Reported by 21 outlets
CISA adds exploited WSO2, Adobe Commerce, SharePoint and RouterOS flaws to KEV catalog
Why this score
- Breadth
- 2.00 / 2.0 · 21 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.60 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.40 / 1.5 · reddit signal
- Score
- 0.4 / 10 = base × recency + community
Desk analysis
CISA's late-September KEV batch confirms four vulnerabilities are being exploited in the wild, with the September 29 update formally adding CVE-2026-5430 and CVE-2026-71362 to the catalog. CVE-2026-5430 is a maximum-severity authentication bypass in WSO2 products where the JWT mechanism accepts tokens signed with an unsupported algorithm, affecting API Manager 4.1.0 through 4.6.0 plus API Control Plane, Traffic Manager, and Universal Gateway 4.5.0 and 4.6.0; the May 3 vendor advisory says successful exploitation compromises administrative accounts and yields full control. CVE-2026-71362 is a critical Adobe Commerce flaw. The two critical additions carry a September 27 remediation deadline for federal agencies, and CISA gave no attack details for either.
The other two additions are equally operational. SharePoint CVE-2026-65660, a CWE-94 code injection fixed in Microsoft's August 11, 2026 updates with a CVSS of 8.8 after revision from a moderate spoofing rating, moved to KEV on September 25 after Viettel Security published technical details. Microsoft confirmed observed attacks as of September 25, Previdian saw exploitation attempts on September 24 and web shell creation attempts on September 25 including two-stage deployment against sites permitting anonymous access, and Canada's Cyber Centre warns the flaw chains with other SharePoint bugs for pre-authentication impact. MikroTik CVE-2026-67279 is a pre-authentication SSH state-machine bypass added the same day, with reports of routers taken over without credentials.
The pattern worth noting is timing: the SharePoint wave began roughly six weeks after patches and days after researcher disclosure, the classic patch-gap window. The affected products are backbone infrastructure: identity gateways (WSO2), commerce platforms (Adobe Commerce), document servers (SharePoint), and edge routers (RouterOS). Watch for named victims from the WSO2 and Adobe Commerce exploitation since CISA provided none, and for whether the MikroTik SSH bypass shows up in botnet recruitment.
Timeline
-
original reporting
CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks
bleepingcomputer.com · 18d ago · September 25th, 2026
The Cybersecurity and Infrastructure Security Agency (CISA) warns that hackers are exploiting a critical authentication bypass vulnerability (CVE-2026-5430) affecting multiple products from enterprise software provider WSO2. The agency also added CVE-2026-71362, another critical-severity flaw affecting Adobe Commerce, to the list of security issues being leveraged in attacks. Hackers are also exploiting two additional vulnerabilities: a high-severity code injection flaw in Microsoft SharePoint tracked as CVE-2026-65660, and a medium-severity pre-authentication SSH state-machine/workflow bypass in Mikrotik RouterOS identified as CVE-2026-67279. For the two critical issues added to the Known Exploited Vulnerabilities ( KEV ) catalog, federal agencies using the affected products have until Sunday, September 27, to apply the recommended updates or mitigations, or discontinue their use. The CVE-2026-5430 flaw received a maximum severity score and impacts WSO2 API Manager versions 4.1.0 through 4.6.0, API Control Plane, Traffic Manager, and Universal Gateway versions 4.5.0 and 4.6.0. In the original advisory on May 3 , the vendor says that an attacker successfully exploiting the vulnerability could compromise administrative accounts and take full control. The problem stems from the JWT authentication mechanism accepting tokens signed with an unsupported algorithm. CISA has not shared any details about the attacks, but security firm watchTowr announced on September 15 announced that
-
update from msrc.microsoft.com
Microsoft SharePoint Server Remote Code Execution Vulnerability (MSRC advisory for CVE-2026-65660)
msrc.microsoft.com · 64d ago · August 11th, 2026
The vendor advisory, released August 11, 2026 (page shows the date only), with a revision log showing v1.1 on August 27, 2026 updated the Impact column in the Security Updates table, the CVE title, and the FAQs. The current page rates the flaw CWE-94 code injection with impact Remote Code Execution, max severity Important, CVSS 3.1 base 8.8 and temporal 7.7 (vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and the exploitability assessment recorded at original publication reads Publicly Disclosed: No, Exploited: No, Exploitation Less Likely. The update table lists KB 5002893 for SharePoint Server Subscription Edition (build 16.0.19725.20522), KB 5002894 and KB 5002896 for SharePoint Server 2019 (build 16.0.10417.20198), and KB 5002905 and KB 5002906 for SharePoint Enterprise Server 2016 (build 16.0.5565.1001), all released August 11, 2026, and acknowledges khoadha (@_l0gg).
-
update from github.com
GHSA-r94x-x846-rxqx: the original spoofing classification of CVE-2026-65660 frozen in the NVD-fed advisory record
github.com · 64d ago · August 11th, 2026
The GitHub Advisory Database record for CVE-2026-65660, published by the National Vulnerability Database on August 11, 2026 and last updated the same day, preserves the original classification the story is about: CWE-94 code injection that allows an authorized attacker to perform spoofing over a network, rated Moderate at CVSS 6.5 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, showing no integrity or availability impact. The record carries EPSS 0.807 percent at the 55th percentile and cites the MSRC advisory as its reference. This frozen text documents the low-severity label that the August 27 advisory revision and the September researcher disclosure reversed.
