Future TechnologyTen Actively Exploited CVEs Land Before September's Patch Tuesday
Key takeaways
- Ten vulnerabilities are under confirmed active exploitation in the first week of September
- CVE-2026-55040 and CVE-2026-63520 chain on SharePoint for auth bypass then remote code execution
- HPE disclosed two CVSS 10 flaws in Fabric Composer and a 9.8 in AOS-CX switches
- Patch Tuesday falls on 8 September, so this queue lands on top of whatever Microsoft ships
Ten vulnerabilities are under confirmed active exploitation in the first week of September, and Patch Tuesday has not happened yet.
The pair leading the week is CVE-2026-55040 and CVE-2026-63520, chained against SharePoint servers. Authentication bypass first, remote code execution second. Chained together they take an unauthenticated attacker to code execution on an internet-facing document store, which is close to the worst shape a bug can take.
The actively exploited CVE list for September 2026
Alongside the SharePoint chain sit SonicWall SMA1000, JFrog Artifactory, PaperCut MF and NG, Kestra, LiteLLM, NetScaler ADC and Gateway, and the Linux kernel. Hewlett Packard Enterprise separately disclosed two maximum-severity flaws in Fabric Composer, CVE-2026-76657 and CVE-2026-76658, both rated CVSS 10, plus a 9.8 in AOS-CX network switches.
The pattern behind the list
Network appliances, publishing platforms and container orchestration account for most of the activity, which is the same shape we flagged with SonicWall earlier in the week. Anything that faces the internet by design gets hunted continuously, and the infrastructure layer underneath keeps producing the worst cases, as the KVM hypervisor escape did last month.
The newer entry is AI infrastructure. LiteLLM has appeared twice in a fortnight, which tells you the gateway and proxy layers sitting in front of models are now treated as ordinary attack surface. It rhymes with agents getting loose during testing: the model is rarely the weak part, the plumbing around it is.
What to patch before Monday
Patch Tuesday falls on 8 September. In practical order: the SharePoint chain first if you run it on-premises, then the edge devices, then Artifactory and PaperCut, then the kernel. Anything on the HPE Fabric Composer or AOS-CX list is a same-day job given the CVSS 10 rating.
The scheduling is the real problem here. A queue this size arriving the week before a fixed patch cycle is what pushes small teams behind, in the same way Oracle's 943 patches in August did. When the list is longer than the week, sequencing beats completeness.
