CISA’s September 8, 2026 update to the Known Exploited Vulnerabilities Catalog adds four vulnerabilities affecting Adobe Commerce and Magento, Microsoft Windows and N-able N-central. The newly added flaws are CVE-2026-75650, an Adobe Commerce and Magento template-engine injection vulnerability; CVE-2026-81963, a Windows Update Stack link-following privilege-escalation flaw; CVE-2026-85880, a Windows Advanced Local Procedure Call heap-based buffer overflow; and CVE-2026-86218, a pre-authentication static code injection vulnerability in N-able N-central. CISA added all four because there is evidence of active exploitation. That distinction should immediately move them ahead of the enormous number of vulnerabilities disclosed every month that remain theoretical. A vulnerability scanner may show hundreds or thousands of open CVEs, but the four that attackers are already using deserve a fundamentally different response priority. 

CVE-2026-75650 is probably the most directly exposed of the four because it affects Adobe Commerce and Magento Open Source systems that are frequently reachable from the public internet. Adobe rates the vulnerability Critical with a CVSS score of 10.0 and confirms that it is being exploited in the wild. The weakness involves improper neutralization of special elements inside a template engine and can allow an unauthenticated remote attacker to achieve arbitrary code execution. Adobe has released the emergency VULN-39341 hotfix and classifies the update as Priority 1. The affected range includes multiple Adobe Commerce branches through the August 2026 releases, as well as corresponding Magento Open Source and Commerce B2B versions.

The Magento vulnerability is particularly dangerous because exploitation has already been observed producing persistent server backdoors. That changes the response from ordinary patch management into incident response. Installing the hotfix prevents the original exploit from working again, but it does not remove malicious PHP files, cron persistence, stolen API credentials or other artifacts an attacker may already have planted. Organizations that ran vulnerable Magento or Adobe Commerce systems while they were internet-accessible should therefore patch immediately and review historical web logs, recently modified application files, cron jobs, new administrator accounts, unexpected outbound connections and payment-page modifications. Credentials accessible to the application, including database passwords, payment gateway keys, API tokens and administrative secrets, should be assessed for rotation where compromise is suspected. Adobe’s own confirmation of active exploitation means defenders should not assume a successful patch automatically restores trust.

CVE-2026-81963 affects the Windows Update Stack and provides a different kind of attacker capability. Microsoft describes it as an improper link-resolution vulnerability that allows a low-privileged local attacker to elevate privileges to SYSTEM. It has a CVSS score of 7.8, substantially lower than the Magento flaw, yet Microsoft and CISA both confirm active exploitation. The vulnerability affects Windows 11 versions including 23H2, 24H2, 25H2 and 26H1, as well as Windows Server 2025.

The relatively modest 7.8 score should not lead security teams to treat CVE-2026-81963 casually. Local privilege escalation is one of the most useful components in a real-world intrusion chain. Attackers may initially obtain code execution through phishing, malicious downloads, browser compromise or stolen user credentials but remain confined to an ordinary user context. A vulnerability that converts that foothold into SYSTEM privileges allows them to disable security tools, dump credentials, install persistence, modify protected files and interact with higher-privileged processes. The vulnerability therefore represents the bridge between initial compromise and full endpoint control. CISA’s KEV entry specifically notes total technical impact and active exploitation.

The technical weakness is also interesting because it affects Windows Update Stack itself. Link-following flaws typically arise when privileged software accesses or modifies a filesystem object after an attacker has manipulated symbolic links, junctions or similar references so that the privileged process operates on a different target than intended. In such attacks, the vulnerable service becomes a confused deputy: the attacker cannot directly modify a protected location, but they can influence a SYSTEM-level component into performing the operation for them. That is particularly uncomfortable when the privileged component involved is part of Windows’ own update infrastructure, because the service is trusted precisely because it must modify sensitive system files.

CVE-2026-85880 is the second actively exploited Windows privilege-escalation vulnerability added to KEV in the same update. It affects Windows Advanced Local Procedure Call, or ALPC, and is caused by a heap-based buffer overflow combined with use of an uninitialized resource. Microsoft rates the vulnerability High at CVSS 7.8 and confirms that an authorized low-privilege attacker can exploit it locally to elevate privileges. CISA’s assessment again records active exploitation and total technical impact. Affected products include several Windows 10 releases and Windows Server 2012, 2012 R2, 2016, 2019 and 2022.

ALPC is particularly sensitive because it is a core Windows inter-process communication mechanism. Privileged Windows services routinely use ALPC to exchange data between processes. A memory-corruption flaw in that path can therefore allow attacker-controlled input from a lower-privileged process to influence a much more privileged execution context. Just as with CVE-2026-81963, this does not provide the initial entry point into the endpoint, but it gives attackers something extremely valuable once they are already there: SYSTEM-level execution. Microsoft patched both vulnerabilities in its September Patch Tuesday release, and the fact that two separate Windows elevation-of-privilege zero-days were being exploited simultaneously reinforces why endpoint compromise should be viewed as an attack chain rather than a single vulnerability event.

