Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026
2026-10-16T20:51:31Z•92df13b0003ba893553f505ba2c6e752af858e6f082a730fadd6a627c057f76c
CVE-2024-47575CVE-2026-88771CVE-2026-88772AMOSAWS-IAMFortiGateFortiManagerIran-nexusKubernetesLinuxNetScalerPEERSTITCHRBACSPIFFESPIREcloud-securitycredential-theftcritical-infrastructureedge-devicesespionageexploitationgovernment-targetinginitial-accessmacOSphishingsupply-chainweb-shellszero-day
What happened
Unit 42 reporting from September–October 2026 highlights active exploitation of internet-facing infrastructure, including FortiGate/FortiManager vulnerability CVE-2024-47575 and NetScaler zero-days CVE-2026-88771 and CVE-2026-88772. Additional coverage describes espionage campaigns targeting government Linux systems and Iraqi critical infrastructure, phishing and credential abuse, cloud and Kubernetes identity risks, supply-chain attacks, and macOS information stealers.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- paloalto_unit42
- Record identifier
- 92df13b0003ba893553f505ba2c6e752af858e6f082a730fadd6a627c057f76c
- Enrichment time
- 2026-10-16T20:51:31Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.