CTI · reviewed · 2026-09-27

CISA adds exploited WSO2, Adobe Commerce, SharePoint and RouterOS flaws to KEV catalog

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1606 Forge Web Credentials Credential Access
• T1100 Web Shell Persistence

Indicators

Observables tied to this case, from the curated feed. raw sidecar

• cybersecurefox.com domain · active · corroborated
• sphealth.aspx domain · active

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: SharePoint Server Exploitation Attempts via AddGallery Endpoint CVE-2026-65660
id: 2c360909-4b18-48c7-b3c8-f16abfb6056f
status: experimental
description: Detects two-stage exploitation attempts against the SharePoint Server code injection flaw CVE-2026-65660 added to the CISA KEV catalog, looking for AddGallery.aspx or designgallery.aspx requests carrying DisplayMode=Edit, and access to the sphealth.aspx webshell path reported in the wild.
references:
  - https://blog.previdian.com/cve-2026-65660-previdian-observes-two-stage-sharepoint-exploitation-attempts/
  - https://www.bleepingcomputer.com/news/security/cisa-warns-of-sharepoint-wso2-adobe-commerce-flaws-exploited-in-attacks/
  - https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-65660
author: Tia N. List
date: 2026/09/27
tags:
  - attack.t1190
  - attack.t1100
  - attack.initial-access
  - attack.persistence
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri|contains:
      - '/_layouts/15/AddGallery.aspx'
      - 'designgallery.aspx'
  selection_param:
    cs-uri|contains: 'DisplayMode=Edit'
  selection_shell:
    cs-uri|contains: 'sphealth.aspx'
  condition: (selection_path and selection_param) or selection_shell
falsepositives:
  - Legitimate page editing in SharePoint authoring workflows
  - Security scanners probing for the reported webshell path
level: high

References

• https://www.bleepingcomputer.com/news/security/cisa-warns-of-sharepoint-wso2-adobe-commerce-flaws-exploited-in-attacks/
• https://thehackernews.com/2026/09/sharepoint-rce-and-mikrotik-routeros.html
• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-65660
• https://blog.previdian.com/cve-2026-65660-previdian-observes-two-stage-sharepoint-exploitation-attempts/
• https://www.cve.org/CVERecord?id=CVE-2026-65660