Top RCE Vulnerabilities

A remote code execution (RCE) vulnerability is a software flaw that lets an attacker run their own code on a target system from a remote location. Exploiting vulnerabilities like this is now the most common way attackers get in: it was the initial access vector in 31% of breaches in Verizon’s 2026 Data Breach Investigations Report (DBIR), up from 20% the year before, and the median time to fully patch rose from 32 to 43 days.

This page ranks the top RCE vulnerabilities defenders should be tracking right now. Each remote code execution vulnerability below includes its severity scoring, exploitation status, and whether an RCE exploit is public.

Key Takeaways

• Exploitation Is the Norm: Nine of the 10 vulnerabilities below are in the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog.
• Zero-Days Lead the List: Five entries involve flaws that attackers exploited before a fix existed.
• Security Appliances Are Prime Targets: Five of the 10 entries are gateways, email security appliances, or access proxies from Citrix, Cisco, F5, Check Point, and Fortinet.
• Public Exploits Shrink the Window: Splunk’s flaw reached the KEV catalog eight days after disclosure, six days after a public proof-of-concept (PoC) appeared, and WordPress sites were attacked on the day the fix shipped.
• CVSS Needs Context: A CVSS 10.0 Microsoft Entra ID flaw required no customer action, while a 9.2 WordPress flaw was under attack on the day it was fixed.

RCE CVE List at a Glance

Flaws already profiled as incidents in SOCRadar’s roundup of RCE attacks, including some Ivanti, BeyondTrust, and Langflow cases, are not repeated here.

How We Ranked These RCE Vulnerabilities

Entries are ordered by the risk they pose to organizations that have not yet acted, using four factors:

• Confirmed Exploitation: Zero-day exploitation and KEV listings rank above flaws with no confirmed attacks.
• Reachability: Unauthenticated flaws on internet-facing systems rank above flaws that need credentials or local access.
• Default Exposure: Flaws that work in a default configuration rank above flaws that need an optional feature.
• Exploit Availability: Public PoC code raises a flaw’s position, and CVSS breaks ties.

Exploiting these flaws on exposed systems maps to the MITRE ATT&CK technique Exploit Public-Facing Application (T1190).

The 10 Top RCE Vulnerabilities, Ranked

1. Citrix NetScaler RCE Zero-Days (CVE-2026-88771, CVE-2026-88772)

Citrix disclosed eight NetScaler vulnerabilities on September 27, 2026, and two of them are remote code execution zero-days that attackers were already using against customer-managed NetScaler ADC and Gateway appliances: CVE-2026-88771 and CVE-2026-88772 (both 9.5 CVSS v4.0).

CVE-2026-88771 is an improper input validation flaw that lets an unauthenticated attacker run arbitrary commands in a default configuration, with no optional feature required. CVE-2026-88772 is a memory overflow in Datagram Transport Layer Security (DTLS) handling that leads to code execution or denial of service, and Citrix says DTLS is enabled by default on VPN virtual servers.

Exploit Status: Exploitation attempts against CVE-2026-88771 were reported on September 24, 2026, three days before disclosure, while exploitation of CVE-2026-88772 likely began in early September. CISA added both to KEV on September 27 with a three-day deadline. Citrix later disclosed a third zero-day, CVE-2026-88779 (8.7 CVSS v4.0), affecting SAML-enabled appliances.

2. Cisco Secure Email Gateway RCE (CVE-2026-76461)

Cisco disclosed CVE-2026-76461 (9.8 CVSS) on September 14, 2026, a SQL injection flaw in the email parsing logic of Cisco AsyncOS Software for Cisco Secure Email Gateway. An unauthenticated attacker only has to send a crafted email message through an affected appliance to run arbitrary commands with root privileges, and Cisco says physical and virtual gateways are affected regardless of configuration.

Exploit Status: Cisco confirmed exploitation in September 2026, before the fix shipped, and CISA added the flaw to KEV the same day with a three-day deadline. Cisco upgraded Secure Email Cloud devices itself and published detection guidance, and no public exploit code had been reported as of September 15, 2026.

