Q2 2026 Exploitation Trends Put AI Systems in Focus

The vulnerability picture in the second quarter of 2026 was shaped by two converging developments: a sustained increase in newly registered vulnerabilities and a shorter interval between disclosure and exploit publication. At the same time, enterprise adoption of AI agents, LLM platforms, and development tools introduced additional systems in which authentication, authorization, input handling, and credential management require close scrutiny.

Those are the central findings of Securelist’s Q2 2026 vulnerability analysis, authored by Alexander Kolesnikov. The report draws on Kaspersky’s vulnerability knowledge base, open sources, and Kaspersky telemetry. It describes exploitation across Windows and Linux, the use of common command-and-control frameworks in APT activity, and several vulnerabilities affecting AI-related products.

The research does not identify a single campaign or a single victim set. Instead, it presents a broad risk assessment: organizations must continue to address long-standing software weaknesses while preparing for security failures in newer AI-enabled infrastructure.

Disclosure speed is becoming a security problem

Securelist reports that the number of registered vulnerabilities reached an unprecedented level in Q2 2026 across the databases it tracks. The organization assesses that widespread AI adoption contributed to this growth in several ways. AI-assisted analysis can examine large volumes of previously unreviewed code, while AI-generated software and security advice can also introduce defects or fail to identify them reliably.

The report specifically points to OpenClaw, which ranked among the projects with the highest number of vulnerabilities published during the quarter, with more than 200 CVEs registered in the reporting period. Securelist also describes a sharp increase in published critical vulnerabilities and links that rise, in its assessment, to automated vulnerability research and the discovery of previously overlooked attack surfaces.

A related concern is the publication of exploit details before vendors have had adequate time to respond. Securelist says that researchers published technical details for several Windows issues before CVE identifiers had been assigned. The report names BlueHammer, RedSun, YellowKey, GreenPlasma, RoguePlanet, and UnDefend. These are researcher-assigned names in the source material, not CVE identifiers.

The reported issues affect components including Windows Defender, BitLocker-related recovery functionality, and the Collaborative Translation Framework. Securelist says the published material included working exploits for several of the issues, while GreenPlasma’s exploit had limited functionality and UnDefend was described as causing denial of service and blocking updates. The organization presents early exploit publication as an emerging trend that can give attackers an advantage over software developers.

Old Windows flaws remain operationally relevant

New disclosures are only part of the problem. According to Securelist, Kaspersky solutions continued to detect exploitation attempts targeting well-known Windows vulnerabilities. The report lists CVE-2018-0802 and CVE-2017-11882 in Microsoft Equation Editor, CVE-2017-0199 in Microsoft Office and WordPad, and CVE-2023-38831 in WinRAR.

It also highlights CVE-2025-6218 and CVE-2025-8088, both associated with archive extraction behavior in WinRAR. Securelist says these flaws can allow files to be placed in unintended locations and potentially support malicious command execution. The report further notes that attackers used NTFS alternate data streams to bypass controls related to extraction directories when exploiting CVE-2025-8088.

Securelist says the vulnerabilities observed in Windows exploitation can support initial access or privilege escalation. The number of Windows users encountering exploits declined slightly in Q2 and reached an 18-month low, according to the report’s telemetry. That reduction should not be interpreted as evidence that patching can be deferred: the continued detection of older flaws shows that exposure can persist long after a vulnerability becomes public.

Linux privilege escalation raises cloud and container concerns

Linux exploitation in Q2 included the Dirty Frag family and related vulnerabilities involving page-cache manipulation. Securelist reports active exploitation of CVE-2026-31431, called Copy Fail; CVE-2026-43284 and CVE-2026-43500, referred to as Dirty Frag; CVE-2026-46300, called Fragnesia; CVE-2026-31635, called DirtyDecrypt; CVE-2026-43494, called PinTheft; and CVE-2026-46331, known as pedit COW.

The common impact described by the organization is local privilege escalation, in several cases allowing an unprivileged user to reach root privileges. Securelist specifically characterizes CVE-2026-31431 as especially dangerous in cloud and containerized environments. The research also records continued exploitation attempts against older Linux vulnerabilities, including CVE-2022-0847, known as Dirty Pipe; CVE-2019-13272; CVE-2021-22555; and CVE-2023-32233.

Securelist reports that the number of Linux users encountering exploits declined slightly compared with Q1. Nevertheless, the concentration of newer flaws in kernel caching and related subsystems makes host and image hygiene important for organizations operating Linux fleets. A compromised user context may be materially more damaging when it is running on a shared host, a cloud workload, or a container platform with excessive privileges.

APT activity combines new access bugs with established C2 tools

Securelist’s review of open sources, research, and telemetry found a Q2 trend toward exploiting newly published vulnerabilities soon after disclosure, alongside continued use of zero-day vulnerabilities. The report does not name specific APT victims, but it says the observed activity involved launching command-and-control agents after initial access or privilege escalation.

