# september 2026 > markdown for agents. every page and download is listed in [llms.txt](https://cvegen.art/llms.txt). ![drybrush poster for september 2026, painted from 14,934 published cves](https://media.cvegen.art/posters/2026-09/1280.jpg?v=60337f4b03) what the poster shows: 30 days as bands of dry brush, the first day at the top. every one ran above the 2025 average for their weekday, so every band sweeps fast and wide. two inks: the deep one for open-source packages, enterprise vendors, the linux kernel, browsers and ai software, the pale one for everything else. the poster being painted, a 12 second film: [mp4](https://media.cvegen.art/films/2026-09.mp4?v=8627e6d80d) | fact | value | | --- | --- | | cves | 14,934 | | against an average 2025 month | 3.7× | | busiest day | sep 8, 1,563 | | rated critical, cvss 9 or higher | 1,479 | | critical with no login and no click | 1,035 | | used in real attacks | 32 | ## september 2026 in numbers september 2026 brought 14,934 cves, 3.7 times an average 2025 month. every one of its 30 days ran above the 2025 average for that weekday. - 1,563 on sep 8, the busiest day. microsoft published 965 of them at once. - 1,479 rated critical, cvss 9 or higher. 1,035 of them can be hit over the network with no login and nothing for a user to click. - 675 in browsers, 15 times their 2025 monthly average. no other kind of software grew as fast. - 2,197 came in three single drops: microsoft 965 on sep 8, oracle 634 on sep 15, the linux kernel team 598 on sep 17. ## 32 already used in real attacks cisa kev, as of oct 24. ### by product - 4 plex media server, sep 23 - 3 mikrotik routeros, sep 5 - 2 sonicwall sma1000 appliances, sep 1 - 2 google chromium v8, sep 3, 9 - 2 microsoft windows, sep 8 - 2 check point products, sep 9, 22 - 2 citrix netscaler, sep 27 - 2 zammad, sep 30 - 1 n-able n-central, sep 6 - 1 adobe commerce and magento, sep 7 - 1 connectwise screenconnect, sep 8 - 1 gitlab community edition and enterprise edition, sep 12 - 1 cisco secure email gateway, sep 14 - 1 google pixel, sep 15 - 1 cisco identity services engine, sep 16 - 1 acronis backup, sep 17 - 1 arista velocloud orchestrator, sep 22 - 1 f5 big-ip apm, sep 22 - 1 wordpress core, sep 22 - 1 apple products, sep 28 - 1 cisco catalyst sd-wan manager, sep 30 ### every cve - sep 1, sonicwall sma1000 appliances, [cve-2026-83548](https://www.cve.org/CVERecord?id=CVE-2026-83548) - sep 1, sonicwall sma1000 appliances, [cve-2026-83549](https://www.cve.org/CVERecord?id=CVE-2026-83549) - sep 3, google chromium v8, [cve-2026-85046](https://www.cve.org/CVERecord?id=CVE-2026-85046) - sep 5, mikrotik routeros, [cve-2026-67277](https://www.cve.org/CVERecord?id=CVE-2026-67277) - sep 5, mikrotik routeros, [cve-2026-67279](https://www.cve.org/CVERecord?id=CVE-2026-67279) - sep 5, mikrotik routeros, [cve-2026-86060](https://www.cve.org/CVERecord?id=CVE-2026-86060) - sep 6, n-able n-central, [cve-2026-86218](https://www.cve.org/CVERecord?id=CVE-2026-86218) - sep 7, adobe commerce and magento, [cve-2026-75650](https://www.cve.org/CVERecord?id=CVE-2026-75650) - sep 8, microsoft windows, [cve-2026-81963](https://www.cve.org/CVERecord?id=CVE-2026-81963) - sep 8, connectwise screenconnect, [cve-2026-84869](https://www.cve.org/CVERecord?id=CVE-2026-84869) - sep 8, microsoft windows, [cve-2026-85880](https://www.cve.org/CVERecord?id=CVE-2026-85880) - sep 9, check point multiple products, [cve-2026-85102](https://www.cve.org/CVERecord?id=CVE-2026-85102) - sep 9, google chromium v8, [cve-2026-87491](https://www.cve.org/CVERecord?id=CVE-2026-87491) - sep 12, gitlab community edition and enterprise edition, [cve-2026-85706](https://www.cve.org/CVERecord?id=CVE-2026-85706) - sep 14, cisco secure email gateway, [cve-2026-76461](https://www.cve.org/CVERecord?id=CVE-2026-76461) - sep 15, google pixel, [cve-2026-58704](https://www.cve.org/CVERecord?id=CVE-2026-58704) - sep 16, cisco identity services engine, [cve-2026-76460](https://www.cve.org/CVERecord?id=CVE-2026-76460) - sep 17, acronis backup, [cve-2026-87886](https://www.cve.org/CVERecord?id=CVE-2026-87886) - sep 22, wordpress core, [cve-2026-87902](https://www.cve.org/CVERecord?id=CVE-2026-87902) - sep 22, check point multiple products, [cve-2026-93616](https://www.cve.org/CVERecord?id=CVE-2026-93616) - sep 22, arista velocloud orchestrator, [cve-2026-93952](https://www.cve.org/CVERecord?id=CVE-2026-93952) - sep 22, f5 big-ip apm, [cve-2026-94127](https://www.cve.org/CVERecord?id=CVE-2026-94127) - sep 23, plex media server, [cve-2026-96652](https://www.cve.org/CVERecord?id=CVE-2026-96652) - sep 23, plex media server, [cve-2026-96654](https://www.cve.org/CVERecord?id=CVE-2026-96654) - sep 23, plex media server, [cve-2026-96655](https://www.cve.org/CVERecord?id=CVE-2026-96655) - sep 23, plex media server, [cve-2026-96656](https://www.cve.org/CVERecord?id=CVE-2026-96656) - sep 27, citrix netscaler, [cve-2026-88771](https://www.cve.org/CVERecord?id=CVE-2026-88771) - sep 27, citrix netscaler, [cve-2026-88772](https://www.cve.org/CVERecord?id=CVE-2026-88772) - sep 28, apple multiple products, [cve-2026-86950](https://www.cve.org/CVERecord?id=CVE-2026-86950) - sep 30, zammad gmbh zammad, [cve-2026-102489](https://www.cve.org/CVERecord?id=CVE-2026-102489) - sep 30, zammad gmbh zammad, [cve-2026-102490](https://www.cve.org/CVERecord?id=CVE-2026-102490) - sep 30, cisco catalyst sd-wan manager, [cve-2026-76504](https://www.cve.org/CVERecord?id=CVE-2026-76504) cisa keeps adding older cves when attacks come to light, so this list can still grow. ## how to read it each poster is four layers. here they are pulled apart, the days at the bottom and the painting on top. - 01 days: one line per day: dim up to the 2025 average for that weekday, bright beyond it - 02 brush: one sweep a day, longer past the 2025 weekday average - 03 marks: extra passes on the busiest days, sep 14 to 17 fold into one - 04 painting: the finished sheet, 14,934 cves in september 2026 ## this poster | fact | value | | --- | --- | | period | september 1 to 30, 2026 | | cves | 14,934 | | data | cve list v5, cisa kev, drawn 2026-10-24 | | format | 3:4, drawn for 45 × 60 cm | [download jpg, 2000 × 2667](https://media.cvegen.art/posters/2026-09/2000.jpg?v=60337f4b03) ## other months - before: [august 2026](https://cvegen.art/2026/08.md), 12,260 cves - after: [october 2026](https://cvegen.art/2026/10.md), 13,601 so far - [all months](https://cvegen.art/index.md)