Critical Vulnerabilities and Active Exploitation, Sep 2026

Active threats and campaigns

Ransomware and extortion

September reporting identified only one case in which ransomware or extortion was the primary focus, but the source did not specify whether it involved asset encryption, data exfiltration without encryption, or only a mention on a leak site. That lack of detail prevents a more precise classification and means the case should be treated as an incomplete signal, not as a broader monthly pattern.

Operationally, that matters because a single ransomware label can mask very different impacts. Losing system availability is not the same as facing data extortion without encryption. Since the corpus does not separate those scenarios, this month’s analysis focuses on exploited vulnerabilities rather than on a true ransomware wave.

Fraud and phishing

The corpus recorded 9 documented fraud or phishing cases, down from 30 the previous month. The drop does not mean the problem disappeared, but it does confirm that in September the center of gravity shifted toward technical exploitation of vulnerabilities and campaigns against critical infrastructure. The most visible case was CTIR Gov Recommendation 17/2026 on SEO poisoning in .gov.br sites.

That campaign deserves attention because it went beyond classic phishing. The material describes cloaking against search engine bots, injected links to illegal gambling and casino sites, and the need to reset database, API, certificate, and administrative panel credentials. In other words, fraud overlapped with intrusion and manipulation of government websites.

APT, persistent intrusion, and infrastructure abuse

The material did not identify any case as a classic APT with solid attribution to a persistent group, but it did include campaigns with persistence, infrastructure abuse, and covert control. MikroTrick on MikroTik, SEO poisoning in .gov.br, and abuse of remote access tools such as ScreenConnect fit this broader category of campaigns that prioritize attacker continuity.

There is also an infrastructure vector that is difficult to neutralize, such as KREMLIN’s command-and-control infrastructure update through Ethereum smart contracts. The material itself makes clear that KREMLIN has no CVE and no KEV entry, so it should not be confused with an exploited vulnerability. Even so, it is a signal of campaigns designed for operational resilience and evasion of blocking.

Critical vulnerabilities

The table below consolidates the CVEs and the exploitation or prioritization status cited in the material reviewed. It excludes cases without an exact identifier, although those are mentioned in prose in earlier sections.

The universe of critical CVEs was not limited to these identifiers. The material also mentions flaws in Cisco Identity Services Engine, Cisco Secure Email Gateway, NGINX, 7-Zip and WSO2, but without a uniform list of active exploitation comparable to the main block above. For that reason, this table prioritizes only the cases where the link to exploitation, KEV or an official alert is explicitly supported.

Regulation and compliance

September did not show formal regulatory moves in the strict sense of the metric, but it did bring intense institutional response activity. CTIR Gov and CISC issued alerts and bulletins, ECUCERT published a specific alert, and INCIBE-CERT released notices on GitLab and other applications. In practice, the month looked more like an accelerated operational compliance cycle than a change in regulation.

In Brazil, the response included alerts, bulletins, and technical recommendations that drilled down into specific remediation steps. Recomendação 17/2026 called for deindexing routes, redefining credentials, and reporting anomalous activity. The alerts on Adobe Commerce, Fortinet, SonicWall, and Cisco Identity Services Engine point to the same logic: prioritize remediation, review exposure, and, in some cases, treat the incident as a potential compromise.

These kinds of documents do not create a new legal rule, but they do function as a de facto standard for state teams and vendors that work with government. In Latin America, where national response bodies often guide multiple sectors, these notices carry practical weight similar to a compliance circular, even if they remain technical in nature.

Most affected countries in Latin America

Brazil

Brazil accounted for the largest amount of verifiable signal this month. CTIR Gov issued alerts on SonicWall SMA1000, Adobe Commerce and Magento, Fortinet, Cisco Identity Services Engine, and GitLab, along with a recommendation on SEO poisoning in .gov.br sites. CISC also published bulletins on vulnerabilities in Microsoft, Fortinet, Commvault, Check Point, NGINX, and 7-Zip.

The Brazilian picture has two layers. The first is technical prioritization, because much of the material is focused on patching and KEV catalogs. The second is exposed surface, because several issues involve cloud services, automated repositories, remote administration, and public government sites. The result is a high-risk signal for public agencies, vendors, and companies with hybrid infrastructure.

Ecuador

Ecuador issued a specific and operationally valuable alert on MikroTik RouterOS being actively exploited. ECUCERT not only named the CVEs, it framed the issue as active exploitation, which means exposed routers must be treated as assets that may already be compromised, not simply as devices to update when possible.

This is especially relevant for connectivity providers, SMEs, and edge networks. In environments where MikroTik serves as a router, firewall, or access concentrator, active exploitation can enable persistence, traffic redirection, or movement into internal segments. The Ecuadorian alert aligns with the broader international technical ecosystem and reinforces the urgency of review.

