Vulnerabilities Hackers Are Exploiting Right Now

Every month software vendors publish a list of security holes they've fixed. Microsoft alone usually patches dozens in a single update. Most businesses can't patch everything instantly, so the useful question isn't "what vulnerabilities exist?" It's "which ones are attackers actually using, and how long have I got?"

The answer to the second part is less than you'd like. Here's what's being exploited heading into late 2026, and what to do about it.

Why "right now" matters more than "critical"

Vulnerabilities get a severity score out of 10 (the CVSS score), and it's tempting to patch from the top down. But a 9.8 that nobody is exploiting is less urgent than a 7.5 that criminals are using today. That's why security teams lean on the US CISA's Known Exploited Vulnerabilities catalogue, a public list of flaws with confirmed real-world attacks. If something on that list is in your network, it jumps the queue.

The ACSC's Essential Eight puts a number on it. For internet-facing services, patch within 48 hours when a working exploit exists, otherwise within two weeks. Do the maths on Microsoft's monthly Patch Tuesday, which lands on Wednesday morning in Australia. Forty-eight hours later is Friday morning. If your patching runs on the last weekend of the month, you're outside that window by more than two weeks.

1. The boxes on the edge of your network

Firewalls, VPN gateways and remote access appliances are the hottest target going, and it makes sense if you think like an attacker. These devices sit on the internet by design, they often hold the keys to everything behind them, and they usually can't run endpoint security software. Compromise one and you're inside without having phished anyone.

A good example is CitrixBleed 2 (CVE-2025-5777), disclosed in mid-2025. A crafted request made vulnerable Citrix NetScaler gateways leak chunks of their memory, which could include live session tokens. Replay the token and you're in as that user, MFA already satisfied. Ransomware groups were using it within weeks.

The ASD's annual cyber threat report makes the same point for Australia: criminals scan for old routers and misconfigured firewalls and use them as back doors. What to do: know every device that faces the internet, subscribe to the vendor's security advisories, and treat edge-device patches as a 48-hour job. If a device is out of vendor support, replace it.

2. On-premises servers that face the internet

In July 2025 attackers began exploiting a chain of vulnerabilities in on-premises Microsoft SharePoint, nicknamed ToolShell (CVE-2025-53770). It allowed remote code execution with no login at all. Exploitation was seen from 18 July; Microsoft's fix arrived late on 20 July. For a couple of days, the only defence was to disconnect the server.

Notice who wasn't affected: SharePoint Online in Microsoft 365. When Microsoft runs the server, Microsoft patches it, usually before anyone outside knows there was a problem. That's a strong argument for moving file sharing and email off servers in the comms cupboard. If you still run an Exchange or SharePoint server that's reachable from the internet, it needs either rigorous patching or a migration plan; our email and data migration team does the second one.

3. Software that's past its use-by date

An unpatched vulnerability is bad. A vulnerability that will never be patched is worse. Windows 10 reached end of support in October 2025, so any PC still running it without paid extended updates collects new holes every month that stay open forever. The same goes for old Windows Server versions, unsupported NAS boxes and that copy of a PDF reader from 2017.

Attackers love end-of-life software because their exploits keep working indefinitely. What to do: keep an asset list that includes support end dates, and budget replacements before the deadline, not after. Our guide to building an IT refresh plan shows how to spread the cost.

4. Home and small-office routers

Routers are the forgotten computers in every building. In April 2026 the FBI announced it had disrupted a network of compromised home and small-office routers run by a unit of Russian military intelligence. The attackers had exploited known flaws in routers, including popular TP-Link models, and changed their DNS settings so traffic was quietly redirected to servers that harvested passwords and authentication tokens. Microsoft counted more than 18,000 compromised routers across over 120 countries at the peak.

The flaws were known. Patches existed. The routers just never got them. What to do: turn on automatic firmware updates, disable remote administration, and replace routers the manufacturer no longer supports. Our article on the NSA's home network advice has the full list, and it applies to small offices too.

5. The browser and everything bolted onto it

Chrome, Edge and the other Chromium browsers get emergency fixes for exploited zero-days several times a year. The browser updates itself, but the fix only takes effect when the browser restarts, and some people haven't closed theirs since Easter. Browser extensions are a second layer of risk: a popular extension that changes hands can push a malicious update to every user overnight.

What to do: force browser restarts after updates through your device management, and restrict extensions to an approved list.

6. The vulnerability that isn't a bug: misconfiguration

Some of the most exploited weaknesses aren't in the code at all. A remote desktop port left open to the internet. An admin account without MFA. A storage bucket set to public. A Microsoft 365 tenant that still allows legacy sign-in methods that skip MFA entirely. Nobody issues a CVE for these, so no patch will ever fix them.

A regular IT audit or a Microsoft 365 security assessment is how you find them.

A patching routine that keeps up

None of this requires heroics. It requires a process that runs whether or not anyone remembers:

• Know what you have. Every device, every internet-facing service, every support end date.
• Automate the routine. Workstations, browsers and Microsoft 365 apps should patch themselves on a deadline, with compliance reporting so you can see the stragglers.
• Fast-track the exploited. Anything internet-facing on the known-exploited list gets done within 48 hours.
• Replace, don't stretch. End-of-life gear comes out on schedule.
• Check it worked. Scan for vulnerabilities monthly, because "we pushed the patch" and "the patch installed" are different sentences.

This is the core of what our managed IT clients get by default. Patching is boring. Being on the wrong side of a 48-hour window is not.

Frequently asked questions

What are the most exploited vulnerabilities right now?

Flaws in internet-facing devices such as firewalls, VPN and remote access gateways dominate, along with on-premises servers like SharePoint and Exchange, end-of-life operating systems and unpatched routers. CISA's Known Exploited Vulnerabilities catalogue is the best public list of what's under active attack.

How quickly should vulnerabilities be patched?

Under the ACSC's Essential Eight, internet-facing services should be patched within 48 hours if a working exploit exists and within two weeks otherwise. Other applications and operating systems have slightly longer windows depending on the maturity level you're aiming for.

Why are firewalls and VPNs targeted so often?

They sit directly on the internet, they control access to everything behind them, and they usually can't run endpoint security tools. One exploited gateway can hand an attacker remote access without any phishing at all.

Is cloud software safer from vulnerabilities than on-premises servers?

For patching, generally yes. Services like SharePoint Online and Exchange Online are patched by Microsoft, often before a flaw is public. You remain responsible for configuration, such as MFA and sharing settings.

Local IT and cyber security support across NSW

Chewing IT runs managed IT and cyber security for small and mid-sized businesses from our Wyong and Hornsby offices, covering the Central Coast, Newcastle, Lake Macquarie and Hornsby.

Not sure what's facing the internet in your business, or when it was last patched? Ask us for a vulnerability check — we'll find the gaps before someone else does.