CISA Adds Two Known Exploited Vulnerabilities to Catalog
2026-09-28T17:24:04Z•6c91dab952528c60e86967d93451f8cb692edd2e4593619d08d6e790277be5b8
CVE-2026-5430CVE-2026-65660CVE-2026-67279CVE-2026-71362CVE-2026-7273CVE-2026-85102CVE-2026-87902CVE-2026-88771CVE-2026-88772CVE-2026-88773CVE-2026-88774CVE-2026-88775CVE-2026-88776CVE-2026-88777CVE-2026-88778CVE-2026-93616CVE-2026-93952CVE-2026-94127Adobe CommerceArista VeloCloudCISACheck PointCitrix NetScalerF5 BIG-IPKEVKnown Exploited VulnerabilitiesMagentoMicrosoft SharePointMikroTik RouterOSNetScaler ADCNetScaler GatewayWSO2WordPressZyxel GS1900active exploitationincident responseremote code executionvulnerability remediationzero-day
What happened
CISA reports active exploitation of multiple vulnerabilities added to its Known Exploited Vulnerabilities (KEV) Catalog from September 22–27, 2026. The most urgent issue is a pair of critical, zero-day Citrix NetScaler ADC/Gateway vulnerabilities (CVE-2026-88771 and CVE-2026-88772) that can independently enable remote code execution and are being exploited globally. Additional exploited flaws affect WordPress, Microsoft SharePoint, MikroTik RouterOS, WSO2 products, Adobe Commerce/Magento, Check Point products, Arista VeloCloud Orchestrator, F5 BIG-IP APM, and Zyxel GS1900 switches. CISA urgesか
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cisa_ncas_current_activity
- Record identifier
- 6c91dab952528c60e86967d93451f8cb692edd2e4593619d08d6e790277be5b8
- Enrichment time
- 2026-09-28T17:24:04Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.