Top 10 Exploited Vulnerabilities in 2026 [Updated]
Introduction
Cybersecurity in 2026 is not being defined by brand-new exploits. It is being shaped by familiar vulnerabilities that keep resurfacing in breach reports, incident reviews, and post-attack investigations.
At Capture The Bug, working with SaaS companies, regulated enterprises, and fast-growing startups across ANZ and the USA, a clear pattern keeps emerging. Most successful attacks do not rely on sophisticated techniques. They rely on gaps. Gaps in patching, visibility, ownership, and urgency.
This article breaks down the top 10 exploited vulnerabilities still being abused in 2026, why attackers keep returning to them, and what security leaders should realistically take away from each one.
This is written for decision-makers, not researchers. The goal is clarity, not alarm.
Why "old" vulnerabilities still dominate in 2026
Before looking at the list, one uncomfortable truth needs to be addressed.
Most breaches are not caused by zero-days. They are caused by known issues that were documented, scored, and patched months or even years ago. Attackers prefer reliability. If a vulnerability worked at scale in 2022, and many organisations still have not fully closed it in 2026, it remains profitable.
This is why vulnerability exploitation trends change slowly, even as technology evolves quickly.
The Top 10 Exploited Vulnerabilities in 2026
1. ZeroLogon (CVE-2020-1472)
ZeroLogon remains one of the most damaging authentication flaws ever discovered in Windows environments. Despite patches being available for years, domain controllers are still being compromised due to incomplete remediation, legacy dependencies, or misconfigured enforcement modes.
Why attackers still use it:
Once exploited, it can lead to full domain takeover. There are few faster ways to move from initial access to total control.
What it teaches security teams:
Identity infrastructure is a single point of failure. If domain controls are weak, everything else becomes irrelevant.
2. Log4Shell (CVE-2021-44228)
Log4Shell continues to appear in breach investigations because it lives deep inside software supply chains. Many organisations patched their core systems but failed to identify embedded libraries in third-party tools, internal services, or forgotten applications.
Why attackers still use it:
It enables remote code execution with minimal effort and broad reach, especially in Java-heavy environments.
What it teaches security teams:
Asset visibility matters more than patch announcements. You cannot secure what you do not fully inventory.
3. ICMAD in SAP Systems (CVE-2022-22536)
SAP environments remain high-value targets due to the sensitive business data they process. This request smuggling vulnerability is still exploited in organisations that treat ERP platforms as untouchable or too risky to update frequently.
Why attackers still use it:
Successful exploitation can compromise confidentiality, integrity, and availability in a single move.
What it teaches security teams:
Critical business systems cannot be exempt from regular security testing just because downtime feels expensive.
4. ProxyLogon (CVE-2021-26855)
Microsoft Exchange continues to be a magnet for attackers. ProxyLogon enables unauthenticated access and remote code execution, and compromised servers often become long-term persistence points.
Why attackers still use it:
Email infrastructure offers direct access to sensitive communications and credentials.
What it teaches security teams:
Externally exposed services deserve continuous scrutiny, not periodic checks.
5. Spring4Shell (CVE-2022-22965)
Spring-based applications remain widely deployed across enterprise and SaaS platforms. Misunderstandings around affected configurations led many teams to assume they were safe when they were not.
Why attackers still use it:
It offers a direct path to code execution when conditions align.
What it teaches security teams:
Framework-level vulnerabilities require deep understanding, not surface-level confirmation.
6. Atlassian Confluence RCE (CVE-2022-26134)
Confluence is often treated as internal-only infrastructure, which makes it dangerous when exposed. Attackers have repeatedly leveraged this OGNL injection flaw to gain execution on collaboration servers.
Why attackers still use it:
Confluence instances frequently hold credentials, internal documentation, and deployment details.
What it teaches security teams:
Internal tools often become external risks through misconfiguration and trust assumptions.
7. VMware vSphere Client RCE (CVE-2021-21972)
Virtualisation platforms are crown jewels in modern infrastructure. This vulnerability allows attackers to execute code with high privileges, potentially compromising entire environments.
Why attackers still use it:
One successful exploit can cascade across dozens or hundreds of workloads.
What it teaches security teams:
Infrastructure layers deserve the same testing attention as applications.
8. Google Chrome Zero-Day (CVE-2022-0609)
Client-side exploitation remains relevant in 2026. Browser vulnerabilities are still used for initial access, especially in targeted campaigns.
Why attackers still use it:
Browsers sit at the boundary between users and the internet. Exploiting them bypasses many perimeter controls.
What it teaches security teams:
Endpoint security and patch discipline are still part of the attack surface.
9. Follina (CVE-2022-30190)
Follina demonstrated how document-based attacks can bypass traditional protections. Even years later, similar techniques are still succeeding due to user behaviour and legacy tooling.
Why attackers still use it:
It blends social engineering with technical exploitation.
What it teaches security teams:
Security controls must account for how people actually work, not how policies assume they work.
10. PetitPotam (CVE-2021-36942)
PetitPotam exploits weaknesses in Windows authentication flows to force domain controllers into unintended authentication. While technically complex, it continues to be used in targeted attacks.
Why attackers still use it:
It enables lateral movement and privilege escalation inside trusted networks.
What it teaches security teams:
Internal trust boundaries are often too permissive.
The common thread across all 10 vulnerabilities
These vulnerabilities span different vendors, technologies, and years. Yet they share the same underlying issues:
- Delayed patching
- Poor asset visibility
- Over-trust in "internal" systems
- One-time security assessments
- Lack of continuous validation
Attackers are not winning because they are smarter. They are winning because defenders are inconsistent.
What security leaders should do differently in 2026
At Capture The Bug, the strongest security programmes share a few practical traits.
- They treat vulnerability management as an ongoing discipline, not a quarterly task.
- They verify fixes, rather than assuming patches worked.
- They test production environments realistically, not theoretically.
- They prioritise exploitable risk, not raw vulnerability counts.
This is where modern penetration testing models, especially continuous and on-demand approaches, are reshaping outcomes. The goal is not to find more issues. It is to close the ones that matter before attackers do.
Final thoughts
The top exploited vulnerabilities of 2026 tell a simple story.
The industry does not have a discovery problem. It has an execution problem.
Most breaches could be prevented with better follow-through, better testing coverage, and better visibility into what is actually running in production.
Security maturity in 2026 is no longer about knowing what is vulnerable. It is about proving what is no longer exploitable.
That distinction is where real resilience begins.
FAQ
What are the most exploited vulnerabilities in 2026?
The most exploited vulnerabilities in 2026 are well-known issues like ZeroLogon, Log4Shell, ProxyLogon, and Spring4Shell that remain unpatched or poorly remediated in many environments.
Why are old vulnerabilities still exploited?
Because attackers prioritise reliability. If a known vulnerability still works at scale, it remains more valuable than chasing unproven new flaws.
Are zero-day vulnerabilities the biggest risk in 2026?
No. Most successful attacks still rely on known vulnerabilities that organisations failed to fully address.
How can companies reduce exploitation risk?
By maintaining accurate asset inventories, validating patches, and performing regular, realistic penetration testing.
Does penetration testing still matter if vulnerabilities are known?
Yes. Testing verifies whether known vulnerabilities are actually exploitable in your specific environment.
