Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

WSO2, Adobe Commerce, SharePoint, and RouterOS active exploitation wave

Exploitation Wave
First reported
Last updated
Happening score
H score 34
2 unique sources, 2 articles

Summary

Hide ▲

CISA says attackers are actively exploiting four vulnerabilities across WSO2, Adobe Commerce, Microsoft SharePoint, and Mikrotik RouterOS, creating a broad exposure window for internet-facing enterprise systems. The wave includes CVE-2026-5430, CVE-2026-71362, CVE-2026-65660, and CVE-2026-67279, spanning authentication bypass, incorrect authorization, code injection, and pre-auth SSH workflow bypass flaws. CISA placed the two critical issues in the KEV catalog and set mitigation deadlines of September 27 for the critical bugs and September 28 for the SharePoint and RouterOS flaws.

Related Happenings

CISA MikroTik RouterOS mitigation guidance for CVE-2026-84411

Advisory/Mitigation
H score28 First: 30.09.2026 18:49 Last: 30.09.2026 18:49 Sources 1

About this happening: CISA issued mitigation guidance for MikroTik RouterOS operators affected by CVE-2026-84411, a pre-authentication integer underflow that can enable root code...

Open Happening

MikroTik RouterOS SSH exploitation wave

Exploitation Wave
H score8 First: 06.09.2026 12:32 Last: 06.09.2026 12:32 Sources 1

How related: The second vulnerability to be added to the KEV catalog is CVE-2026-67279, which has been chained along with CVE-2026-86060, an argument injection flaw in the RouterOS login process, as part of an exploit codenamed MikroTrick.

About this happening: MikroTik RouterOS SSH exploitation is using the MikroTrick chain, where CVE-2026-67279 and CVE-2026-86060 combine to give attackers full administrative control...

Latest development: 23.09.2026 19:06

CERT Polska details the MikroTrick chain on MikroTik RouterOS SSH, combining CVE-2026-67279 with CVE-2026-86060 to let attackers reach full administrative control on Internet-exposed routers without a password or SSH key. Attack logs date to at least September 2, CISA added CVE-2026-86060 to its Known Exploited Vulnerabilities catalog on September 10, and CERT Polska says some writeups incorrectly included CVE-2026-67276.

Open Happening

Cisco security patch release for CVE-2026-20188

Security Patch Release
H score35 First: 06.05.2026 21:06 Last: 06.05.2026 21:06 Sources 1

About this happening: Cisco released security updates for CVE-2026-20188, a high-severity DoS vulnerability in Crosswork Network Controller (CNC) and Network Services Orchestrator (NS...

Open Happening

Federal civilian executive branch agency hit by network compromise

Incident
H score21 First: 24.04.2026 23:34 Last: 24.04.2026 23:34 Sources 1

About this happening: A federal civilian executive branch agency was compromised in an early September 2025 intrusion that left attackers with persistent access on Cisco Firepower and Sec...

Open Happening

Cisco ASA/FTD code execution and authentication bypass flaws (multiple vulnerabilities)

Vulnerability
H score88 First: 24.04.2026 20:06 Last: 24.04.2026 20:06 Sources 1

About this happening: Cisco ASA/FTD vulnerabilities CVE-2025-20333 and CVE-2025-20362 are still under active exploitation and can be chained for unauthenticated remote control of af...

Open Happening

Timeline

  1. 25.09.2026 20:24 3 articles · 14d ago

    CISA adds WSO2 and Adobe Commerce flaws to KEV amid active exploitation

    Legal Policy Action Update

    CISA warned that hackers are exploiting CVE-2026-5430 in WSO2 products, CVE-2026-71362 in Adobe Commerce, CVE-2026-65660 in Microsoft SharePoint, and CVE-2026-67279 in Mikrotik RouterOS. The agency placed the two critical issues in the Known Exploited Vulnerabilities catalog and told federal agencies to apply updates or mitigations for those flaws by September 27, while SharePoint and RouterOS remediation is due September 28.

    Show sources
    Open in new tab
  2. 15.09.2026 03:00 1 articles · 24d ago

    Forged JWT attempts target the wrong WSO2 product

    Exploitation Observed

    watchTowr said its honeypots captured a limited number of exploitation attempts from one IP address on September 13 using forged JWT tokens against a WSO2 product, and the attacker targeted the wrong product for CVE-2026-5430.

    Show sources
    Open in new tab