Imminent Deadline: API Infrastructure and E-Commerce Platforms

Two vulnerabilities carry a September 27 patch deadline — roughly 48 hours from today.

CVE-2026-5430 — WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway are affected by a path traversal vulnerability enabling unrestricted file upload leading to remote code execution. WSO2 components are deeply embedded in enterprise integration and microservices architectures, often bridging internal services to external consumers. A successful exploit here is not limited to the WSO2 host — downstream service exposure depends on what the API gateway can reach. Teams should immediately audit external exposure of WSO2 admin consoles and management APIs, apply vendor patches, and review upload directories for any unauthorized artifacts already present.

CVE-2026-71362 — Adobe Commerce and Magento carries an incorrect authorization vulnerability allowing privilege escalation to sensitive resources without user interaction. This is a significant threat in retail and government e-commerce environments, where Magento installations frequently handle payment flows and personally identifiable data. The no-interaction requirement is a critical differentiator — exploitation does not depend on luring an authenticated user. Verify patch status across all Commerce and Magento instances, audit administrator account creation logs for the past 30 days, and confirm that file integrity monitoring is active.

Weekend Deadline: SharePoint Code Injection and MikroTik Chain Exploitation

Two vulnerabilities were added to KEV today, September 25, with a compressed September 28 patch deadline — a 72-hour window that spans the weekend.

CVE-2026-65660 — Microsoft SharePoint contains a code injection flaw exploitable by an authorized attacker over a network. The "authorized attacker" framing is important — this likely requires some level of authenticated access, making it a particularly relevant threat in environments where SharePoint permissions are broadly delegated or where credentials have already been compromised through phishing or credential stuffing. Patch immediately, review SharePoint site collection permissions for over-privileged accounts, and cross-reference recent authentication logs for anomalous access patterns.

CVE-2026-67279 — MikroTik RouterOS contains an improper behavioral workflow enforcement vulnerability that enables unauthenticated clients to open session channels and send exec requests. CISA's catalog entry explicitly notes this vulnerability chains with CVE-2026-86060 to achieve fully unauthenticated exploitation. MikroTik devices are prevalent in ISP, industrial, and SMB environments and are historically slow to receive firmware updates at scale. Any internet-exposed RouterOS device should be patched immediately, disabled if patching is not feasible, or placed behind strict ingress filtering. The chained exploit path elevates urgency — defenders should not treat these as independent issues.

Across all eight CVEs, the pattern is consistent with CISA's broader BOD 26-04 enforcement posture: unauthenticated RCE on perimeter and orchestration infrastructure is being actively exploited, and compressed deadlines signal high-confidence threat actor activity. Federal agencies and their contractors have no discretion on compliance; commercial organizations operating critical infrastructure should treat these deadlines as operationally binding.

Sources: CISA KEV Catalog · CISA BOD 26-04 · Check Point Security Advisory Portal · F5 Security Advisories · Microsoft Security Update Guide · WSO2 Security Advisories · Adobe Security Bulletin · Arista Security Advisories · MikroTik Security Announcements