Story · 5 sources · 7 articlesfirst Sep 25, 04:46 UTCupdated Sep 26, 08:49 UTC (23h ago)

CISA KEV adds exploited WSO2, Adobe, SharePoint, and MikroTik flaws

criticalExploit / PoCexploited in the wildimportance 88CVE-2026-65660 CVE-2026-67279 CVE-2026-86060 CVE-2026-5430 CVE-2026-71362

What's new: The Hacker News on September 26 adds that Microsoft revised SharePoint CVE-2026-65660 from spoofing to remote code execution and reported reliable evidence of attacks as of September 25, 2026, and names the MikroTrick chain of CVE-2026-67279 with already-listed CVE-2026-86060 as giving passwordless administrative control of exposed RouterOS 7.x devices.

Merged summary · grok-4.7 · rewritten as coverage arrives

CISA ordered federal fixes for actively exploited WSO2, Adobe Commerce, SharePoint, and MikroTik flaws by September 27 or 28, 2026.

On September 24, 2026, CISA added actively exploited WSO2 CVE-2026-5430 and, according to The Hacker News, Security Affairs, and BleepingComputer, Adobe Commerce CVE-2026-71362 to its Known Exploited Vulnerabilities catalog, ordering federal civilian agencies to remediate both by September 27, 2026. Sources disagree on CVE-2026-5430: The Hacker News scores it CVSS 9.8 as path traversal in API Control Plane, API Manager, Traffic Manager, and Universal Gateway enabling unrestricted file upload and remote code execution, while Security Affairs and BleepingComputer score it CVSS 10.0 as failed JWT signature verification that can bypass authentication and seize accounts; Cyber Security News and GBHackers report both the path-traversal impact and CWE-347, and GBHackers cites a CVSS 10.0 scenario. BleepingComputer specifies API Manager 4.1.0 through 4.6.0 and related 4.5.0 and 4.6.0 components used by nearly 1,000 banking, government, telecom, and logistics customers; watchTowr observed exploitation on honeypots since September 13, which BleepingComputer narrows to limited forged-token attempts that day from one IP, and ransomware use is unconfirmed while BOD 26-04 requires forensic triage. CVE-2026-71362 (CVSS 9.1) is an incorrect-authorization flaw in Adobe Commerce and Magento that can switch sessions and take over accounts without user interaction; Security Affairs adds Commerce B2B and Magento Open Source through the July 2026 patches and access to private customer data, and Sansec said targeting began in August 2026. CISA also added SharePoint CVE-2026-65660 (CVSS 8.8; Server 2016, 2019, and Subscription Edition), which Microsoft revised from spoofing to remote code execution with reliable evidence of attacks as of September 25, 2026, and MikroTik RouterOS SSH-bypass CVE-2026-67279 (CVSS 6.9), both due September 28; CERT Polska dates MikroTik exploitation to at least September 2, and The Hacker News says the MikroTrick chain with already-listed CVE-2026-86060 can give passwordless administrative control of exposed RouterOS 7.x devices, while Security Affairs cites BOD 22-01 for that deadline.

CISA added WSO2 CVE-2026-5430 and Adobe Commerce CVE-2026-71362 to the KEV catalog on September 24, 2026; FCEB agencies must remediate both by September 27, 2026.
Sources disagree on CVE-2026-5430: The Hacker News scores it CVSS 9.8 as path traversal to unrestricted file upload and RCE, while Security Affairs and BleepingComputer score it CVSS 10.0 as a JWT signature-verification failure; Cyber…
Affected WSO2 products include API Control Plane, API Manager 4.1.0 through 4.6.0, Traffic Manager, and Universal Gateway, used by nearly 1,000 customers; watchTowr saw activity since September 13, which BleepingComputer narrows to limited…

VendorsMicrosoft MikroTik WSO2 Adobe

ProductsSharePoint RouterOS Microsoft SharePoint Server WSO2 API Manager Adobe Commerce Magento Microsoft SharePoint WSO2 API Control Plane WSO2 Traffic Manager WSO2 Universal Gateway Magento Open Source Commerce B2B

OrganizationsCISA CERT Polska Bishop Fox watchTowr Sansec

Coverage timelineoldest first · each row is one article

Sep 25, 04:46 UTC · 2d ago
The Hacker News· 80
WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV
CISA added WSO2 path traversal CVE-2026-5430 and Adobe Commerce authorization flaw CVE-2026-71362 to its KEV catalog amid active exploitation.
Sep 25, 08:22 UTC · 1d ago
Security Affairs· 82
U.S. CISA adds Adobe and WSO2 flaws to its Known Exploited Vulnerabilities catalog
CISA added exploited WSO2 and Adobe Commerce flaws to the KEV catalog, with federal fixes due September 27.
Sep 25, 09:39 UTC · 1d ago
Cyber Security News· 82
CISA Warns of WSO2 Multiple Products Vulnerability Exploited in Attacks

Vulnerabilities in this storyAll →

CVE-2026-543010.0<1%
Unauthenticated JWT Algorithm Bypass in WSO2 API Manager and Gateways
published Aug 6, 2026· wso2 api manager KEV PoC
CVE-2026-65660