Sliver, Havoc, AdaptixC2, and Metasploit were identified as the most widely used frameworks in the report’s review of APT activity. Their presence is not, by itself, proof of compromise: these are dual-use or publicly available frameworks that may also appear in legitimate security testing. The defensive significance is that organizations should not rely only on malware names or static signatures. They should also monitor the behavior of newly created services, suspicious processes, unusual outbound connections, and post-exploitation activity following exploitation of internet-facing systems.

The vulnerabilities associated by Securelist with attacks involving these frameworks include CVE-2026-35273 in Oracle PeopleSoft PeopleTools; CVE-2023-46604 in Apache ActiveMQ; CVE-2024-12356 and CVE-2026-1731 in BeyondTrust software; CVE-2023-36884 in Windows Search; CVE-2025-53770 in Microsoft SharePoint; and CVE-2025-8088 and CVE-2025-6218 in WinRAR.

The source describes these weaknesses as being used for initial access or privilege escalation before a C2 agent was launched. It also notes that the technical details of CVE-2026-35273 have not been disclosed, although post-exploitation research exists. That limitation matters: defenders should treat the reported association as a risk signal, not as a complete public exploit description.

AI platforms create new paths to credentials and internal services

The most distinctive part of the report concerns vulnerabilities in AI tools and platforms. Securelist’s analysis of vulnerability records found recurring weaknesses involving inadequate access control, flawed authentication or authorization, and injection-related defects. The organization assesses that developers have often prioritized functionality over security as AI tools have expanded rapidly.

CVE-2026-25253 in OpenClaw illustrates the credential exposure risk. Securelist says the interface trusted a gatewayUrl value supplied through a URL and automatically opened a WebSocket connection to that address, transmitting an authentication token without additional confirmation. If obtained, the token could enable actions according to its privileges, including session compromise, changes to agent configuration, and unauthorized access to connected tools or resources. The source says further host compromise was possible under certain configurations, but does not establish that every deployment is affected in the same way.

CVE-2026-41948 in the Dify AI platform represents an isolation and internal-service risk. Securelist describes a path traversal issue that could allow an authenticated user to move beyond the permitted tenant boundary and reach internal REST APIs. Depending on configuration, the consequences could include unauthorized access to internal interfaces, workspace-isolation failure, and disclosure of internal service information.

CVE-2026-45386 in Open WebUI is different in impact. The report says a user with permission to view a channel could alter the pinned status of messages because the application checked read access rather than the authorization required for a write operation. Securelist does not describe this as arbitrary code execution or sensitive-data compromise. Instead, it identifies risks to data integrity, moderation workflows, and the reliability of pinned instructions or announcements.

The report also covers CVE-2026-45501 in Microsoft Exchange. Securelist says improper neutralization of user input when generating web pages could cause specially crafted content to be interpreted as active content. Microsoft categorizes the potential impact as spoofing; Securelist notes that such flaws can also affect displayed content, user trust, and actions taken within an active session.

What organizations should do now

• Prioritize patching by exposure and exploit evidence. Build an inventory of Windows, Linux, WinRAR, Exchange, SharePoint, ActiveMQ, PeopleSoft, BeyondTrust, Dify, Open WebUI, OpenClaw, and other AI-related deployments. Accelerate remediation for vulnerabilities that Securelist reports as actively exploited or linked to APT activity.
• Review Linux privilege boundaries. Patch kernel packages promptly. Where patching is not immediately possible, evaluate Securelist’s recommendation to disable vulnerable kernel modules when operationally safe. Review container privileges, host sharing, and workload isolation.
• Protect agent credentials. Treat tokens used by AI agents as high-value credentials. Restrict their scope, rotate them when exposure is suspected, and monitor for unexpected connections or configuration changes. Do not allow agents to access sensitive tools or data by default.
• Test authorization at every AI operation. Verify that read, write, moderation, tenant, and administrative permissions are enforced independently. Pay particular attention to internal APIs and workspace boundaries.
• Hunt around exploitation events. Correlate web, application, endpoint, and identity logs for suspicious child processes, unexpected service changes, archive extraction anomalies, new outbound connections, and activity immediately following exploitation attempts.
• Validate vulnerability intelligence. Securelist warns that some polished Exchange and SharePoint vulnerability write-ups were fake or AI-generated. Confirm claims through trusted vendor advisories and established research before changing detection logic or prioritization.

Conclusion

Securelist’s Q2 2026 findings show that vulnerability management is becoming more time-sensitive and more diverse. Long-standing Windows and Linux flaws remain useful to attackers, while newer AI systems introduce risks involving tokens, authorization, tenant isolation, and active content. Organizations should combine rapid patching with least-privilege design, continuous monitoring, and careful validation of vulnerability reports. For AI agents in particular, security controls must cover not only the model, but also the tools, credentials, APIs, workspaces, and operating environments connected to it.

Sources

Securelist: “Analyzing the vulnerability landscape in Q2 2026”, by Alexander Kolesnikov.