---
title: Unit 42's September 2026 initial-access ranking: public-facing app exploits first, then valid credentials, phishing, supply chain and drive-by | ctxsec
url: https://ctxsec.com/items/unit42-top5-initial-access-sep-2026
description: ""
status: "vendor trend report (opinion/ranking)"
published: 2026-10-16
---

> 

[← Industry News](/industry) · [markdown](/items/unit42-top5-initial-access-sep-2026.md)

vendor trend report (opinion/ranking)

2026-10-16

### Unit 42's September 2026 initial-access ranking: public-facing app exploits first, then valid credentials, phishing, supply chain and drive-by

Unit 42's monthly roundup (Oct 16) ranks exploitation of public-facing applications as the most frequent entry vector in September, followed by valid credentials and credential abuse (often chained with edge-service bugs), phishing and targeted social engineering, supply-chain compromise, and drive-by or watering-hole compromise. It's a qualitative ranking without counts, so treat it as direction rather than measurement; it matches this week's KEV mix of edge appliances (BeyondTrust, Fortinet, Atlassian, Ivanti) and the AOMEI update-channel compromise.

Sources: [Unit 42: Top 5 Initial Access Threat Vectors, September 2026](https://unit42.paloaltonetworks.com/top-5-initial-access-vectors-september-2026/)