3. F5 BIG-IP APM RCE (CVE-2026-94127)

F5 disclosed CVE-2026-94127 (9.8 CVSS v3.1, 9.3 CVSS v4.0) on September 22, 2026, a heap-based buffer overflow in BIG-IP APM that lets an unauthenticated attacker execute code with specially crafted traffic. The flaw exists only when an APM access policy and an OAuth profile are attached to a virtual server and APM acts as an OAuth Authorization Server, and appliance mode is also vulnerable. F5 found the flaw internally.

Exploit Status: F5 confirmed exploitation in its advisory, and CISA added the flaw to KEV the same day with a three-day deadline. More than 14,700 internet addresses showed BIG-IP APM fingerprints on September 23, 2026, although that count does not show how many are vulnerable. F5’s indicators of compromise are behavioral, and no confirmed public exploit had been identified at publication.

4. Check Point RCE Flaws (CVE-2026-85102, CVE-2026-93616)

Check Point disclosed two critical flaws in a security advisory on September 22, 2026. CVE-2026-85102 (9.8 CVSS) is an improper certificate validation bug in VPN negotiation that lets an unauthenticated attacker run code on Security Gateway and Spark Firewall appliances that use Site-to-Site or Remote Access VPN. CVE-2026-93616 (9.8 CVSS) is a pre-authentication path traversal in the Security Management web service that lets an attacker execute a script from an arbitrary path and load an arbitrary Java class.

Exploit Status: The fix for CVE-2026-85102 shipped on September 9, 2026, and exploitation attempts against Spark customers began three days later. CVE-2026-93616 was a zero-day, with targeted attacks observed on July 23, 2026, about two months before its fix arrived. CISA added both flaws to KEV on September 22, 2026 with a three-day deadline.

5. FortiMail Zero-Day RCE (CVE-2026-104286)

Fortinet disclosed CVE-2026-104286 (9.8 CVSS v3.1) on October 1, 2026, a flaw that combines path traversal with improper handling of NULL characters and lets an unauthenticated attacker write arbitrary files to a FortiMail appliance through crafted web requests. Gwendal Guégniaud of Fortinet’s Product Security team found it internally. Attackers have turned the file write into code execution by dropping a malicious shared library and modifying a system file so the library loads.

Exploit Status: Exploitation began before disclosure, and CISA added the flaw to KEV the same day with a three-day deadline. As of October 6, 2026, the fixed releases (7.4.9, 7.6.7, and 8.0.2) were still listed as upcoming, so Fortinet’s interim mitigation is to disable Identity-Based Encryption (IBE) support or block internet access to the management interface. As of October 2, 2026, no fully weaponized public exploit had been verified.

6. WordPress Core RCE (CVE-2026-87902)

WordPress released version 7.1.2 on September 22, 2026 to fix CVE-2026-87902 (9.2 CVSS v4.0), an unauthenticated path traversal in the way WordPress resolves page templates. An attacker can make the get_page_template() function include a readable local PHP file from outside the active theme directories, and under the right conditions that becomes code execution.

Those conditions include the PHP register_argc_argv setting and the PHP Extension and Application Repository (PEAR) utility pearcmd.php being present, and the official PHP Docker image and default cPanel setups with a PHP version before 8.5 are affected. The flaw has existed since WordPress 4.7.0, the fix was backported to every branch eligible for security fixes, and Robert Ressl reported it.

Exploit Status: Attacks began within hours of the release, moving from probing to writing files that run shell commands, and CISA added the flaw to KEV on September 25, 2026 with a three-day deadline. A public proof-of-concept and a scanning template are circulating.

7. Windows IKE Extension RCE (CVE-2026-33824)

Microsoft fixed CVE-2026-33824 (9.8 CVSS v3.1) on April 14, 2026, a double free in the Windows Internet Key Exchange (IKE) Service Extensions that affects all supported Windows 10, Windows 11, and Windows Server releases. An unauthenticated attacker can send crafted IKE version 2 packets to User Datagram Protocol (UDP) ports 500 and 4500 on an unpatched system and execute code over the network.

Exploit Status: Microsoft’s patch-day assessment rated exploitation less likely, yet CISA added the flaw to KEV on August 18, 2026, 126 days after the patch, with a three-day deadline. No public exploit code has been reported.

