* Hackers exploited vulnerability to access non-public info

* SEC only became aware of possible illicit trading last month (Adds details of critical report into SEC cyber security, details of previous hacks, more background)

By Michelle Price

WASHINGTON, Sept 20 (Reuters) - The top U.S. markets regulator said on Wednesday that hackers accessed its corporate disclosure database and may have illegally profited by trading on the insider information stolen.

The Securities and Exchange Commission (SEC) said the hack occurred in 2016 but that it had only discovered last month that the cyber criminals may have used the information to make illicit trades.

The hackers exploited a software glitch in the test filing component of the system to gain access to non-public information, the agency said.

The SEC hosts large volumes of sensitive and confidential information that could be used for insider-trading or manipulating U.S. equity markets. Its EDGAR database houses millions of filings on corporate disclosures ranging from quarterly earnings to statements on mergers and acquisitions.

Although the SEC "promptly" patched the vulnerability after detecting it in 2016, the regulator only became aware last month that the glitch "may have provided the basis for illicit gain through trading", it said.

"It is believed the intrusion did not result in unauthorized access to personally identifiable information, jeopardize the operations of the Commission, or result in systemic risk," the SEC said, adding that it was also liaising with the relevant authorities without naming them.

The incident comes just weeks after Equifax Inc, a major U.S. consumer credit reporting agency, disclosed that hackers had stolen data on more than 143 million customers and underscores the threat cyber criminals pose to the integrity of the financial markets.

It also raises questions about whether there were weak spots within the SEC, an institution tasked with protecting investors and financial markets, that allowed the hackers in.

In July, months after the breach was detected, a congressional watchdog office warned that the Wall Street regulator was "at unnecessary risk of compromise" because of deficiencies in its information systems.

The 27-page report by the Government Accountability Office found the SEC did not always fully encrypt sensitive information, used unsupported software, failed to fully implement an intrusion detection system and made missteps in how it configured its firewalls, among other things.

Cyber criminals have targeted financial information hubs before -- the Hong Kong stock exchange and the Nasdaq stock exchange in New York were targeted by hackers in 2011.