CISA’s latest Known Exploited Vulnerabilities update highlights a particularly uncomfortable mix of enterprise attack surfaces: Microsoft SharePoint, WSO2 API infrastructure, Adobe Commerce/Magento, and MikroTik RouterOS are all now associated with vulnerabilities being exploited in real-world attacks. The affected products sit in very different parts of an organization, but they share one important characteristic: they are often Internet-facing and positioned close to sensitive data, identity, application control planes, or network infrastructure. (bleepingcomputer.com)

The vulnerabilities include CVE-2026-5430 in WSO2, CVE-2026-71362 in Adobe Commerce/Magento, CVE-2026-65660 in Microsoft SharePoint, and CVE-2026-67279 in MikroTik RouterOS. The first two were added to CISA’s KEV catalog with a federal remediation deadline of September 27, while the SharePoint and MikroTik issues carry a September 28 deadline. (bleepingcomputer.com)

What makes this alert important is not simply the number of CVEs. These vulnerabilities affect systems that can provide an attacker with very different forms of leverage: authentication bypass in an API-management platform, authorization failure in an e-commerce platform, code injection in a collaboration server, and authentication bypass in a network router. A successful compromise in any of these environments can become much more than a single-server incident.

WSO2 CVE-2026-5430: authentication bypass in the API control plane

The WSO2 vulnerability is arguably the most severe of the group from an architectural perspective. CVE-2026-5430 affects WSO2 API Manager versions 4.1.0 through 4.6.0, as well as API Control Plane, Traffic Manager, and Universal Gateway versions 4.5.0 and 4.6.0. WSO2 assigns it a CVSS score of 10.0 in some deployment scenarios. (security.docs.wso2.com)

The root cause is improper validation of JWT signing algorithms. A token signed using an unsupported algorithm may be accepted when it should instead be rejected, allowing an unauthenticated attacker to bypass authentication and potentially compromise administrative accounts.

That is particularly serious because WSO2 often sits at the control plane of enterprise APIs. An attacker with administrative-level access may gain visibility into application endpoints, credentials, backend service configurations, policies, routing, and other sensitive integration information.

BleepingComputer reports that watchTowr observed exploitation attempts in September, including forged JWT activity against WSO2 infrastructure. The researchers reproduced the attack against the correct product and showed that forged tokens could expose API endpoints and application credentials. (bleepingcomputer.com)

The risk therefore extends far beyond a single user account. A compromised API-management platform can become a gateway into multiple applications and backend systems.

Adobe Commerce CVE-2026-71362: authorization failure on an Internet-facing commerce platform

The second critical issue is CVE-2026-71362, affecting Adobe Commerce and Magento Open Source. The vulnerability is an incorrect authorization flaw that can be exploited without an existing account, administrator privileges, or user interaction. CISA’s KEV inclusion confirms that attackers are now using it in the wild. (bleepingcomputer.com)

This matters because e-commerce platforms are high-value targets by design. They commonly hold customer data, order information, account details, administrative functions, API integrations, shipping data, and payment-related workflows.

An attacker who gains unauthorized elevated access may potentially manipulate account data, interfere with business processes, access sensitive information, or use the commerce platform as a stepping stone toward connected backend systems.

Sansec has reported active exploitation and emphasized that no existing account or user interaction is required. That significantly lowers the attacker's barrier to entry and makes publicly reachable Commerce and Magento systems attractive targets for automated scanning.

For defenders, this should be treated as both a patching and compromise-assessment problem. Updating closes the vulnerability going forward, but systems exposed before remediation should still be examined for abnormal administrative activity, privilege changes, suspicious sessions, unauthorized integrations, and changes to customer or order data.

SharePoint CVE-2026-65660: code injection in a high-value collaboration platform

CISA is also warning about active exploitation of CVE-2026-65660, a high-severity code-injection vulnerability in Microsoft SharePoint Server. Microsoft addressed the issue in its August 2026 security updates for supported SharePoint Server versions. (bleepingcomputer.com) Microsoft’s August update for SharePoint Server 2019 lists CVE-2026-65660 among the security issues fixed in that release. (support.microsoft.com)

SharePoint deserves particular attention because it frequently contains highly sensitive internal content: documents, project information, operational procedures, credentials embedded in files, business plans, HR content, customer information, and internal collaboration data.

It also has a long history of being targeted because an exposed SharePoint server can provide attackers with both valuable information and a foothold inside enterprise networks.

Active exploitation of a code-injection vulnerability means organizations should not assume that patch installation alone ends the incident. Administrators should also inspect SharePoint logs, IIS activity, newly created or modified files, unexpected application-pool behavior, unfamiliar scheduled tasks, suspicious child processes, and administrative changes that occurred before remediation.

The wider lesson from repeated SharePoint exploitation is that collaboration platforms should be treated as critical infrastructure rather than ordinary web applications. Internet-facing SharePoint servers often contain exactly the information an attacker needs to understand the organization before moving further inside.