-
update from securityonline.info
CVE-2026-71362 Exploited: Adobe Commerce Account Takeover, Details and PoC are Public
securityonline.info · 47d ago · August 28th, 2026
This August 28, 2026 report states attackers began targeting CVE-2026-71362 within hours of disclosure, that root-cause details and a working PoC path are public, and that Sansec blocked live exploitation attempts soon after Adobe's advisory. The mechanism is a failed account edit storing attacker input that is later copied back unfiltered, letting a supplied id value overwrite the session's customer id while the session check never verifies ownership. The article cites 30-day EPSS at 89.6 percent and suggests a WAF rule blocking mass-assigned id values on the customer edit and create endpoints.
-
update from blog.viettelcybersecurity.com
SharePoint CVE-2026-65660: From Anonymous Access to Pre-Auth RCE via EditingPageParser Type-Check Bypass (Viettel Cyber Security)
blog.viettelcybersecurity.com · 22d ago · September 22nd, 2026
The original researcher disclosure by khoadha (Dinh Ho Anh Khoa) of Viettel Cyber Security, timestamped 2026-09-22T03:03:00Z in the page metadata, roughly eleven hours before the earliest coverage in this story. The writeup chains CVE-2026-65660 with a ToolPane placement trick that reaches the vulnerable parser on any page inheriting WebPartPage with a WebPartZone, states anonymous exploitation works on web applications that allow anonymous page viewing (a standard internet-facing setup), and notes the memshell request lands on AddGallery.aspx rather than ToolPane.aspx. It demonstrates a fileless in-memory webshell via XamlServices.Parse() with ExpandedWrapper, ObjectDataProvider, and a LosFormatter-serialized ysoserial ActivitySurrogate payload, states the technique had already been used in real projects, and adds that the August 11, 2026 patch disables ToolPane.GetPartPreviewAndPropertiesFromMarkup() by default while alternate template-parsing entry points such as GetWebPartPageConnectionInfo of WebPartPagesWebService remain, and that an unreported ToolPane authentication bypass was fixed in the June 9, 2026 patch.
-
update from thecybersecguru.com
CVE-2026-65660 is a good example of why vulnerability labels deserve scrutiny. Microsoft initially classified the SharePoint flaw as a spoof
thecybersecguru.com · 21d ago · September 22nd, 2026
CVE-2026-65660 is a good example of why vulnerability labels deserve scrutiny. Microsoft initially classified the SharePoint flaw as a spoof
via Mastodon https://thecybersecguru.com/news/cve-2026-65660-sharepoint-rce/
-
update from cyberpress.org
Microsoft SharePoint Flaw Lets Low-Privilege Attackers Execute Remote Code
cyberpress.org · 21d ago · September 23rd, 2026
Microsoft has confirmed that a SharePoint Server vulnerability originally logged as a low-severity spoofing issue is, in fact, a high-severity remote code execution flaw that low-privileged, authenticated attackers can exploit to run arbitrary code on affected servers. The vulnerability, tracked as CVE-2026-65660, carries a CVSS score of 8.8 and stems from a code-injection weakness (CWE-94) in how SharePoint validates server-side controls against its SafeControls allowlist. Microsoft SharePoint Flaw GetPartPreviewAndPropertiesFromMarkup(), a function that parses Web Part markup submitted through pages such as AddGallery.aspx. SharePoint separates incoming markup into a “Register” block and a “Tag” block, verifying each independently with EditingPageParser.VerifyControlOnSafeList(). The flaw sits in the RegisterDirective.GetHtml() method, which writes attribute values into the reconstructed markup without escaping embedded quote characters. Because an attacker can smuggle unescaped double and single quotes inside an attribute like Src, they can break out of the intended directive and inject a second, attacker-controlled Register directive containing an arbitrary .NET namespace, splitting the payload across both markup blocks so that neither individual check catches the full malicious string. Once the injected directive slips past validati
-
update from gbhackers.com
Microsoft SharePoint Flaw Lets Low-Privilege Attackers Execute Remote Code
gbhackers.com · 20d ago · September 23rd, 2026
Viettel Cyber Security researcher Dinh Ho Anh Khoa reported […] The post Microsoft SharePoint Flaw Lets Low-Privilege Attackers Execute Remote Code appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from blog.previdian.com
Previdian: CVE-2026-65660 two-stage SharePoint exploitation attempts observed
blog.previdian.com · 20d ago · September 24th, 2026
Previdian's honeypot captured 12 POST requests exploiting CVE-2026-65660 around 12:00 UTC on September 24, 2026 from 169.150.248[.]21, targeting /_layouts/15/AddGallery.aspx and designgallery.aspx with DisplayMode=Edit and pairing an anonymous delivery bug with Viettel's SafeControls quote-injection technique. Payloads disable the .NET ActivitySurrogate type check and carry an embedded wt3k3sij.dll assembly with an SdLoader; a September 25 update adds a webshell backdoor at /_layouts/15/sphealth.aspx and DLL SHA-256 hashes.
