CISA Adds One Known Exploited Vulnerability to Catalog
2026-09-30T21:24:03Z•5afa557e31a26d3b53a00004c510a0414f973045cd7bd28dba56f90d12ee9ee0
CVE-2026-5430CVE-2026-65660CVE-2026-67279CVE-2026-71362CVE-2026-76504CVE-2026-86950CVE-2026-87902CVE-2026-88771CVE-2026-88772CVE-2026-88773CVE-2026-88774CVE-2026-88775CVE-2026-88776CVE-2026-88777CVE-2026-88778Adobe CommerceAppleCISACisco Catalyst SD-WANCitrix NetScalerKEVMicrosoft SharePointMikroTik RouterOSWSO2WordPressactive exploitationpublicly exposed assetsremote code executionvulnerability managementzero-day
What happened
CISA reports active exploitation of multiple vulnerabilities added to its Known Exploited Vulnerabilities (KEV) Catalog between September 25 and 30, 2026. Affected technologies include Cisco Catalyst SD-WAN Manager, Apple products, Citrix NetScaler ADC/Gateway, WordPress Core, Microsoft SharePoint, MikroTik RouterOS, WSO2 products, Adobe Commerce/Magento, and others. The Citrix NetScaler flaws CVE-2026-88771 and CVE-2026-88772 are described as critical zero-days enabling remote code execution and are being exploited globally. Organizations should prioritize remediation, investigate for prior-
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cisa_ncas_current_activity
- Record identifier
- 5afa557e31a26d3b53a00004c510a0414f973045cd7bd28dba56f90d12ee9ee0
- Enrichment time
- 2026-09-30T21:24:03Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.