Mexico

Mexico appears in the material mainly through web applications, cloud, and service exposure. Ciberseguridad LATAM coverage notes that in Brazil and Mexico, sectors such as digital payments and digital health operate applications integrated with AWS, Azure, and Google Cloud, with GitHub or GitLab repositories configured for automatic deployment without manual review. That is not a specific Mexican incident, but it is a useful frame for reading local risk.

For this report, Mexico also appears through references to companies and services in the regional market where attack surface depends on automated integrations and repositories connected to production. The available material does not allow for a claim of incident concentration in the country, but it does suggest exposure comparable to other regional markets that rely on DevOps and cloud.

Colombia

Colombia enters the corpus mainly through uncategorized items and incident cases in digital services, although the material analyzed does not provide a critical vulnerability case there with the same density as in Brazil or Ecuador. The lack of strong signal should not be read as absence of risk, but as a limit of the available corpus for the month.

The ICETEX case, although outside this thematic vertical because it was a provider security incident, reinforces the region's dependence on third parties and external services. In a critical vulnerability reading, that matters because many exploitations end up affecting organizations that do not directly control the compromised infrastructure.

Paraguay

Paraguay appears mainly through CERT.PY activity and the regional bulletin context. The material provided includes advisories on MISP and WordPress plugins, but without confirmed dates, so they are not included in the month’s indicators. Even so, they show institutional interest in common attack surfaces that are often relevant for mid-sized organizations.

In the regional comparison, Paraguay does not concentrate verifiable incidents at the same scale as Brazil or Ecuador. That does not reduce the value of its advisories, but it does limit the ability to build a narrative of active exploitation with enough volume for this report. The signal is one of monitoring, not prevalence.

Argentina

There were not enough verifiable facts in the material to build a specific reading for Argentina within this vertical. That does not imply absence of exposure to critical vulnerabilities, only that the September corpus did not provide a case with confirmed date and scope comparable to those in Brazil or Ecuador.

Chile

There were also not enough verifiable facts for Chile in the September corpus analyzed for this topic. The available material does not support a country trend, although that does not rule out exposure to the same products and exploitation chains seen in other regional markets.

Peru

There were not enough verifiable facts for Peru in the period analyzed. The report does not attribute that absence to lower real risk, only to the specific coverage in the material received.

Bolivia

There were no sufficient verifiable facts for Bolivia in the September material. The regional signal that does appear, especially in perimeter appliances and administration software, is equally relevant for Bolivian environments, but it cannot be documented here with a concrete local case.

United States

Although it is not part of Latin America, the United States appears as a background reference in nearly every prioritization process through CISA KEV. Remediation deadlines for U.S. federal agencies, such as September 14 or 27, helped define urgency for regional vendors and CERTs. In this report, it is used only as a comparative frame for active exploitation and remediation.

Trends and signals to watch

Compared with the previous month, the total volume fell sharply, from 344 to 177 verified incidents, and the number of critical CVEs mentioned dropped from 83 to 43. Even so, the operational signal did not ease by the same margin, because vulnerabilities remained the main threat and multiple cases were confirmed as actively exploited by several sources.

August brought a higher volume and multiple high-impact infrastructure cases. September had less noise, but the signal was more focused on urgent remediation and prioritizing exposed assets. That often happens when the ecosystem shifts from a cycle of broad disclosure to one of confirmed exploitation and institutional response.

The first signal to watch is the persistence of multi-CVE chains in perimeter devices. SonicWall SMA1000 and MikroTik RouterOS show that attackers are still looking for combinations of bypass, SSRF, command injection, and privilege escalation. When those flaws are combined, an attacker does not need a more sophisticated vector to move from initial access to device control.

The second signal is the pressure on development and deployment platforms. GitLab made clear that self-managed environments remain a high-value target because they bring together secrets, pipelines, service credentials, and automation. In the region, where many companies and public agencies use GitLab as a delivery backbone, that means reviewing not only versions but also exposure, permissions, and the traceability of imports or CI/CD.

The third signal is that regional advisories are no longer limited to on-prem software. Fortinet, Commvault Cloud, FortiSandbox Cloud, Microsoft, and other examples show a shift toward cloud and hybrid services. That requires Latin American teams to pair local remediation with control over identity, credentials, pipelines, and sessions. If only the appliance is reviewed, part of the risk is missed.

Security team recommendations

First, prioritize patches and compromise review for assets that appeared in KEV or in official alerts during the month. That includes SonicWall SMA1000, GitLab self-managed, ConnectWise ScreenScreenConnect, Adobe Commerce and Magento, MikroTik RouterOS, and the Fortinet products mentioned in official advisories. In these cases, applying the update is not enough, because several sources called for account, agent, session, and forensic trace review.