MikroTik CVE-2026-67279: authentication bypass against network infrastructure

The fourth vulnerability, CVE-2026-67279, affects MikroTik RouterOS and is part of the broader MikroTrick attack chain disclosed earlier in September.

CERT Polska reported that attackers were actively exploiting RouterOS systems reachable over SSH and using a combination of vulnerabilities to gain full control without authentication. (cert.pl)

MikroTik released fixes in RouterOS versions including 7.24.2, 7.23.4, and 6.49.21, and advised administrators to ensure SSH is not exposed to untrusted networks. (mikrotik.com)

The significance of RouterOS compromise is fundamentally different from a compromised application server. A router sits at a strategic network position. Attackers controlling it may be able to modify routing, firewall rules, DNS settings, NAT behavior, VPN configuration, or traffic visibility depending on the device and deployment.

That can support persistence, credential theft, traffic redirection, interception, lateral movement, or further attacks against internal systems.

The fact that exploitation has already been observed means administrators should not simply upgrade and move on. MikroTik itself advises checking device configuration for unknown scripts, users, or other unauthorized changes after patching.

Four vulnerabilities, four very different attack opportunities

These vulnerabilities are useful examples of why vulnerability management should consider the role of the affected system, not just the CVSS number.

The WSO2 flaw threatens the API and identity control plane.

The Adobe Commerce flaw threatens the customer and transaction layer.

The SharePoint flaw threatens the enterprise collaboration and information layer.

The MikroTik vulnerability threatens the network control plane.

An attacker compromising each platform gains a different form of strategic advantage.

That is why the same response process should not simply be applied mechanically to all four.

CISA KEV status should change the response priority

The most important common factor is confirmed exploitation.

CISA’s Known Exploited Vulnerabilities catalog is valuable because it adds evidence of real-world attacker behavior to ordinary vulnerability severity.

A critical CVE that is not reachable may not represent the same immediate risk as a lower-scored vulnerability actively exploited against an Internet-facing production system.

The better prioritization model is:

severity + exposure + exploitation + business impact

KEV status increases the exploitation component dramatically.

Once a vulnerability enters KEV, defenders should assume attackers know how to use it and may already be scanning for vulnerable systems.

Patching alone is not enough once exploitation is active

For all four products, organizations should distinguish between remediation and incident response.

Patching prevents future exploitation of the known flaw.

It does not determine whether compromise happened yesterday.

Organizations that had affected systems exposed before remediation should review relevant logs and configuration for evidence of exploitation.

That may include authentication anomalies, suspicious administrative activity, unexpected new users, modified configuration, unusual outbound connections, newly created files, abnormal processes, unauthorized API access, or changes to network devices.

If evidence of compromise appears, affected systems should be handled as incidents rather than simply patched assets.

Internet exposure remains one of the biggest risk multipliers

The four cases also reinforce how dangerous unnecessary Internet exposure can be.

WSO2 API systems, Magento stores, SharePoint servers, and routers are often reachable from external networks because the business genuinely needs them to be.

But administrative endpoints, management ports, diagnostic services, and unused features frequently remain exposed unnecessarily.

Organizations should continuously identify which systems are externally reachable and whether that exposure is justified.

For MikroTik in particular, management access such as SSH should not be exposed broadly to the Internet. For SharePoint and WSO2, administrative interfaces should ideally be restricted to trusted networks or protected management paths wherever operationally feasible.

Security teams should prioritize control-plane systems

Three of these four vulnerabilities affect systems that effectively control access to other resources.

WSO2 controls APIs.

SharePoint controls access to large internal information repositories.

MikroTik controls network behavior.

Compromise of a control-plane component can have cascading consequences because the attacker inherits the authority that component normally possesses.

That makes these systems particularly important targets for segmentation, privileged-access control, monitoring, and rapid patching.

The broader cybersecurity lesson

CISA’s warning is a useful reminder that attackers do not organize their campaigns around vendor categories.

They look for whatever exposed system gives them leverage.

An API gateway can provide credentials and backend access. An e-commerce platform can provide customer and administrative access. A SharePoint server can provide data and enterprise footholds. A router can provide control over traffic itself.

The defensive response therefore needs to be equally broad:

identify exposed assets → prioritize KEV vulnerabilities → patch immediately → verify configuration → hunt for compromise → rotate affected credentials → monitor for follow-on activity.

The most important point is simple.

CISA is not warning that these vulnerabilities could theoretically become useful to attackers. They are already being used.

At that stage, the correct question is no longer merely:

“Have we installed the patch?”

It is:

“Were we exposed before we installed it, and what evidence do we have that nobody got there first?”

The Cybersecurity and Infrastructure Security Agency (CISA) warns that hackers are exploiting a critical authentication bypass vulnerability (CVE-2026-5430) affecting multiple products from enterprise software provider WSO2. [...]

Source: CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks via Bleeping Computer — published 25 Sep 2026.