Bastion Codex – Weekly Defender Brief (2026-09-02)

This weekly defender brief summarizes vulnerability movement observed over the past 7 and 30 days.

The goal is simple: highlight signal that matters to frontline defenders — patch workload pressure, severity shifts, and KEV movement.

Bastion Codex – Weekly Defender Brief

Week of 2026-09-02

Executive Snapshot

  • 2533 CVEs observed in the last 7 days
  • 273 Critical
  • 775 High
  • 4 KEV-listed vulnerabilities in last 30 days

Week-over-Week Movement

  • Total CVEs: -951 (from 3484 to 2533, -27.3%)
  • Critical: -172 (from 445 to 273, -38.7%)
  • High: -584 (from 1359 to 775, -43.0%)
  • Medium: -190 (from 885 to 695, -21.5%)
  • Low: 0 (from 102 to 102, 0.0%)
  • Unknown: -5 (from 693 to 688, -0.7%)

Defender Takeaways

  • Elevated volume of Critical vulnerabilities this week. Prioritize external-facing asset review.
  • Recently added KEV vulnerabilities detected. Review CISA remediation timelines.
  • High severity volume suggests increased patch workload. Focus on internet-exposed services first.

Severity Breakdown (7 Days)

  • Critical: 273
  • High: 775
  • Medium: 695
  • Low: 102
  • Unknown: 688

Top Vendors (30 Days)

  • PaperCut: 2
  • Gitea: 1
  • JFrog: 1

Top Products (30 Days)

  • NG/MF: 2
  • Artifactory: 1
  • Gitea: 1

Priority Watchlist (Top 10)

  • CVE-2026-21962 | CVSS: 10.0 | KEV: True | Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Serve
  • CVE-2026-48282 | CVSS: 10.0 | KEV: True | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory (‘Path Traver
  • CVE-2016-8735 | CVSS: 9.8 | KEV: True | Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before
  • CVE-2018-1273 | CVSS: 9.8 | KEV: True | Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerabilit
  • CVE-2019-2725 | CVSS: 9.8 | KEV: True | Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are
  • CVE-2020-1938 | CVSS: 9.8 | KEV: True | When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connec
  • CVE-2023-49105 | CVSS: 9.8 | KEV: True | An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication
  • CVE-2026-8452 | CVSS: 9.8 | KEV: True | Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if th
  • CVE-2026-60004 | CVSS: 9.8 | KEV: True | Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
  • CVE-2026-81578 | CVSS: 9.8 | KEV: True | An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, u

Generated via Bastion Codex pipeline at 2026-09-02T14:51:18.375207+00:00