Claude is having a major outage. Status board · Discuss Claude

KEH-TECH

Exploited this week: 12 vulnerabilities added to CISA’s KEV list (21 Sep to 27 Sep 2026)

Automatic post. Built by KEH-TECH from CISA’s Known Exploited Vulnerabilities catalog, as read by the Patch Tuesday hub, and published without editing. The figures are the source’s own; follow the links for the full detail.

Between 21 September 2026 and 27 September 2026, CISA added 12 entries to its list of vulnerabilities being exploited in the wild, 1 of them Microsoft. US federal agencies must fix these by the deadline shown; everyone else should treat that date as the latest sensible one.

Added this week

  • CVE-2026-7273 Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability. Added 21 Sep; federal deadline 24 September 2026.
  • CVE-2026-85102 Check Point Multiple Products Improper Certificate Validation Vulnerability. Added 22 Sep; federal deadline 25 September 2026.
  • CVE-2026-93616 Check Point Multiple Products Path Traversal Vulnerability. Added 22 Sep; federal deadline 25 September 2026.
  • CVE-2026-93952 Arista VeloCloud Orchestrator Improper Input Validation Vulnerability. Added 22 Sep; federal deadline 25 September 2026.
  • CVE-2026-94127 F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability. Added 22 Sep; federal deadline 25 September 2026.
  • CVE-2026-5430 WSO2 Multiple Products Path Traversal Vulnerability. Added 24 Sep; federal deadline 27 September 2026.
  • CVE-2026-71362 Adobe Commerce and Magento Incorrect Authorization Vulnerability. Added 24 Sep; federal deadline 27 September 2026.
  • CVE-2026-65660 Microsoft SharePoint Code Injection Vulnerability. Added 25 Sep; federal deadline 28 September 2026.
  • CVE-2026-67279 Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability. Added 25 Sep; federal deadline 28 September 2026.
  • CVE-2026-87902 WordPress Core Remote File Inclusion Vulnerability. Added 25 Sep; federal deadline 28 September 2026.
  • CVE-2026-88771 Citrix NetScaler Improper Input Validation Vulnerability. Added 27 Sep; federal deadline 30 September 2026.
  • CVE-2026-88772 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability. Added 27 Sep; federal deadline 30 September 2026.

Running any of these? Microsoft fixes are listed on the Patch Tuesday hub. Found one in your environment? The Patch Panel is the place to compare notes.

Written by

KEH-TECH

The site’s automatic account. Opens The Patch Panel’s regular threads (Patch Tuesday every month, No Dumb Questions on Mondays, War Stories on Fridays) and posts The Advisory’s data-built updates: the Patch Tuesday recap, the end-of-life roundup and the weekly exploited-vulnerabilities digest. Automatic; the replies are the members’.

About KEH-TECH