8. Splunk Enterprise RCE (CVE-2026-20253)

Splunk disclosed CVE-2026-20253 (9.8 CVSS v3.1) on June 10, 2026, a missing authentication flaw in the PostgreSQL sidecar service bundled with Splunk Enterprise. An unauthenticated attacker can create or truncate arbitrary files through the sidecar’s recovery endpoints, and overwriting a Python script that Splunk runs regularly turns that file write into code execution.

Exploit Status: A public proof-of-concept appeared on June 12, 2026, and Splunk acknowledged limited exploitation on June 18, 2026, the day CISA added the flaw to KEV. It was the first Splunk vulnerability to reach the catalog, and the vulnerable sidecar is enabled by default in affected versions.

9. Gitea Git Hook RCE (CVE-2026-60004)

Gitea released version 1.27.1 on July 27, 2026 to fix CVE-2026-60004 (9.8 CVSS), a code injection flaw in the diffpatch application programming interface (API) endpoint reported by Shai Rod. An attacker with write access to a repository submits a crafted patch twice to force a Git merge collision that writes an attacker-controlled file into the Git hooks directory, and Git then runs it as the Gitea service account. Gitea’s default open registration lets an unauthenticated visitor create an account and a repository to get that write access, and exploitation also needs Git 2.32 or later with the diffpatch route enabled.

Exploit Status: Public exploit code has circulated since early August 2026, and CISA added the flaw to KEV on August 25, 2026 with a two-day deadline, making it the first Gitea entry in the catalog. A separate attack reportedly dropped a miner-like payload.

10. Microsoft Entra ID RCE (CVE-2026-69836)

Microsoft published CVE-2026-69836 (10.0 CVSS v3.1) on August 20, 2026, a deserialization flaw in Microsoft Entra ID, the cloud identity service behind Microsoft 365 and Azure sign-ins. Microsoft gives it the maximum score because an unauthenticated attacker could execute code over the network, but it said it had already fully mitigated the flaw on its side, so customers have nothing to patch. Microsoft security engineer Robert Fitzpatrick reported it.

Exploit Status: The advisory first marked the flaw as exploited, and Microsoft corrected that field to No on August 21, 2026, saying it was not exploited in the wild. The flaw is not listed in the KEV catalog, and no exploit code is public.

Public RCE Exploits and Exploitation Timelines

An RCE exploit is the code or technique that turns a vulnerability into working access, and a public RCE exploit lets any attacker reproduce it. Public RCE exploits exist for at least three entries on this list: WordPress CVE-2026-87902, Splunk CVE-2026-20253, and Gitea CVE-2026-60004. Five more entries were exploited as zero-days with no public exploit code reported, which shows that attackers able to find an RCE vulnerability do not need a public exploit to use it.

Among the five flaws exploited after a fix existed, the gap between the fix and a KEV listing ranged from three days for WordPress to 126 days for Windows IKE. Four of the five reached the catalog within 29 days, well inside the 43-day median patch time in Verizon’s 2026 report.

Root Causes Behind These RCE Vulnerabilities

Each remote code execution vulnerability on this list falls into one of five bug classes:

• Injection and Input Validation: Citrix CVE-2026-88771 (improper input validation), Cisco CVE-2026-76461 (SQL injection), and Gitea CVE-2026-60004 (code injection through a Git hook) let attacker-controlled input reach a command or query interpreter.
• Path Traversal and File Write: FortiMail, WordPress, Check Point CVE-2026-93616, and Splunk turn an arbitrary file write or file include into code execution.
• Memory Corruption: Citrix CVE-2026-88772 (memory overflow), F5 CVE-2026-94127 (heap-based buffer overflow), and Windows IKE (double free) corrupt memory in network-facing parsers.
• Authentication and Validation Gaps: Check Point CVE-2026-85102 (improper certificate validation, Common Weakness Enumeration (CWE) 295) and Splunk (missing authentication, CWE 306) let unauthenticated traffic reach sensitive code paths.
• Deserialization: Entra ID CVE-2026-69836 (CWE 502) trusts serialized data it should not.

The Verizon 2026 report lists heap-based buffer overflow and external control of file name or path among the five most common weaknesses in KEV entries, which matches the memory corruption and path traversal entries above.

Frequently Asked Questions

Where Can I Find a Current CVE RCE List?

