CISA Adds Two Known Exploited Vulnerabilities to Catalog
2026-09-27T21:24:01Z•21e8eeaa2c4cb5d1d13eb94ae7d025879493a473e382ac5f6883c03e1abdfd77
CVE-2026-5430CVE-2026-65660CVE-2026-67279CVE-2026-71362CVE-2026-7273CVE-2026-85102CVE-2026-87902CVE-2026-88771CVE-2026-88772CVE-2026-88773CVE-2026-88774CVE-2026-88775CVE-2026-88776CVE-2026-88777CVE-2026-88778CVE-2026-93616CVE-2026-93952CVE-2026-94127Adobe CommerceArista VeloCloudCISACheck PointCitrix NetScalerF5 BIG-IPKEVKnown Exploited VulnerabilitiesMagentoMicrosoft SharePointMikroTik RouterOSNetScaler ADCNetScaler GatewayWSO2WordPressZyxelactive exploitationindicators of compromisepatchingremote code executionvulnerability managementzero-day
What happened
CISA reports active exploitation of multiple vulnerabilities added to its Known Exploited Vulnerabilities (KEV) Catalog between September 22 and 27, 2026. The most urgent issue is a pair of critical zero-days in Citrix NetScaler ADC and Gateway (CVE-2026-88771 and CVE-2026-88772), which can independently enable remote code execution and have been exploited globally. Additional exploited vulnerabilities affect WordPress Core, Microsoft SharePoint, MikroTik RouterOS, WSO2 products, Adobe Commerce/Magento, Check Point products, Arista VeloCloud Orchestrator, F5 BIG-IP APM, and Zyxel GS1900 Series
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cisa_ncas_current_activity
- Record identifier
- 21e8eeaa2c4cb5d1d13eb94ae7d025879493a473e382ac5f6883c03e1abdfd77
- Enrichment time
- 2026-09-27T21:24:01Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.