthorized access and code execution.
Exploitation in 2026
Unpatched on-premises Exchange servers continue to be attractive targets because compromising a mail server can provide access to email data, credentials, authentication infrastructure, and internal network resources.
Attackers can also use compromised Exchange servers as a pivot point for further internal activity.
The vulnerability allows an attacker to perform directory traversal through the SSL-VPN web portal and access files outside the intended directory.
One particularly dangerous target is the SSL-VPN session file, which may contain sensitive session and credential information.
Exploitation in 2026
Credentials and session information obtained through exploitation of this vulnerability have continued to circulate among threat actors. Vulnerable FortiGate devices that remain exposed to the internet therefore remain attractive targets.
ZeroLogon affects the Netlogon Remote Protocol and allows an attacker on the network to abuse weaknesses in the authentication process.
A successful attack can allow the attacker to impersonate a domain controller and ultimately gain highly privileged access to the Active Directory environment.
Exploitation in 2026
Unlike vulnerabilities that are primarily used for mass internet scanning, ZeroLogon is particularly valuable after an attacker has obtained access to the internal network.
Unpatched domain controllers therefore remain high-value targets because successful exploitation can lead to full domain compromise.
The attack chain combines authentication bypass with vulnerabilities that can lead to remote code execution.
Successful exploitation can provide attackers with access to the SharePoint server and potentially expose sensitive authentication material such as ASP.NET machine keys.
Exploitation in 2026
This vulnerability cluster is one of the clearest examples of the rapid exploitation cycle of 2026.
CISA issued dedicated guidance following exploitation of vulnerable SharePoint deployments and emphasized additional hardening actions beyond simply installing updates.
The key lesson is that remediation may require more than patching when attackers may already have obtained cryptographic or authentication material.
The vulnerability affects authentication between SD-WAN components and can allow an unauthenticated attacker to bypass expected authentication controls.
Because the affected systems manage network infrastructure, successful exploitation can provide access to highly privileged management functionality.
Exploitation in 2026
The vulnerability became particularly significant because of observed exploitation against network-management infrastructure. Attackers targeting management systems can use them as a powerful position from which to manipulate or access the wider network.
CISA has repeatedly emphasized that publicly known vulnerabilities affecting network-edge and infrastructure devices should receive high patching priority.
The affected Oracle products contain vulnerabilities that can allow attackers to access internal functionality without valid authentication.
Depending on the vulnerability and attack chain, this can result in arbitrary file access, SSRF, or remote code execution.
Exploitation in 2026
The exploitation of enterprise applications such as Oracle E-Business Suite and PeopleSoft is particularly significant because these platforms often contain financial, employee, identity, and business-critical information.
The exploitation activity observed in 2026 demonstrates that attackers are increasingly targeting business applications rather than only traditional infrastructure.
The vulnerability allows specially crafted Office documents to bypass a security protection that would normally prevent potentially dangerous content from executing.
This gives attackers an additional path for delivering malicious content through targeted documents.
Exploitation in 2026
CVE-2026-21509 is particularly notable because it was exploited in targeted attacks shortly after disclosure.
This demonstrates how quickly attackers can operationalize newly disclosed vulnerabilities when the vulnerable technology is widely deployed.
The vulnerabilities above reveal several common patterns that are more important than any individual CVE.
Several vulnerabilities in this list were disclosed years before 2026.
This is important because attackers do not care when a CVE was published. If a vulnerable asset is still exposed, the vulnerability remains useful.
SMBGhost, Equation Editor, Log4Shell, ProxyLogon, FortiOS and ZeroLogon all demonstrate the same pattern:
Known vulnerability + vulnerable asset + exposure = continued attack opportunity
VPNs, mail servers, firewalls, SharePoint, SD-WAN management systems and enterprise applications repeatedly appear in exploitation campaigns.
These systems sit at the edge of the organization’s attack surface and are therefore reachable before an attacker has established an internal foothold.
A CVE by itself does not tell an organization whether it is currently exposed.
The real security question is: Do we have an internet-facing asset running the vulnerable technology?
This is where vulnerability intelligence and Attack Surface Management intersect.
A vulnerability may have a CVSS score of 10, but if the affected product is not deployed, the practical exposure may be low.
Conversely, a lower-CVSS vulnerability can become a critical operational risk when it exists on an exposed, business-critical asset and is actively exploited.
ZeroLogon, Exchange, SD-WAN and enterprise application vulnerabilities demonstrate another important pattern.
The most dangerous asset is not always the one with the highest CVSS score.
