Bastion Codex – Weekly Defender Brief (2026-09-15)

This weekly defender brief summarizes vulnerability movement observed over the past 7 and 30 days.

The goal is simple: highlight signal that matters to frontline defenders — patch workload pressure, severity shifts, and KEV movement.

Bastion Codex – Weekly Defender Brief

Week of 2026-09-15

Executive Snapshot

  • 4314 CVEs observed in the last 7 days
  • 343 Critical
  • 1773 High
  • 14 KEV-listed vulnerabilities in last 30 days

Week-over-Week Movement

  • Total CVEs: 2127 (from 2187 to 4314, 97.3%)
  • Critical: 158 (from 185 to 343, 85.4%)
  • High: 1128 (from 645 to 1773, 174.9%)
  • Medium: 607 (from 764 to 1371, 79.5%)
  • Low: 92 (from 84 to 176, 109.5%)
  • Unknown: 142 (from 509 to 651, 27.9%)

Defender Takeaways

  • Elevated volume of Critical vulnerabilities this week. Prioritize external-facing asset review.
  • Recently added KEV vulnerabilities detected. Review CISA remediation timelines.
  • High severity volume suggests increased patch workload. Focus on internet-exposed services first.

Severity Breakdown (7 Days)

  • Critical: 343
  • High: 1773
  • Medium: 1371
  • Low: 176
  • Unknown: 651

Top Vendors (30 Days)

  • Google: 2
  • Microsoft: 2
  • MikroTik: 2
  • PaperCut: 2
  • Adobe: 1
  • Cisco: 1
  • Citrix: 1
  • ConnectWise: 1
  • GitLab: 1
  • N-able: 1

Top Products (30 Days)

  • Chromium V8: 2
  • NG/MF: 2
  • RouterOS: 2
  • Windows: 2
  • Commerce and Magento: 1
  • Community Edition and Enterprise Edition: 1
  • N-central: 1
  • NetScaler: 1
  • ScreenConnect: 1
  • Secure Email Gateway: 1

Priority Watchlist (Top 10)

  • CVE-2026-20079 | CVSS: 10.0 | KEV: True | A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attack
  • CVE-2026-75650 | CVSS: 10.0 | KEV: True | Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in ar
  • CVE-2026-85706 | CVSS: 10.0 | KEV: True | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 th
  • CVE-2026-84869 | CVSS: 9.9 | KEV: True | A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorizatio
  • CVE-2016-4117 | CVSS: 9.8 | KEV: True | Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wil
  • CVE-2022-41352 | CVSS: 9.8 | KEV: True | An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio looph
  • CVE-2025-14733 | CVSS: 9.8 | KEV: True | An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbit
  • CVE-2025-67038 | CVSS: 9.8 | KEV: True | An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user’s authenticatio
  • CVE-2026-65400 | CVSS: 9.8 | KEV: True | An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, mac
  • CVE-2026-19490 | CVSS: 9.8 | KEV: True | Vulnerability in NetScaler ADC and NetScaler Gateway.

This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway:

Generated via Bastion Codex pipeline at 2026-09-15T01:57:20.094622+00:00