CISA KEV Adds Four Exploited Flaws, Including SharePoint and WSO2

CISA's KEV additions cover WSO2, Adobe Commerce, SharePoint and RouterOS​

BleepingComputer first reported the four flaws together. The additions came in two batches. On September 25, 2026, CISA posted an alert saying it had added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. Those two were CVE-2026-65660 Microsoft SharePoint Code Injection Vulnerability · CVE-2026-67279 Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability. The two critical flaws, in WSO2 and Adobe Commerce, came slightly earlier. The CVE Brief tracking service lists the WSO2 entry as added to CISA KEV on September 24.

The federal deadlines are short. BleepingComputer reports that for the two critical flaws, federal agencies using the affected products have until Sunday, September 27, to apply the recommended updates or mitigations, or discontinue their use. For the Microsoft SharePoint and Mikrotik RouterOS flaws, CISA is giving agencies until Monday, September 28 to fix them. A separate operator write-up based on the KEV catalog data also gives the SharePoint federal KEV due date as September 28.

Strictly, these deadlines bind only U.S. civilian agencies. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. CISA says that while BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. For a private company, a KEV listing means someone is attacking this bug in the wild, so it should jump the patch queue.

CVE-2026-65660 moved from a spoofing label to a SharePoint RCE in about six weeks​

For Windows shops, the SharePoint flaw is the one to worry about most. Microsoft fixed it in its August 11, 2026 security release. The NVD record describes it as improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network, with a CVSS 3.1 score of 8.8. The affected versions are on-premises SharePoint Server 2016, 2019 and Subscription Edition. SharePoint Online is not listed.

The first classification is the key detail. When Microsoft published the fix, CVE-2026-65660 was listed as a spoofing vulnerability with a CVSS score of 6.5, a moderate rating. Most patch-prioritization rules would put that behind the month's critical items. Later analysis found that an authenticated attacker could run code on the server. The Canadian Centre for Cyber Security issued an alert on September 24 confirming reports of active exploitation, one day before CISA listed the flaw.

The record is still inconsistent. According to the HOL write-up, which is built from MSRC, NVD and KEV data, MSRC still lists exploited: No on the advisory; CISA's KEV listing is the later exploitation signal. Anyone whose triage relies on Microsoft's "Exploitation Detected" flag will not see this one flagged yet. The same write-up says forensic triage is marked Yes under BOD 26-04. Known ransomware campaign use is Unknown.

The attacker needs an account, and that limits the risk. An authenticated flaw can't be sprayed at every exposed SharePoint server the way an unauthenticated one can. But on a SharePoint farm, stolen or phished domain credentials are often all it takes, and the flaw gives code execution on the server itself.

This is the latest in a series of SharePoint KEV entries this summer. In a July alert, updated several times, CISA said it was aware of active exploitation of vulnerabilities CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, CVE-2026-50522, and CVE-2026-55040, enabling cyber threat actors to gain unauthorized access to on-premises SharePoint Server instances. The post-exploitation activity in those campaigns included stealing Internet Information Services (IIS) machine keys and performing deserialization techniques, to gain persistence and deploy malware. CVE-2026-65660 is a separate bug. Nothing on record ties its exploitation to those campaigns. What the history does show is that on-premises SharePoint has been a steady target for months.

WSO2's CVE-2026-5430 lets forged JWTs past API Manager​

CVE-2026-5430 is an authentication bypass in the JWT (JSON Web Token) validation used by several WSO2 products. CVE Brief summarizes it as follows: the WSO2 JWT authentication mechanism incorrectly validates tokens using unsupported algorithms, potentially allowing unauthenticated attackers to bypass security controls and gain unauthorized access. In plain terms, the gateway should reject any token signed with an algorithm it isn't configured to accept. Instead it accepts them, so an attacker can forge a token the system trusts.

BleepingComputer reports that the flaw received a maximum severity score and impacts WSO2 API Manager versions 4.1.0 through 4.6.0, API Control Plane, Traffic Manager, and Universal Gateway versions 4.5.0 and 4.6.0. The scores reported so far don't agree. CVE Brief shows 9.5 in its header but refers to a CVSS of 10.0 in its analysis. Either way, the flaw is critical. WSO2's own advisory warns that a successful attacker could compromise administrative accounts and take full control.

The dates are also messy. BleepingComputer gives May 3 as the date of WSO2's original advisory. CVE Brief records the CVE as disclosed on August 6, 2026, with a fix documented on September 5. These may be different milestones, such as a private customer advisory followed by public CVE publication. Either way, patches have been out for weeks.

The public evidence of exploitation comes from watchTowr. The security firm said its honeypots caught a small number of attempts from a single IP address on September 13. The attacker used forged JWTs but aimed them at the wrong WSO2 product. watchTowr then ran the attack against the correct product and found that a forged token could expose API endpoints and application credentials. CISA hasn't described the attacks behind its listing. Yordan Ganchev of watchTowr told BleepingComputer that WSO2's technology is used by nearly 1,000 customers across banking, government, telecommunications and logistics. He added that "Organizations in these sectors can't afford to wait for exploitation to be formally confirmed."

