CISA's Latest KEV Additions Put WSO2, Adobe Commerce, SharePoint, and MikroTik on a Short Clock

CISA's Latest KEV Additions Put WSO2, Adobe Commerce, SharePoint, and MikroTik on a Short Clock

CISA's newest Known Exploited Vulnerabilities update is a useful reminder that active exploitation rarely stays neatly inside one technology stack. The latest additions span API management, ecommerce, collaboration software, and network infrastructure: WSO2 products, Adobe Commerce and Magento, Microsoft SharePoint, and MikroTik RouterOS.

That mix matters for defenders because each product family tends to sit near sensitive trust boundaries. WSO2 deployments often broker APIs and identity flows. Adobe Commerce and Magento hold customer and transaction context. SharePoint is a collaboration layer with documents, workflows, and internal business data. MikroTik RouterOS sits at the network edge, where management exposure can quickly become operational exposure.

This is why the main action is not just "read the CVEs." It is to identify whether these products exist in your environment, whether they are internet-facing or reachable from lower-trust networks, and whether logs show suspicious activity before and after patching. Once a flaw enters KEV, defenders should treat it as an exploitation-backed vulnerability, not a theoretical backlog item.

What CISA Added

CISA's catalog currently lists four recent entries tied to this cluster:

• CVE-2026-5430 in WSO2 multiple products, added on September 24, 2026, with a September 27 due date for covered federal systems. CISA describes the issue as affecting WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway. WSO2's own advisory describes JWT authentication bypass where an unsupported signing algorithm can allow unauthorized access, with potential compromise of administrative accounts and full account takeover.
• CVE-2026-71362 in Adobe Commerce and Magento, added on September 24, 2026, also with a September 27 due date. CISA describes it as an incorrect authorization issue that can let an attacker gain elevated access to sensitive resources without user interaction. Canada's Cyber Centre also updated its Adobe advisory to note exploitation in the wild and CISA's KEV listing.
• CVE-2026-65660 in Microsoft SharePoint, added on September 25, 2026, with a September 28 due date. CISA describes it as a code injection flaw that could allow an authorized attacker to execute code over a network.
• CVE-2026-67279 in MikroTik RouterOS, added on September 25, 2026, with a September 28 due date. CISA says the flaw can allow an unauthenticated client to open a session channel and send an exec request, and that it can be chained with CVE-2026-86060. MikroTik's September advisory urges upgrades and warns operators to keep SSH away from untrusted networks.

The exact technical shape differs across products, but the operational pattern is consistent: these are systems where access control, authentication, authorization, or code execution boundaries are under pressure.

Why This Is More Than Another Patch Alert

KEV additions compress decision time. Security teams can debate CVSS prioritization for a long list of newly disclosed bugs, but once a CVE is in KEV, the prioritization signal changes: there is evidence of real-world exploitation.

For WSO2 and Adobe Commerce, the immediate concern is business logic and identity abuse. API platforms and commerce platforms often hold tokens, customer data, administrative workflows, and integrations with payment, CRM, or fulfillment systems. A successful compromise may not look like a noisy malware outbreak. It may look like a legitimate session, a manipulated order flow, a new admin path, or an unexpected integration call.

For SharePoint, the risk is different but just as practical. Even when exploitation requires authorization, many organizations have broad internal access patterns. A compromised account can turn an "authorized attacker" condition into a realistic pathway for code execution, document access, or lateral movement.

For MikroTik RouterOS, the key issue is exposure management. Network devices are often left in place for years, and management interfaces can drift into reachable states through emergency changes, VPN reshaping, remote support, or undocumented exceptions. MikroTik's advisory specifically calls out SSH exposure and recommends restricting management access to trusted IPs or using a VPN such as WireGuard.

What Defenders Should Do Today

Start with asset resolution. Search for WSO2 API Manager, API Control Plane, Traffic Manager, and Universal Gateway; Adobe Commerce, Adobe Commerce B2B, and Magento Open Source; Microsoft SharePoint; and MikroTik RouterOS. Give special priority to internet-facing systems, externally reachable admin panels, and systems reachable from partner or user networks.

Then apply vendor fixes or mitigations. WSO2 advises applying the relevant public fixes or moving to an unaffected version. Adobe's advisory covers Commerce and Magento Open Source versions affected by the August security bulletin, with the Canadian Cyber Centre confirming that CVE-2026-71362 has now been added to KEV. MikroTik says fixes are included in RouterOS 7.25 beta 3, 7.24.2, 7.23.4, and 6.49.21, and recommends upgrading even for home users.

After patching, review for signs of prior abuse:

• For WSO2, inspect authentication failures, JWT validation errors, unexpected admin activity, new users, changed roles, and unusual API gateway behavior.
• For Adobe Commerce and Magento, review admin account changes, unusual customer session behavior, suspicious order or payment workflow changes, and newly modified code or extensions.
• For SharePoint, inspect suspicious authenticated activity, unexpected script execution paths, unusual file modifications, and accounts that recently gained elevated permissions.
• For MikroTik, check for "Flagged" status, unknown scripts, unknown users, configuration changes, exposed SSH, and management access from unfamiliar sources.

Finally, move these systems into short-term heightened monitoring. Patch completion is necessary, but it does not prove the system was clean before the patch. For KEV-listed issues, the safer sequence is patch, investigate, rotate credentials or tokens where exposure is plausible, and keep detection tuned for delayed follow-on activity.

The Takeaway

This KEV update is broad, but not random. It touches the places attackers like to use as leverage: identity gateways, commerce platforms, collaboration systems, and network management planes. Treat the update as a prompt to validate inventory and exposure, not just to close tickets.

When a zero-day or recently exploited weakness moves into KEV, the question becomes practical: which reachable assets can an attacker use before your team finishes normal patch cycles? Answer that first, and the remediation order becomes much clearer.

References

1. CISA Known Exploited Vulnerabilities Catalog JSON
2. Security Advisory WSO2-2026-5328/CVE-2026-5430
3. Adobe security advisory AV26-808 - Update 2
4. September 2026 vulnerability
5. CISA warns of SharePoint, WSO2, Adobe Commerce flaws exploited in attacks