-
update from malware.news
AL26-023 - Vulnerability Impacting Microsoft SharePoint Server - CVE-2026-65660
malware.news · 19d ago · September 24th, 2026
Number: AL26-023 Date: September 24, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested. In response to the Microsoft security advisory, released on August 11, 2026 Footnote 2 , the Cyber Centre issued AV26-804 Update 3 Footnote 3 on September 24, 2026.
-
update from euvd.enisa.europa.eu
🚨 EUVD-2026-56431 📊 Score: 8.8/10 (CVSS v3.1) 📦 Product: Microsoft SharePoint Server 2019, Microsoft SharePoint Enterprise Server 2016, Micr
euvd.enisa.europa.eu · 19d ago · September 24th, 2026
🚨 EUVD-2026-56431 📊 Score: 8.8/10 (CVSS v3.1) 📦 Product: Microsoft SharePoint Server 2019, Microsoft SharePoint Enterprise Server 2016, Micr
via Mastodon https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-56431
-
mentioned by www.cve.org
CVE-2026-65660 is a code injection flaw in Microsoft SharePoint Server 2016, 2019, and Subscription Edition, letting an authenticated attack
www.cve.org · 19d ago · September 25th, 2026
-
update from securityonline.info
An exploited SharePoint RCE vulnerability is under attack. Technical details for this SharePoint RCE vulnerability are public. Patch CVE-202
securityonline.info · 18d ago · September 25th, 2026
An exploited SharePoint RCE vulnerability is under attack. Patch CVE-202
via Mastodon https://securityonline.info/exploited-sharepoint-rce-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social
-
mentioned by blog.previdian.com
(blog.previdian.com) Two-Stage SharePoint Exploitation Attempts Targeting CVE-2026-65660: Analysis of Pre-Authentication RCE Chain and Websh
blog.previdian.com · 18d ago · September 25th, 2026
-
mentioned by go.dhs.gov
We added Microsoft SharePoint vulnerability CVE-2026-65660 & Mikrotik RouterOS vulnerability CVE-2026-67279 to our KEV Catalog. Visit https:
go.dhs.gov · 18d ago · September 25th, 2026
-
mentioned by thehackernews.com
🤖 CISA KEV: Microsoft SharePoint CVE-2026-65660 (CVSS 8.8, code injection) is now exploited in the wild. Microsoft first rated it a spoofing
thehackernews.com · 17d ago · September 26th, 2026
-
mentioned by www.yazoul.net
🔵 THREAT INTELLIGENCE WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV Vulnerability | CRITICAL CVEs: CVE-2026-5430 The
www.yazoul.net · 17d ago · September 26th, 2026
-
update from securityweek.com
Microsoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attacks
securityweek.com · 16d ago · September 27th, 2026
A Microsoft SharePoint vulnerability tracked as CVE-2026-65660 is now being exploited in attacks, roughly six weeks after Microsoft announced patches and a couple of days after researchers disclosed technical details. Early-warning threat intelligence platform Previdian (formerly KEVIntel) reported seeing exploitation attempts on September 24. It’s unclear who is behind the attacks, which appear to have started shortly after Viettel Security, whose researchers reported the vulnerability to Microsoft, disclosed technical details .
-
mentioned by cyber.netsecops.io
📰 CISA Adds SharePoint, MikroTik Bugs to Known Exploited List CISA adds two actively exploited vulnerabilities to its KEV catalog: a SharePo
cyber.netsecops.io · 16d ago · September 27th, 2026
-
update from dev.to
SharePoint CVE-2026-65660: Two-Stage Web Shell Deployment Attempts on Sites Allowing Anonymous Access # security # threatintel # software #
dev.to · 15d ago · September 28th, 2026
SharePoint CVE-2026-65660: Two-Stage Web Shell Deployment Attempts on Sites Allowing Anonymous Access # security # threatintel # software #
via Mastodon https://dev.to/anoymask/sharepoint-cve-2026-65660-two-stage-web-shell-deployment-attempts-on-sites-allowing-anonymous-3fbd
-
update from www.rescana.com
Reward: Ticket closed. Marked "resolved by vendor." You are not resolved. https://www. rescana.com/post/microsoft-sha repoint-server-cve-202
www.rescana.com · 15d ago · September 28th, 2026
Reward: Ticket closed. Marked "resolved by vendor." You are not resolved. https://www.
-
mentioned by cybersecurefox.com
CVE-2026-5430 and CVE-2026-71362 Added to CISA KEV Catalog 🔗 https:// cybersecurefox.com/en/cisa-kev -wso2-cve-2026-5430-adobe-commerce-cve-
cybersecurefox.com · 14d ago · September 29th, 2026
-
mentioned by cybersecurefox.com
CISA adds SharePoint and MikroTik RouterOS vulnerabilities to KEV catalog 🔗 https:// cybersecurefox.com/en/cisa-kev -sharepoint-mikrotik-rou
cybersecurefox.com · 13d ago · September 30th, 2026