The final vulnerability, CVE-2026-86218, is arguably the most operationally dangerous for managed service providers and organizations relying on centralized remote monitoring and management. N-able describes the flaw as a critical pre-authentication remote code execution vulnerability affecting N-central versions before build 2026.3.1.14. The CVE carries a CVSS v4 score of 10.0, requires no privileges or user interaction and is reachable over the network. CISA classifies the weakness as static code injection and has now added it to KEV because exploitation has been observed.

The RMM context dramatically increases the potential impact. N-central is designed to monitor and administer large numbers of endpoints remotely. That means the platform may already possess trusted agents, administrative credentials and deployment mechanisms capable of executing software across customer environments. An attacker compromising one N-central server does not merely gain access to that server. They may obtain a position from which they can potentially abuse the same management channels administrators use to control hundreds or thousands of machines.

This is why RMM systems deserve treatment as administrative control-plane infrastructure. A compromise can allow malicious activity to masquerade as normal IT operations because software deployments, remote commands and configuration changes legitimately originate from the N-central platform. Endpoint security products may even trust those processes and agents. Detection therefore has to examine who initiated the action, whether it was expected and how widely it was deployed rather than assuming that traffic or code originating from an RMM tool is inherently safe.

N-able released N-central 2026.3 Hotfix 4, build 2026.3.1.14, specifically to address CVE-2026-86218. The company initially said it had no confirmation of production exploitation, but its later incident-status update stated that the newly disclosed vulnerability had been observed being exploited in the wild. CISA has gone a step further and now formally classifies CVE-2026-86218 as a Known Exploited Vulnerability.

The N-central KEV entry is also notable because CISA requires forensic triage under BOD 26-04 and assigns a remediation due date of September 11, only three days after the vulnerability was added to the catalog. That urgency reflects the combination of pre-authentication RCE, internet exposure, exploitation evidence and the broad administrative privileges inherent in an RMM platform. Organizations running vulnerable N-central servers should therefore update immediately and review the systems for compromise rather than simply checking whether the new build installs successfully.

For N-central environments, compromise assessment should include audit logs, newly created accounts, abnormal administrative sessions, unexpected agent commands, unusual software deployments and outbound communication from the server. Managed endpoints should also be reviewed for activity initiated through N-central during the suspected exposure period. Because an attacker can use legitimate management mechanisms, the downstream compromise may not contain obvious malware-delivery indicators.

Taken together, the four CVEs also demonstrate why vulnerability severity cannot be reduced to one numeric score. CVE-2026-75650 and CVE-2026-86218 carry maximum severity ratings and can be remotely exploited without authentication. The two Microsoft vulnerabilities are rated 7.8 because they require local access and low privileges. Yet all four belong in CISA’s KEV Catalog because attackers have actually demonstrated that they are useful.

That is the distinction defenders should care about.

A theoretical CVSS 10 vulnerability buried inside an unreachable internal component may represent less immediate risk than a 7.8 privilege-escalation flaw attackers are actively chaining into real intrusions.

KEV provides the missing context: attacker behavior.

Organizations should therefore prioritize these four vulnerabilities differently based on their role in the attack chain. Internet-facing Adobe Commerce, Magento and N-central systems deserve immediate patching and compromise hunting because they can provide the attacker with an initial foothold or remote code execution. CVE-2026-81963 and CVE-2026-85880 should be deployed rapidly across Windows endpoints because they provide the privilege escalation attackers need after gaining that foothold.

The remediation strategy should also recognize that patching and incident response overlap once exploitation is confirmed. For an actively exploited vulnerability, the patch answers only one question: can the attacker use that flaw again?

It does not answer whether they already used it.

Security teams should therefore identify systems that were vulnerable during the exploitation period, determine their exposure and review available telemetry for evidence of compromise. CISA’s BOD 26-04 framework increasingly formalizes this distinction by requiring forensic triage in selected high-risk cases rather than treating patch deployment as the end of the vulnerability-management process.

The September 8 KEV update ultimately illustrates why vulnerability management needs to move from vulnerability counting to attack-path reduction.

CVE-2026-75650 gives attackers a path into an e-commerce server.

CVE-2026-86218 can give them control of an RMM management platform.

CVE-2026-81963 and CVE-2026-85880 can turn limited Windows access into SYSTEM privileges.

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-75650 Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability CVE-2026-81963 Microsoft Windows Link Following Vulnerability CVE-2026-85880 Microsoft Windows Heap-Based Buffer Overflow Vulnerability CVE-2026-86218 N-able N-central Static Code Injection Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of

Source: CISA Adds Four Known Exploited Vulnerabilities to Catalog via CISA Advisories — published 08 Sep 2026.