Second, review direct internet exposure for administration tools, repositories, and support portals. If GitLab, ScreenConnect, remote access appliances, or management interfaces are exposed, priority should rise immediately. The risk is not only the vulnerability itself, but also the combination of public accessibility, reused credentials, and automated deployment or support workflows.

Third, strengthen monitoring of credentials and secrets. The GitLab exploitation, SEO poisoning in .gov.br, and abuse of remote tools show that an intrusion can end in theft of tokens, API keys, certificates, and administrative panel passwords. Rotating credentials without reviewing the scope of exposure can leave active persistence in place.

Fourth, add post-patch compromise hunting. In SonicWall, ConnectWise, and Fortinet, the material stresses that patching does not automatically close the incident. Logs, configuration changes, active sessions, hidden accounts, access rules, and persistence artifacts need to be reviewed. That matters especially for edge devices and remote support platforms.

Fifth, treat network and security appliances as highly critical operational assets. MikroTik and SonicWall show that the network edge remains a primary target, and that a compromised router or gateway can have a broader impact than an isolated workstation. The response plan should include secure rebooting, restoration from a known-good configuration, and integrity validation.

Sixth, align regional prioritization with official CERT and CSIRT advisories. In Latin America, CTIR Gov, CISC, and ECUCERT acted as amplifiers of urgency and local context. When those organizations issue alerts about a CVE, the organization should translate that into an internal action with an owner, a deadline, and closure evidence. Otherwise, the alert remains informational reading rather than a control.

Frequently Asked Questions

Which countries had the strongest signal this month, and why?

Brazil and Ecuador had the clearest signal. Brazil concentrated official alerts on SonicWall, Adobe, Fortinet, GitLab, and active campaigns against .gov.br sites. Ecuador, meanwhile, issued a specific alert on MikroTik RouterOS that was actively exploited. Coverage for the rest of the countries was more scattered or lacked a confirmed date.

What was the difference between the Brazil and Ecuador material?

Brazil combined bulletins, recommendations, and active campaigns involving several vendors, along with alerts on SEO poisoning and cloud. Ecuador had a more focused but very clear case involving MikroTik RouterOS with confirmed active exploitation. The difference was breadth in Brazil and operational precision in Ecuador.

What changed between August and September in critical vulnerabilities?

The total volume of verified incidents fell, and so did the number of critical CVEs mentioned. Even so, the main threat remained vulnerabilities, and several cases were still confirmed as actively exploited. August had more noise, while September had less volume but a sharper focus on remediation and prioritization.

Which products should Latin American teams review first?

They should first review SonicWall SMA1000, GitLab self-managed, ConnectWise ScreenConnect, Adobe Commerce and Magento, Fortinet, MikroTik RouterOS, and, where applicable, Cisco Identity Services Engine. The priority comes from the combination of active exploitation, presence in KEV, and broad use across regional infrastructure.

Did the report record ransomware as the main trend?

No. Only one case appeared with ransomware or extortion as the primary focus, but the material did not specify whether there was encryption, exfiltration without encryption, or only a mention on a leak site. The month’s main trend was clearly vulnerabilities, not extortion. The threats and active campaigns section covers it in more detail.

Which official alerts should government teams read first?

In Brazil, the CTIR Gov alerts on SonicWall, Adobe Commerce, Fortinet, GitLab, and Recomendação 17/2026 on SEO poisoning. In Ecuador, the ECUCERT alert on MikroTik RouterOS. Those documents combine active exploitation, operational impact, and concrete mitigation steps.

Material limitations

This report was built exclusively from the material provided for September 2026 and from the comparative framework for prior months included in the file. There was no access to the internet or to sources outside the authorized list. As a result, several technical references are limited to what each source described, rather than to any additional independent verification.

The time window for the indicators was based on 178 dated facts from September 2026, 13 facts from prior months used only as comparative context, and 2 undated facts excluded from the indicators. The undated facts, such as CERT.gov.py notices about MISP and WordPress plugins, may be used as qualitative context, but they are not part of the monthly volume.

A zero indicator means it did not appear in the September material analyzed, not that the phenomenon did not occur in the region. This applies in particular to regulatory developments and the breakdown of some categories. It also applies to CVEs, if the material does not record a given case, that does not rule out the possibility that it existed outside the available corpus.

Aggregated telemetry was handled separately and was not added to incidents. In this report, it is mentioned only as a point of reference when the source makes clear that they are attempted or automated blocks, not confirmed intrusions. Sponsored content, consumer social media, and posts outside the list of available sources were also not used as evidence of trend.

Countries without enough verifiable facts, or with insufficient material to support a local reading, were left out of volume statements. That does not mean there was no risk, only a documentation coverage limitation for the period.