# Ten actively exploited CVEs land before September's Patch Tuesday

> Ten actively exploited CVEs in September 2026, led by a SharePoint auth bypass and RCE chain, plus two CVSS 10 flaws in HPE Fabric Composer.

- Published: 2026-09-05
- Topic: [Security](https://futuretechnologyhq.com/topic/security/)
- URL: https://futuretechnologyhq.com/article/actively-exploited-cve-september-2026/
- Publisher: [Future Technology](https://futuretechnologyhq.com/), free to read. Quote as "Future Technology" with a link to the article.

## Key points

- Ten vulnerabilities are under confirmed active exploitation in the first week of September
- CVE-2026-55040 and CVE-2026-63520 chain on SharePoint for auth bypass then remote code execution
- HPE disclosed two CVSS 10 flaws in Fabric Composer and a 9.8 in AOS-CX switches
- Patch Tuesday falls on 8 September, so this queue lands on top of whatever Microsoft ships

## Article

Ten vulnerabilities are under confirmed active exploitation in the first week of September, and Patch Tuesday has not happened yet.

The pair leading the week is CVE-2026-55040 and CVE-2026-63520, chained against SharePoint servers. Authentication bypass first, remote code execution second. Chained together they take an unauthenticated attacker to code execution on an internet-facing document store, which is close to the worst shape a bug can take.

## The actively exploited CVE list for September 2026

Alongside the SharePoint chain sit SonicWall SMA1000, JFrog Artifactory, PaperCut MF and NG, Kestra, LiteLLM, NetScaler ADC and Gateway, and the Linux kernel. Hewlett Packard Enterprise separately disclosed two maximum-severity flaws in Fabric Composer, CVE-2026-76657 and CVE-2026-76658, both rated CVSS 10, plus a 9.8 in AOS-CX network switches.

## The pattern behind the list

Network appliances, publishing platforms and container orchestration account for most of the activity, which is the same shape we flagged with SonicWall earlier in the week. Anything that faces the internet by design gets hunted continuously, and the infrastructure layer underneath keeps producing the worst cases, as [the KVM hypervisor escape](/article/kvm-januscape-hypervisor-vm-escape/) did last month.

The newer entry is AI infrastructure. LiteLLM has appeared twice in a fortnight, which tells you the gateway and proxy layers sitting in front of models are now treated as ordinary attack surface. It rhymes with [agents getting loose during testing](/article/openai-agents-escaped-testing-hacked-hugging-face/): the model is rarely the weak part, the plumbing around it is.

## What to patch before Monday

Patch Tuesday falls on 8 September. In practical order: the SharePoint chain first if you run it on-premises, then the edge devices, then Artifactory and PaperCut, then the kernel. Anything on the HPE Fabric Composer or AOS-CX list is a same-day job given the CVSS 10 rating.

The scheduling is the real problem here. A queue this size arriving the week before a fixed patch cycle is what pushes small teams behind, in the same way [Oracle's 943 patches in August](/article/oracle-943-security-patches-august-2026/) did. When the list is longer than the week, sequencing beats completeness.

## Key takeaways

- Ten vulnerabilities are under confirmed active exploitation in the first week of September.
- CVE-2026-55040 and CVE-2026-63520 are being exploited against SharePoint servers.
- The SharePoint chain allows an unauthenticated attacker to execute code on an internet-facing document store.
- Other actively exploited vulnerabilities include SonicWall SMA1000, JFrog Artifactory, and the Linux kernel.
- Hewlett Packard Enterprise has disclosed two maximum-severity flaws in Fabric Composer.
- Patch Tuesday falls on 8 September, and prioritisation is needed due to the large number of vulnerabilities.

## Sources

- [September 2026 Patch Tuesday forecast](https://www.helpnetsecurity.com/2026/09/04/september-2026-patch-tuesday-forecast/)
- [3 September 2026 archive](https://cvebrief.com/archive/2026/09/03/)
- [Critical Gitea RCE actively exploited](https://thehackernews.com/2026/08/critical-gitea-rce-actively-exploited.html)