Start with CISA’s Known Exploited Vulnerabilities catalog for confirmed exploitation, the National Vulnerability Database for CVSS scores and weakness types, and vendor advisories for affected and fixed versions. A CVE that appears in all three with an RCE description deserves the first patch window.

Does a Public RCE Exploit Mean Attacks Have Started?

A public RCE exploit removes the main barrier for attackers, though it does not confirm active attacks by itself. Splunk CVE-2026-20253 shows the pattern: researchers published a proof-of-concept on June 12, 2026, and CISA confirmed exploitation on June 18, 2026. Check the KEV catalog for confirmation.

Which RCE Vulnerabilities Should I Patch First?

Patch internet-facing systems with confirmed exploitation first, starting with anything in the KEV catalog. Next come flaws with public exploit code, then unauthenticated flaws on exposed services, with CVSS as the tiebreaker. For a zero-day without a fix, apply the vendor’s mitigation and check the system for signs of compromise.

Do I Need to Patch RCE Vulnerabilities in Cloud Services?

Usually the provider patches the service, as Microsoft did for Entra ID CVE-2026-69836, which needed no customer action. Customer-managed software is different: Citrix’s bulletin covers only customer-managed NetScaler appliances, while Cloud Software Group updates Citrix-managed cloud services. Confirm which model each product uses.

How Do I Check Whether an RCE Vulnerability Was Already Exploited?

Treat any exposed, unpatched system as possibly compromised until checked. Preserve logs and memory evidence where practical, run the vendor’s indicators of compromise or detection guidance (Citrix, Check Point, Fortinet, and Cisco all published them), look for new files, web shells, and unexpected outbound connections, and rotate the credentials the system held.

Preventing Exploitation of RCE Vulnerabilities

Most of this list comes down to fundamentals:

• Keep a current inventory of internet-facing systems and the exact product versions they run.
• Treat any CVE added to the KEV catalog as a patch-this-week item.
• Disable optional features such as DTLS, IBE, or OAuth profiles on appliances that do not need them, because several entries above only work when one is enabled.
• For appliances exposed before a fix existed, preserve logs and check for compromise before and after patching.

How SOCRadar Can Help Track RCE Vulnerabilities

SOCRadar supports each step of tracking RCE vulnerabilities like these:

• Vulnerability Intelligence: scores each CVE with the SOCRadar Vulnerability Risk Score (SVRS), a 0 to 100 rating of how likely a flaw is to be exploited, and tracks KEV status and exploitation changes for flaws like those above.
• Attack Surface Management: discovers internet-facing assets and the technologies they run, which shows which of these products are exposed in your environment.
• Cyber Threat Intelligence: tracks the actors and tooling behind exploitation, including SOCRadar’s analysis of the NetScaler C2 framework, a suspected automated tool that fingerprints exposed NetScaler appliances and exploits CVE-2026-88771.
• Dark Web Monitoring: watches Dark Web forums and marketplaces for exploit code, PoCs, and access listings tied to these CVEs.

Conclusion

Three patterns stand out from this list, and each changes how we would prioritize.

Security Products Are the Entry Point: Five of the 10 entries come from Citrix, Cisco, F5, Check Point, and Fortinet, products that sit between the internet and everything behind them, and each involves flaws exploited before a fix existed. Citrix alone disclosed three exploited NetScaler zero-days in about a week. When the perimeter product is the target, patching is only half the job: teams also need to confirm whether the appliance was compromised before the fix arrived.

Attackers Outrun Patch Cycles: Four of the five flaws exploited after a fix existed reached the KEV catalog within 29 days, while Verizon’s 2026 report puts the median time to fully patch at 43 days. The clock starts at disclosure, so a quarterly maintenance cycle is too slow for this class of flaw.

Severity Scores and Vendor Ratings Predict Poorly: Microsoft’s CVSS 10.0 Entra ID flaw required no action, a CVSS 9.2 WordPress flaw was attacked within hours, and the Windows IKE flaw carried a lower patch-day exploitability rating yet entered KEV 126 days later. Exploitation evidence and exposure should lead the queue, with CVSS as a tiebreaker.

In practice, that means knowing which of these products you expose, watching KEV status and exploit availability for each, and treating any appliance that was reachable before a fix as a candidate for compromise assessment.