CISA Adds SharePoint, WSO2, Adobe Commerce to KEV

September 26, 2026 · Senserva Trustworthy AI

Senserva Watch

Join Senserva Watch and get Three Free Unlimited Audits with our full Claude MCP, a fresh audit credit every quarter, alerts when a CVE or KB you follow changes, critical security updates when they land, the Patch Tuesday wire on release day, and 20% off when you buy.

Join Senserva Watch

One email address. No tenant connection, no agent, no call.

CISA adds SharePoint, WSO2, and Adobe Commerce to the KEV catalog

Over September 24 and 25, CISA added five actively exploited vulnerabilities to the Known Exploited Vulnerabilities catalog. The one closest to home for Microsoft shops is CVE-2026-65660, a Microsoft SharePoint code injection vulnerability added on September 25. If you run on-premises SharePoint, this moves from patch eventually to patch now.

The other four span common internet-facing software. CVE-2026-5430 is a WSO2 path traversal flaw rated CVSS 10 and was added on September 24. CVE-2026-71362 is an Adobe Commerce and Magento incorrect authorization vulnerability at CVSS 9.1, also added September 24 and now the top hot mover with an EPSS score around 0.90. Rounding out the additions are CVE-2026-67279 in MikroTik RouterOS and CVE-2026-87902, a WordPress Core remote file inclusion flaw at CVSS 8.1. BleepingComputer and the CISA advisories confirm all five are being exploited in the wild.

The wider exploitation picture

Beyond the fresh adds, the hot list is dominated by critical KEV entries. Two are explicitly ransomware-linked: CVE-2026-41940 in WebPros cPanel and WHM (CVSS 9.8, EPSS 0.9853) and CVE-2026-0257, a Palo Alto Networks PAN-OS authentication bypass (CVSS 9.1, EPSS 0.9638). Those two deserve priority alongside the KEV adds.

CISA also warned about multiple Check Point product vulnerabilities exploited in attacks, covering CVE-2026-93616 and CVE-2026-85102. GitLab Community and Enterprise Edition path traversal CVE-2026-85102 companions the separately reported GitLab CI/CD code execution bugs CVE-2026-89078 and CVE-2026-93577. F5 BIG-IP APM CVE-2026-94127 and Arista VeloCloud Orchestrator CVE-2026-93952 also carry critical ratings and KEV status.

What the press adds on Microsoft and identity

Two Microsoft identity stories are worth tracking even though no CVE is attached. Researchers reported a Microsoft authentication vulnerability said to expose a very large store of records, and a separate report that the Microsoft password reset portal could reveal whether users exist and whether MFA is enabled. Neither has a patch KB in today's facts, but both affect the Entra ID attack surface.

Microsoft's own blog detailed Storm-3168, an actor running agentic cloud attacks using compromised service principals. That is a direct reminder to review service principal permissions and credentials in your tenant. Microsoft also confirmed recent Windows updates causing black screens and desktop loading issues, so validate the current cumulative updates in a ring before broad deployment.

On the Windows patch side, the top KEV-flagged cumulative updates include KB5046616 for Windows Server 2022 (37 CVEs) and KB5046617, KB5046615, and KB5046612 for Windows 10 Version 1809.

Do this first

Prioritize by exploitation status, not just CVSS. The KEV adds and ransomware-linked entries are the ones attackers are already using.

Patch on-premises SharePoint for CVE-2026-65660 and confirm exposure of any WSO2, Adobe Commerce, MikroTik, or WordPress instances against the new KEV entries.
Treat CVE-2026-41940 (cPanel/WHM) and CVE-2026-0257 (PAN-OS) as urgent given their ransomware links and high EPSS.
Review service principal credentials and permissions in Entra ID in response to the Storm-3168 report.
Stage the latest Windows cumulative updates and watch for the black screen and desktop loading issue before wide rollout.
Use Senserva's free Microsoft Patch Tracker to rank your open Microsoft patches by KEV, EPSS, and ransomware linkage, and the non-Microsoft exploited-CVE tracker to follow daily KEV additions.

Sources

BleepingComputer: CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks (2026-09-25)
CISA Cybersecurity Advisories: CISA Adds One Known Exploited Vulnerability to Catalog (2026-09-25)
CISA Cybersecurity Advisories: CISA Adds Two Known Exploited Vulnerabilities to Catalog (2026-09-25)
CISA Cybersecurity Advisories: CISA Adds Two Known Exploited Vulnerabilities to Catalog (2026-09-24)
Cyber Security News: CISA Warns of Multiple Check Point Product Vulnerabilities Exploited in Attacks (2026-09-25)
Cyber Security News: Microsoft Password Reset Portal Could Reveal Users and MFA Protection Details (2026-09-25)
Microsoft Security Blog: Storm-3168: Agentic-driven cloud attacks using compromised service principals (2026-09-25)
Cyber Security News: Microsoft Confirms Windows 11 Update Bug Causing Black Screens and Loading Issues (2026-09-25)
BleepingComputer: Microsoft: Recent Windows updates cause desktop loading issues (2026-09-25)
Cyber Security News: Critical GitLab Bugs Let Attackers Execute Code Through Malicious CI/CD Regex (2026-09-25)

Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-09-26.

Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.