CISA Adds One Known Exploited Vulnerability to Catalog
2026-09-25T21:24:03Z•f4122812784bdaa0538ef353b71d7184c3849fe59103b736ee521351177e8db2
CVE-2025-39682CVE-2025-39964CVE-2026-53266CVE-2026-5430CVE-2026-65660CVE-2026-67279CVE-2026-71362CVE-2026-7273CVE-2026-85102CVE-2026-87902CVE-2026-93616CVE-2026-93952CVE-2026-94127Adobe CommerceArista VeloCloud OrchestratorCISA KEVCheck PointF5 BIG-IPLinux kernelMagentoMicrosoft SharePointMikroTik RouterOSWSO2WordPressZyxelactive exploitationbuffer overflowcode injectioncritical infrastructureimproper authorizationimproper input validationout-of-bounds writepath traversalrace conditionremote file inclusionvulnerability management
What happened
CISA reported the addition of 13 vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog between September 18 and September 25, 2026, citing evidence of active exploitation. Affected products include WordPress, Microsoft SharePoint, MikroTik RouterOS, WSO2, Adobe Commerce/Magento, Check Point products, Arista VeloCloud Orchestrator, F5 BIG-IP APM, Zyxel switches, and the Linux kernel. Organizations—especially federal civilian executive agencies—should prioritize remediation, assess publicly exposed systems, and investigate potential compromise before patching.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cisa_ncas_current_activity
- Record identifier
- f4122812784bdaa0538ef353b71d7184c3849fe59103b736ee521351177e8db2
- Enrichment time
- 2026-09-25T21:24:03Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.