GTIG Counts 141 Exploited Flaws as CVE Disclosures Double

An edge appliance with a public management interface is a better first stop for many patch teams than a list sorted by the latest CVE number. In its September 30 analysis, Google Threat Intelligence Group (GTIG) counted 141 distinct vulnerabilities disclosed and exploited from January through August 2026. Edge and security appliances accounted for 14% of the vulnerabilities it observed exploited in that period. The pressure falls on teams running internet-facing gateways, as well as owners of exposed collaboration services and AI gateways.

GTIG counted 10,740 vulnerabilities disclosed in August, up from 5,045 in January. The monthly average of vulnerabilities observed exploited rose from 10.5 in 2025 to 18 in the first eight months of 2026. Those are different measurements: disclosures count published flaws; observed exploitation counts flaws seen used in the wild. GTIG says just 0.23% of vulnerabilities disclosed in 2026 were observed actively exploited. The practical problem is finding the small set of reachable systems where a disclosed flaw becomes an entry route.

Disclosure volume distorts the queue

GTIG tracks disclosures and exploitation over January 2025 through August 2026. Its High-Risk label is a GTIG vulnerability risk rating, not a CVSS severity band. High-Risk disclosures rose from 131 in January to 350 in August 2026, but still accounted for 3% of August disclosures. Vendor disclosure cycles shaped that peak: Oracle’s quarterly releases and Linux kernel network driver advisories contributed 128 High-Risk vulnerabilities in August. GTIG also attributes 75 High-Risk flaws to mass research disclosures in TOTOLINK consumer router firmware during April and May.

Assignment practices affect the wider count, too. GTIG identifies roughly 5,000 CVEs with “Linux Kernel” in their descriptions from January through August 2026 and says none of those were observed as exploited in-the-wild zero-days. That counterweight makes a raw count a poor substitute for a map of exposed assets and observed attacker activity. GTIG counted 75 High-Risk vulnerabilities exploited in the first eight months of 2026, compared with 28 across 2025.

Attackers target reachable gateways

For the January–August period, GTIG assigns 14% of observed exploited vulnerabilities to edge and security appliances and 11% to enterprise directory and collaboration hubs. More than 65% of the exploited edge flaws received its High or Critical Threat Risk ratings. It describes adversaries targeting unauthenticated public management interfaces, where an appliance may have no endpoint detection agent to report what happens next. These percentages describe categories of exploited vulnerabilities, not percentages of deployed appliances.

One case makes the timing tangible. GTIG says Hacktron AI autonomously discovered CVE-2026-1731, a pre-authentication command-injection flaw in BeyondTrust Remote Support and Privileged Remote Access. GTIG observed one threat cluster exploiting it within four days of public disclosure and five more within seven days; it reports privilege escalation, data exfiltration and secondary payloads across those actors. The BeyondTrust-assigned CVE record lists Remote Support through 25.3.1 and Privileged Remote Access through 24.3.4 as affected. It describes command execution as the site user. This is the sort of exposure where a short gap between publication and exploitation defeats a patch queue based only on age.

GTIG writes that “adversary exploitation activity remains concentrated in perimeter appliances and exposed enterprise services.” Use that concentration to order the work: inventory edge and security appliances whose management services are reachable from untrusted networks, identify their installed builds, and put vendor fixes ahead of lower-risk disclosures on isolated systems. Restrict management reachability to the admin network or approved jump hosts while the fixes roll out; test access again from an untrusted network.

AI gateways require their own access check

GTIG also tracks 2,076 AI-related CVE disclosures over its full January 2025–August 2026 window, with more than 1,500 from January through August 2026. Those disclosures measure flaws in AI software across the longer window; GTIG separately counts observed exploitation. GTIG says AI-assisted findings skew toward higher-impact outcomes: 50% of the AI-discovered vulnerabilities it identified allowed remote code execution, compared with 26% in the wider set it compared. GTIG attributes part of that split to researchers directing agents toward critical code and privilege-sensitive components; public CVE records lack a uniform AI-discovery tag. Google also promotes its own AI defense products in the report, so the attribution and proposed automation are GTIG’s analysis.

A gateway example needs a precise access condition. GTIG includes LiteLLM CVE-2026-42271 among exploited AI middleware and groups the examples under unauthenticated code-execution and file-write flaws. The official LiteLLM CVE record specifies an authenticated path: the MCP server preview endpoints accepted a server configuration that could cause the proxy to spawn a subprocess, but callers needed a valid proxy API key. Even a low-privilege internal-user key could reach the endpoints because they had no role check. The record lists 1.74.2 up to but excluding 1.83.7 as affected, and 1.83.7 as patched. For that gateway, check both the installed version and who holds a valid key; restrict access to the proxy and upgrade affected installations to 1.83.7 or later.

Verify the exposed management path

Build the first patch queue from installed versions and reachable services: public management on edge and security appliances, then the exposed enterprise hubs and AI gateways whose advisories match your deployments. For BeyondTrust, compare installed Remote Support and Privileged Remote Access releases with the affected ranges in the CVE record and follow its linked vendor advisory for the applicable fixed release. For LiteLLM, check the installed build against 1.83.7 and review issued proxy API keys, including low-privilege internal-user keys. Preserve appliance management access logs and proxy authentication records to investigate suspected exploitation on a specific system.

After restricting management access, try the management URL from a network outside the approved admin path: it should be unreachable there and reachable from the authorized jump host. Check the installed patched version directly on each affected system after rollout.