Secondary CVE reporting lists the fixed builds as follows. Check them against WSO2's advisory before relying on them:

WSO2 fixes these as patch levels within each release line, not as new major versions. Administrators need to check the update level of each deployed component, not just the product version.

Adobe Commerce CVE-2026-71362 hijacks customer sessions without logging in​

CVE-2026-71362 is the second critical KEV entry. BleepingComputer describes it as an incorrect authorization vulnerability in Adobe's Commerce and Magento e-commerce platforms. Adobe fixed it in its August 2026 update, bulletin APSB26-92. Check Point's advisory lists the vulnerable versions as Adobe Commerce 2.4.9 and earlier, Adobe Commerce B2B 1.5.3 and earlier, and Magento Open Source 2.4.9 and earlier.

Exploit attempts began almost as soon as the patch shipped. BleepingComputer reported in August that although Adobe's advisory said it wasn't aware of exploits in the wild, e-commerce security firm Sansec said its Shield web application firewall was already blocking CVE-2026-71362 exploitation attempts. Sansec analyzed the patch and traced the problem to Magento mishandling customer identity within an account session. The company said the flaw lets attackers switch a customer session to another customer's account, which exposes that victim's account and private data. According to Sansec, threat actors require "no existing account, administrator privileges, or user interaction" to leverage it.

For a store operator, that means customer data exposure without any admin compromise. Attackers can reach names, addresses, order history and anything else stored in customer accounts, without touching the admin panel. That changes the incident-response question. Auditing admin logins won't be enough. Operators should look for sessions that switched between customer identities.

Patching Adobe Commerce is harder than it sounds. Sansec says Adobe distributes these monthly fixes as isolated patch files, not as a new security release or updated Composer packages. Before applying the matching patch, stores must be on the latest -p release for their supported branch. If a store is behind on -p releases, it has to catch up first, so the fix can take longer than a single patch.

MikroTik RouterOS CVE-2026-67279 drops SSH authentication during rekey​

The fourth flaw is rated medium, but it still matters to anyone running MikroTik gear at a branch office or network edge. The GitHub Advisory Database describes CVE-2026-67279 as an SSH state-machine bug. When a client requests a rekey, an affected RouterOS SSH server can move into the connection phase without authenticating the user. It then accepts an exec request and allows unauthenticated file operations within RouterOS's managed file namespace. CISA classifies it as Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability.

Fixed releases are RouterOS 6.49.21 (long-term), 7.23.4 (long-term) and 7.24.2 (stable). MikroTik's September 3 security notice also lists 7.25 beta 3 and says most configurations are not at risk but still recommends upgrading. Whether a router is exposed mostly depends on whether its SSH service can be reached. MikroTik says the default configuration blocks SSH from the internet. Users who opened it manually should limit it to trusted IPs or put it behind a VPN such as WireGuard.

What this means for you​

Start with SharePoint and WSO2, then the others. Treat all four as emergency patches if you run the affected product, whatever your sector. The fixes are already available, so the work is mostly finding every instance and confirming it's on a fixed build. Organizations with no on-premises SharePoint, no WSO2 API gateway, no Magento store and no MikroTik hardware have nothing to do here.

On SharePoint, check servers against the August 2026 builds, not just the month's KB numbers. The HOL write-up gives the fixed builds as SE 16.0.19725.20522 / 2019 16.0.10417.20198 / 2016 16.0.5565.1001. Because this flaw requires authentication, also check which accounts can reach the farm and whether any of them have been compromised. Given the forensic-triage flag in the KEV entry, unpatched servers that were reachable over the past six weeks deserve a look for signs of compromise, not just a patch.

• On-premises SharePoint Server 2016, 2019 and Subscription Edition farms that don't have the August 11, 2026 update are exposed to an actively exploited, authenticated code-execution flaw, even though Microsoft still marks it as not exploited.
• WSO2 API Manager 4.1.0–4.6.0 and API Control Plane, Traffic Manager and Universal Gateway 4.5.0–4.6.0 need to be checked component by component against WSO2's fixed update levels.
• Adobe Commerce, Commerce B2B and Magento Open Source stores must be on the latest -p release for their branch before the APSB26-92 isolated patch will apply.
• Magento operators who patched late should investigate customer-account access as well as admin activity, because CVE-2026-71362 hijacks customer sessions.
• MikroTik RouterOS devices should run 6.49.21, 7.23.4, 7.24.2 or later, and any SSH service opened to the internet should be restricted to trusted IPs or placed behind a VPN.
• If your patch triage depends on vendor severity labels or "exploited" flags, add the KEV catalog as a separate input, because both labels were out of date here.

All four vendors had fixes out before attackers got going. CISA's catalog is now the clearest sign that a patch can't wait. Federal agencies must finish the WSO2 and Adobe work by September 27 and the SharePoint and RouterOS work by September 28. For everyone else, the useful lesson is procedural: CVE-2026-65660 went from a moderate spoofing label to a KEV-listed code-execution bug in about six weeks, so patch priorities based only on the severity in the original advisory need a second input.