CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA reported active exploitation of 14 vulnerabilities added to its Known Exploited Vulnerabilities (KEV) Catalog between September 18 and 25, 2026. Affected products include Microsoft SharePoint, MikroTik RouterOS, WSO2, Adobe Commerce/Magento, Check Point products, Arista VeloCloud Orchestrator, F5 BIG-IP, Zyxel switches, the Linux kernel, Cisco ISE, and Acronis Backup. Organizations—especially Federal Civilian Executive Branch agencies—should prioritize rapid remediation, assess publicly exposed systems for compromise, and follow risk-based vulnerability management aligned with BOD 26-04.