cve recordzero dayexploit reported

CVE-2026-84434

CVSS—

Severitynone

Weakness—

EPSS3.9%90.3th percentile

Exploited1 KEV source

patch window

Called exploited 1 days before disclosure.

Measured from the CVE publication date to the earliest of 1 KEV catalogue that list it.

The life of this vulnerability

CVE reservedSep 1, 2026
CVE publishedSep 19, 202618d
First KEV listingSep 18, 20261d
Last sightingSep 18, 2026same day

Gaps are compressed to equal steps. The elapsed time is printed under each.

Which catalogues call it exploited

CISA KEVUS federaldoes not list it
EUVDENISA, European Uniondoes not list it
VulnCheck KEVcommercial researchlisted Sep 18, 2026
CIRCLaggregator, mirrors the abovedoes not list it

Sources1 of 3

Listings differ by—

This rests on a single catalogue. No second catalogue corroborates the claim that it is being exploited. CIRCL is an aggregator and is not counted.

Public exploitation evidence

reported exploitationSep 18, 2026patchstack.com/database/wordpress/plugin/gravityforms/vulner

1 public report collected from VulnCheck and CIRCL, first on Sep 18, 2026. Each links to its original source. We have not verified them.

Description

References

← Back to the CVE Tracker

Our coverage of CVE-2026-84434

CVE-2026-84434Oct 2, 2026high

Gravity Forms Unrestricted Upload Flaw Exploited Before CVE Publication

A critical vulnerability in Gravity Forms, an unrestricted file upload flaw, was exploited before its official CVE publication. It is listed on VulnCheck's Known Exploited Vulnerabilities catalogue but not on CISA's or the EUVD.

CVE-2026-84434Sep 20, 2026high

CVE-2026-84434 Exploited Before Publication, No Patch Window

A critical vulnerability, CVE-2026-84434, was reported as exploited on September 18, 2026, one day before its official publication. This flaw has no patch window and is listed in the VulnCheck KEV but not in CISA KEV or EUVD.