It may be the asset that provides:
This makes asset context an essential part of vulnerability prioritization.
Most exploitation in 2026 targeted known, patchable vulnerabilities. Six of the ten were disclosed before 2022, highlighting that reducing the patch backlog especially on internet-facing and identity systems should be a top priority.
For prioritization, exploitation status is often more useful than CVSS. Use KEV membership as the first filter, as it indicates confirmed exploitation, followed by EPSS to assess the likelihood of near-term exploitation. CVSS should then be used to understand the potential severity if the vulnerability is exploited.
Patching alone may not be enough if an attacker has already gained access. Some 2026 edge-device vulnerabilities can expose keys or session material before a fix is applied, and that compromised material may remain valid even after patching. Organizations should therefore combine patching with credential/key rotation, session invalidation, and post-compromise investigation where exposure is suspected.
Why do top 10 exploited vulnerability lists keep listing old CVEs?
Many are recycled from previous years, with only the date updated. This is why vulnerabilities such as ZeroLogon and Log4Shell, originally disclosed between 2020 and 2022, can still appear on “2026” lists.
Is CVSS a good way to prioritize patching?
Not on its own. CVSS measures severity, not active exploitation. In 2026, the actively exploited SharePoint vulnerability CVE-2026-56164 had a CVSS score of 5.3, while the AD FS vulnerability enabling Golden SAML scored 7.8. A CVSS-first approach could therefore deprioritize vulnerabilities that attackers are actively exploiting. KEV status and EPSS should be prioritized instead.
What does CISA KEV mean and why does it matter?
The Known Exploited Vulnerabilities (KEV) catalog is CISA’s list of vulnerabilities with confirmed exploitation in the wild. A CVE is added only when there is evidence of active exploitation, making KEV a stronger prioritization signal than severity alone. US federal agencies have mandatory remediation deadlines for KEV entries, which private organizations can also use as a strong baseline.
How fast are new vulnerabilities exploited after disclosure?
Sometimes within hours. The Citrix NetScaler vulnerability CVE-2026-8451 was reportedly exploited roughly 24 hours after disclosure. For edge devices, exploitation can also begin before a CVE is publicly disclosed. This significantly reduces the available patch window and makes rapid detection and response essential.
What is EPSS and how is it different from CVSS?
EPSS (Exploit Prediction Scoring System) estimates the likelihood that a vulnerability will be exploited in the near term, while CVSS measures its potential severity if exploited. They answer different questions. Combining KEV status with EPSS provides a more effective prioritization signal than relying on CVSS alone.
How ThreatMon Helps Reduce External Exposure
The vulnerabilities discussed throughout this article show that the challenge is not simply knowing which CVEs exist, but knowing where those vulnerabilities exist across an organization’s external attack surface. This is where Attack Surface Management becomes critical. ThreatMon helps security teams continuously connect exposed assets, technologies, vulnerabilities, and risk to provide a clearer view of external exposure.
Discover Exposed Assets
Organizations often have internet-facing assets that are missing from internal inventories. Through continuous Attack Surface Management, ThreatMon helps identify domains, subdomains, IP addresses, applications, services, and technologies exposed to the internet.
Identify Vulnerable Technology
Once an exposed asset is discovered, technology fingerprinting and vulnerability intelligence can help determine whether it is running an affected product or version. This allows security teams to move beyond simply knowing that a CVE exists and identify which exposed asset may actually be affected.
Prioritize What Attackers Can Reach
Not every vulnerability represents the same level of risk. ThreatMon helps security teams prioritize vulnerabilities by considering vulnerability, exposure, and asset importance together. This is particularly valuable for KEV vulnerabilities, where confirmed exploitation makes exposed vulnerable assets a higher-priority remediation target.
Continuously Monitor the Attack Surface
External attack surfaces change constantly. New subdomains and cloud assets appear, services become exposed, and technologies change over time. Continuous ASM monitoring helps detect these changes and identify new exposures that may otherwise remain unnoticed between periodic security assessments.
Reduce the Window of Exposure
The goal of ASM is not simply to create a larger vulnerability list, but to reduce the time between asset exposure, vulnerability discovery, risk identification, and remediation. As the 2026 exploitation landscape shows, attackers continue to exploit both long-standing vulnerabilities and newly disclosed flaws. Continuous visibility through ThreatMon helps organizations identify and reduce these opportunities before attackers do.
More posts
Share this article
Found it interesting? Don’t hesitate to share it to wow your friends or colleagues
Subscribe to our blog newsletter to follow the latest posts
