Exploited in August and September 2026: 74 flaws added, from SharePoint to RouterOS
CISA added 31 in August and 43 in September, across SharePoint, SonicWall SMA1000, Adobe Commerce and Magento, Citrix NetScaler and WordPress.
Threat intelligence
Covers to 30 Sep 2026
Lead source CISA, Known Exploited Vulnerabilities Catalog (release 2026.10.23)
The two months in the catalogue
A listing in the catalogue means CISA has evidence of exploitation in the wild. Of the 74 entries added in August and September, 10 carry CVE identifiers from 2025 or earlier. CISA marks two as known to be used in ransomware campaigns: VMware vCenter CVE-2026-59310 and JetBrains TeamCity CVE-2026-63077.
Added: 7 Aug
- Product
- Progress LoadMaster
- CVE
- CVE-2026-8037
- Flaw
- Unauthenticated command injection
Added: 18 Aug
- Product
- Microsoft SharePoint
- CVE
- CVE-2026-55040
- Flaw
- Weak authentication, security feature bypass
Added: 18 Aug
- Product
- VMware vCenter
- CVE
- CVE-2026-59310
- Flaw
- Path traversal, ransomware use known
Added: 26 Aug
- Product
- Citrix NetScaler ADC and Gateway
- CVE
- CVE-2026-8452
- Flaw
- Memory buffer flaw
Added: 2 Sep
- Product
- SonicWall SMA1000
- CVE
- CVE-2026-83548, CVE-2026-83549
- Flaw
- Unauthenticated request forgery, admin command injection
Added: 8 Sep
- Product
- Adobe Commerce and Magento
- CVE
- CVE-2026-75650
- Flaw
- Template injection to code execution
Added: 10 Sep
- Product
- MikroTik RouterOS
- CVE
- CVE-2026-86060, CVE-2026-67277
- Flaw
- Privilege escalation, unauthenticated memory disclosure
Added: 11 Sep
- Product
- ConnectWise ScreenConnect
- CVE
- CVE-2026-84869
- Flaw
- File transfer and execution without host confirmation
Added: 24 Sep
- Product
- Adobe Commerce and Magento
- CVE
- CVE-2026-71362
- Flaw
- Incorrect authorisation
Added: 25 Sep
- Product
- Microsoft SharePoint
- CVE
- CVE-2026-65660
- Flaw
- Code injection by an authorised user
Added: 25 Sep
- Product
- WordPress Core
- CVE
- CVE-2026-87902
- Flaw
- Unauthenticated file inclusion to code execution
Added: 25 Sep
- Product
- MikroTik RouterOS
- CVE
- CVE-2026-67279
- Flaw
- Unauthenticated exec request, chains with CVE-2026-86060
| Added | Product | CVE | Flaw |
|---|---|---|---|
| 7 Aug | Progress LoadMaster | CVE-2026-8037 | Unauthenticated command injection |
| 18 Aug | Microsoft SharePoint | CVE-2026-55040 | Weak authentication, security feature bypass |
| 18 Aug | VMware vCenter | CVE-2026-59310 | Path traversal, ransomware use known |
| 26 Aug | Citrix NetScaler ADC and Gateway | CVE-2026-8452 | Memory buffer flaw |
| 2 Sep | SonicWall SMA1000 | CVE-2026-83548, CVE-2026-83549 | Unauthenticated request forgery, admin command injection |
| 8 Sep | Adobe Commerce and Magento | CVE-2026-75650 | Template injection to code execution |
| 10 Sep | MikroTik RouterOS | CVE-2026-86060, CVE-2026-67277 | Privilege escalation, unauthenticated memory disclosure |
| 11 Sep | ConnectWise ScreenConnect | CVE-2026-84869 | File transfer and execution without host confirmation |
| 24 Sep | Adobe Commerce and Magento | CVE-2026-71362 | Incorrect authorisation |
| 25 Sep | Microsoft SharePoint | CVE-2026-65660 | Code injection by an authorised user |
| 25 Sep | WordPress Core | CVE-2026-87902 | Unauthenticated file inclusion to code execution |
| 25 Sep | MikroTik RouterOS | CVE-2026-67279 | Unauthenticated exec request, chains with CVE-2026-86060 |
What to do with the list
Match the catalogue against an inventory of what the business runs, starting with anything reachable from the internet. Internet-facing systems with a known exploit carry the Essential Eight's shortest patch window, 48 hours.
- Confirm internet-facing SharePoint, SMA1000, NetScaler and RouterOS devices run fixed builds
- Update WordPress core and Adobe Commerce, including sites run by an agency
- Confirm remote support tools such as ScreenConnect run a fixed build, or remove them
- Review each patched device for signs of access before the update
Sources
- PrimaryCISA, Known Exploited Vulnerabilities Catalog (release 2026.10.23)Retrieved 25 Oct 2026
