INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Vulnerabilities Remain Top Entry Point for Cyber Attacks

| 2026-09-25 12:44 CRITICAL MEDIUM RANSOMWARE & EXTORTION EXPLOITED VULNERABILITY
JSON
Executive Summary
AI-generated
A recent Verizon study found that vulnerability exploitation became the most common initial access vector, appearing in 31% of breaches. Credential abuse accounted for 13%, while ransomware appeared in 48% of breaches, up from 44% the previous year. The Access Route Got Older, Not Smarter Much of the current security discussion centres on AI-related threats , but Verizon’s data shows that known and unpatched vulnerabilities remain a common entry point. These flaws are documented, catalogued and often left unresolved for weeks.
Technical Mitigations AI-generated
• Apply the vendor fix for CVE-2024-37079, CVE-2020-0796 and treat internet-facing systems that were not patched in time as potentially compromised until verified. • Audit (ATT&CK mitigation for Phishing): Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2024-37079CVE-2024-37079 CVE-2020-0796CVE-2020-0796 CVE-2026-22719CVE-2026-22719 CVE-2025-22225CVE-2025-22225 CVE-2026-59310CVE-2026-59310 CVE-2025-60710CVE-2025-60710
Target & Sectors
CN
governmentgovernment
Incident Timeline
‎February 2026
More than 270,000 systems remained exposed to CVE-2020-0796 as of February 2026.
vulnerability CVE-2020-0796
Separately, more than 270,000 systems remained exposed to CVE-2020-0796 as of February 2026, six years after its disclosure.
general_metric 270,000 systems
Separately, more than 270,000 systems remained exposed to CVE-2020-0796 as of February 2026, six years after its disclosure.
organisation Automox
“Manual work is the new attack surface,” says Ryan Braunstein, Security Manager at Automox.
organisation MTTP
Roughly 1 in 10 reported an MTTP of under a day.
organisation the Reason Triage Stopped Working
Volume Is the Reason Triage Stopped Working The prioritization bottleneck is a volume problem before it’s a judgment problem.
organisation CVE
The same analysis notes that NIST no longer enriches every new CVE, which quietly removes a triage input a lot of programs were built on.
‎Q2 2026
Disclosed vulnerabilities rose 36% quarter over quarter, following an 18.5% rise the previous quarter.
organisation Beazley Security’s
Beazley Security’s Q2 2026 analysis found disclosed vulnerabilities rose 36% quarter over quarter, following an 18.5% rise the quarter before.
general_metric 36 %
Beazley Security’s Q2 2026 analysis found disclosed vulnerabilities rose 36% quarter over quarter, following an 18.5% rise the quarter before.
general_metric 18.5 %
Beazley Security’s Q2 2026 analysis found disclosed vulnerabilities rose 36% quarter over quarter, following an 18.5% rise the quarter before.
‎July 2026
Automox integrated its platform with Tenable Vulnerability Management in limited beta.
organisation Tenable Vulnerability Management
In July 2026, Automox placed an integration with Tenable Vulnerability Management into limited beta.
organisation Sophos’s State of Ransomware
Sophos’s State of Ransomware 2026 reported that compromised identities featured in 79% of ransomware attacks, while malicious email (26%) and phishing (24%) were the two most commonly reported root causes.
victims 2,158 organizations
Sophos surveyed 2,158 organizations that had experienced ransomware during the previous year, all with 100 to 5,000 employees, while Verizon analyzed confirmed breaches across a much broader dataset.
victims 5,000 employees
Sophos surveyed 2,158 organizations that had experienced ransomware during the previous year, all with 100 to 5,000 employees, while Verizon analyzed confirmed breaches across a much broader dataset.
organisation IBM
IBM’s Cost of a Data Breach Report 2026 found 50% of organizations now deploy AI agents somewhere in the security operations center, but only 18% apply them to vulnerability scanning and management.
organisation Mitigation Worklet
In September, the company introduced an AI-drafted Mitigation Worklet pipeline that produces configuration changes and temporary workarounds.
organisation Verizon’s
These figures are not directly comparable with Verizon’s breach-wide findings.
organisation The Boring Investment
The Boring Investment Is the Defensible One The most defensible security spending of the AI era may be the least interesting.
‎2026/09/25
Ransomware gangs have exploited a critical VMware vCenter vulnerability, tracked as CVE-2026-59310, to breach organizations.
organisation The Access Route Got Older
The Access Route Got Older, Not Smarter Much of the current security discussion centres on AI-related threats , but Verizon’s data shows that known and unpatched vulnerabilities remain a common entry point.
organisation Securing AI
Securing AI systems matters, but organizations are still being breached through weaknesses for which fixes already exist.
infrastructure 361 IP addresses
Two weeks later, digital forensics and incident response (DFIR) company QUIRSO reported finding over 361 IP addresses across 47 countries compromised after a suspected advanced persistent threat (APT) actor began exploiting the vulnerability to d…
infrastructure 450 vCenter servers
Internet security threat monitor Shadowserver currently tracks over 450 VMware vCenter servers exposed online ; however, there is no information on how many have already been patched against this flaw.
Tactical Metrics
Metrics
victims
2,158
Organizations
Sophos surveyed 2,158 organizations that had experienced ransomware during the previous year, all with 100 to 5,000 employees, while Verizon analyzed confirmed breaches across a much broader dataset.
Metrics
victims
5,000
Employees
Sophos surveyed 2,158 organizations that had experienced ransomware during the previous year, all with 100 to 5,000 employees, while Verizon analyzed confirmed breaches across a much broader dataset.
Metrics
infrastructure
361
Ip Addresses
Two weeks later, digital forensics and incident response (DFIR) company QUIRSO reported finding over 361 IP addresses across 47 countries compromised after a suspected advanced persistent threat (APT) actor began exploiting the vulnerability to d…
Metrics
infrastructure
450
Vcenter Servers
Internet security threat monitor Shadowserver currently tracks over 450 VMware vCenter servers exposed online ; however, there is no information on how many have already been patched against this flaw.
Intelligence Sources
BleepingComputer 2026-09-15
HackRead 2026-09-25