CISA Adds SharePoint and Adobe Commerce Flaws to KEV

September 25, 2026 · Senserva Trustworthy AI

Senserva Watch

Join Senserva Watch and get Three Free Unlimited Audits with our full Claude MCP, a fresh audit credit every quarter, alerts when a CVE or KB you follow changes, critical security updates when they land, the Patch Tuesday wire on release day, and 20% off when you buy.

Join Senserva Watch

One email address. No tenant connection, no agent, no call.

SharePoint code injection lands on the KEV list

CISA added CVE-2026-65660, a Microsoft SharePoint code injection vulnerability, to the Known Exploited Vulnerabilities catalog on September 25. That is the headline for Microsoft shops: a KEV entry means confirmed active exploitation, so this moves from patch eventually to patch now.

It arrived alongside a batch of other exploited flaws BleepingComputer flagged in the same reporting. On September 24, CISA also added CVE-2026-5430, a WSO2 path traversal rated CVSS 10, and CVE-2026-71362, an Adobe Commerce and Magento incorrect authorization vulnerability at CVSS 9.1. On September 25 it followed with CVE-2026-67279 in MikroTik RouterOS and CVE-2026-87902, a WordPress Core remote file inclusion flaw rated CVSS 8.1.

Exploitation picture and hot movers

The Adobe Commerce flaw CVE-2026-71362 is the top mover, now KEV-listed with an EPSS score of 0.8962. If you run Magento or Adobe Commerce storefronts, treat it as urgent.

Two entries carry ransomware linkage, which raises the stakes further. CVE-2026-41940 in WebPros cPanel and WHM sits at CVSS 9.8 with EPSS 0.9853 and is both KEV-listed and ransomware-associated. CVE-2026-0257, a Palo Alto Networks PAN-OS authentication bypass at CVSS 9.1, is also KEV-listed, ransomware-linked, and carrying EPSS 0.9638. Other critical KEV movers include CVE-2026-85706 in GitLab (CVSS 10), CVE-2026-93952 in Arista VeloCloud Orchestrator (CVSS 10), and CVE-2026-94127 in F5 BIG-IP APM.

WordPress, Check Point, and active exploitation in the press

Cyber Security News reports attackers are actively exploiting the WordPress Core flaw CVE-2026-87902 to execute malicious code, matching its same-day KEV listing. A separate WordPress Comment2Shell issue, CVE-2026-93485, lets attackers take over sites through comments.

CISA also warned of multiple Check Point product vulnerabilities exploited in attacks. Among the hot list, CVE-2026-93616 is a Check Point path traversal at CVSS 9.8 and CVE-2026-85102 is an improper certificate validation flaw, both KEV-listed. SecurityWeek notes a Roundcube Webmail vulnerability, CVE-2026-48842, is drawing attacker attention, and Kiteworks urged a six-hour server shutdown over potential zero-day activity.

Windows update issues to watch

Separate from the security patches, Microsoft confirmed recent Windows updates are causing desktop loading problems and black screens, per BleepingComputer and Cyber Security News. Factor that into your ring rollout planning so you do not confuse a known cosmetic or loading defect with something worse.

On the patch side, several critical Windows cumulative updates carry KEV-listed fixes, including KB5046616 for Windows Server 2022 covering 37 CVEs and KB5046617 for Windows 10 1809 covering 33 CVEs.

Do this first

Prioritize the confirmed exploited items over raw CVSS. In order:

Patch SharePoint for CVE-2026-65660, now KEV-listed and exploited.
Remediate Adobe Commerce and Magento CVE-2026-71362 given its high EPSS and KEV status.
Address the ransomware-linked KEV entries CVE-2026-41940 (cPanel/WHM) and CVE-2026-0257 (PAN-OS) on emergency timelines.
Update WordPress Core for CVE-2026-87902 and review Check Point, WSO2, MikroTik, GitLab, F5, and Arista exposure.
Use the free Senserva Microsoft Patch Tracker to rank your open Microsoft patches by KEV, EPSS, and ransomware linkage, and the non-Microsoft exploited-CVE tracker to follow these KEV additions.

Sources

CISA Cybersecurity Advisories: CISA Adds One Known Exploited Vulnerability to Catalog (2026-09-25)
CISA Cybersecurity Advisories: CISA Adds Two Known Exploited Vulnerabilities to Catalog (2026-09-25)
CISA Cybersecurity Advisories: CISA Adds Two Known Exploited Vulnerabilities to Catalog (2026-09-24)
BleepingComputer: CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks (2026-09-25)
Cyber Security News: Hackers Actively Exploiting WordPress Vulnerability to Execute Malicious Code (2026-09-25)
Cyber Security News: CISA Warns of Multiple Check Point Product Vulnerabilities Exploited in Attacks (2026-09-25)
SecurityWeek: Roundcube Webmail Vulnerability in Attackers’ Crosshairs (2026-09-25)
BleepingComputer: Kiteworks urges 6-hour server shutdown over potential zero-day attacks (2026-09-25)
Cyber Security News: Microsoft Confirms Windows 11 Update Bug Causing Black Screens and Loading Issues (2026-09-25)
BleepingComputer: Microsoft: Recent Windows updates cause desktop loading issues (2026-09-25)

Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-09-25.

Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.