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-5430	Unauthenticated JWT Algorithm Bypass in WSO2 API Manager and Gateways CVE-2026-5430 is a flaw in WSO2's JWT authentication mechanism (CWE-347, improper verification of cryptographic signature) in which tokens signed with algorithms other than those explicitly configured are incorrectly accepted and validated. A remote, unauthenticated attacker can craft a JWT with an unsupported algorithm and present it to gain unauthorized access, up to and including compromise of administrative accounts and full account takeover. The flaw carries a CVSS 3.1 base score of 10.0 (scope changed) and 9.8 in single-tenant deployments, and affects WSO2 API Manager, API Control Plane, Traffic Manager, and Universal Gateway; the CISA catalog entry titles it as a path traversal issue, but the technical description is a JWT signature-validation bypass. It was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-24, and press reports describe active exploitation targeting WSO2 API Manager with forged admin tokens, despite a low EPSS score (0.4%, 29th percentile). Do: Immediately apply the vendor's patched versions or mitigations per the WSO2 security advisory and CISA BOD 26-04 timelines (or discontinue use if mitigations are unavailable), since this is in the KEV catalog and being exploited with forged admin tokens. Restrict internet access to management consoles, API Control Plane, and gateway endpoints, and hard-enforce the JWT algorithms configured at each token validator. Hunt for JWTs with unexpected "alg" headers, unexplained admin logins, or new rogue applications/clients, and rotate admin credentials, signing keys, and issued tokens on any suspected compromise.	10.0	<1%	KEV PoC	wso2 api manager wso2 api control plane wso2 traffic manager +1 more	moderatelow thousands of internet-exposed WSO2 deployments (order of 10^3-10^4 systems)	Aug 6, 2026 KEV Sep 24, 2026
CVE-2026-65660	Authenticated Code Injection RCE in Microsoft SharePoint Server CVE-2026-65660 is an improper control of code generation (CWE-94) flaw in Microsoft Office SharePoint Server that allows an authenticated, low-privilege attacker to inject and execute arbitrary code over a network. The bug is triggered after login by sending crafted input that SharePoint processes and executes, so any account with basic access to the SharePoint site — including a standard user — is a viable attack path. Successful exploitation yields remote code execution on the SharePoint server with the privileges of the SharePoint service account, threatening full compromise of confidentiality, integrity, and availability (CVSS 8.8). Notably, Microsoft initially classified the flaw as spoofing before it was recharacterized as authenticated RCE, and Canada's Cyber Centre has issued advisory AL26-023 about it. A public proof-of-concept exists on GitHub, but the issue is not in CISA's KEV catalog and there are no confirmed reports of in-the-wild exploitation yet, though EPSS (1.2%, 67th percentile) suggests above-average likelihood of attempted exploitation. Do: Apply Microsoft's security update for SharePoint Server from the corresponding Patch Tuesday release as soon as possible, prioritizing any server reachable from the internet or exposed to broad internal user populations. Because exploitation only requires an authenticated low-privilege account, review recent SharePoint audit logs for anomalous behavior by ordinary users (unexpected page/app modifications, unusual requests preceding process activity), and enforce least-privilege access so standard accounts cannot reach sensitive site collections. Verify patch levels across all SharePoint farms, including pre-production and forgotten servers, and monitor Microsoft's advisory and the Canadian Cyber Centre's AL26-023 for updates on active exploitation.	8.8	2%	KEV
CVE-2026-86060 +1 related CVE CVE-2026-67279	Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation CVE-2026-86060 is an argument-injection flaw (CWE-88) in MikroTik RouterOS's SSH login path: when a login supplies a username beginning with a prohibited character, the RouterOS login helper mishandles the argument, allowing the trusted RouterOS policy mask to be changed and privileges to be escalated. An unauthenticated attacker only needs the ability to reach the router's SSH service, since exploitation happens during the SSH login process itself. By altering the policy mask the attacker gains elevated rights on the device, and news reports indicate attackers have used this technique — including logins with usernames such as '-2' — as part of chains that take over routers without needing a password. Any RouterOS deployment running versions before the fixes (6.49.21 Long-term, 7.23.4 Long-term, 7.24.2 Stable) with SSH enabled or reachable is affected, with internet-exposed SSH at highest risk. Multiple outlets report the RouterOS flaws are being actively exploited in the wild, although no public proof-of-concept is known and the flaw is not yet in CISA KEV. Do: Upgrade RouterOS to 6.49.21 (Long-term), 7.23.4 (Long-term) or 7.24.2 (Stable) as applicable. Until patched, restrict SSH (TCP 22) to trusted management networks or disable the SSH service if unused, and review authentication logs and user/group policy settings for tampering — reports indicate attackers log in with usernames beginning with '-' (e.g., '-2').	9.2 group max	2%	KEV
CVE-2026-71362	Unauthenticated Privilege Escalation Flaw in Adobe Commerce (Magento) CVE-2026-71362 is an incorrect-authorization flaw (CWE-863) in Adobe Commerce, the e-commerce platform formerly known as Magento, in which authorization checks are applied incorrectly and can be bypassed. It is triggered over the network without authentication or user interaction, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). A successful attacker gains elevated access to sensitive resources — a privilege-escalation condition that Adobe's APSB26-92 advisory and press coverage describe as an account-takeover risk. Any organization running an unpatched Adobe Commerce/Magento deployment is affected; exact version ranges are listed in Adobe security bulletin APSB26-92. The flaw came under active attack shortly after public disclosure, and its EPSS score of 25.1% (98th percentile) signals a high likelihood of continued near-term exploitation. Do: Apply the fix released under Adobe advisory APSB26-92 immediately, prioritizing internet-facing Commerce/Magento instances, and check the bulletin for the exact patched version ranges for your deployment. Because exploitation requires no credentials or user interaction, review admin accounts, API integrations, and user/role assignments for unauthorized privilege changes, and restrict admin-panel and storefront API access where feasible. Monitor Adobe's advisory for indicators of compromise given confirmed in-the-wild exploitation.	9.1	88%	KEV	Adobe Commerce (Magento)