Every week CISA adds vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue. The bar for getting on that list is not "severe on paper" but "attackers are using it now". For a small team with limited patching hours, that makes KEV the most useful priority list there is.
These are the ten entries added between 21 and 25 September 2026, copied from the catalogue, each linked to its NVD record. Nothing below is estimated or rewritten.
The ten actively exploited vulnerabilities added this week
| Added | Product | CVE |
|---|---|---|
| 25 Sep | MikroTik RouterOS, improper enforcement of behavioral workflow | CVE-2026-67279 |
| 25 Sep | Microsoft SharePoint, code injection | CVE-2026-65660 |
| 25 Sep | WordPress Core, remote file inclusion | CVE-2026-87902 |
| 24 Sep | WSO2 multiple products, path traversal | CVE-2026-5430 |
| 24 Sep | Adobe Commerce and Magento, incorrect authorization | CVE-2026-71362 |
| 22 Sep | Arista VeloCloud Orchestrator, improper input validation | CVE-2026-93952 |
| 22 Sep | F5 BIG-IP APM, heap-based buffer overflow | CVE-2026-94127 |
| 22 Sep | Check Point multiple products, path traversal | CVE-2026-93616 |
| 22 Sep | Check Point multiple products, improper certificate validation | CVE-2026-85102 |
| 21 Sep | Zyxel GS1900 series switches, stack-based buffer overflow | CVE-2026-7273 |
What European authorities flagged the same week
Romania's national cyber security directorate, DNSC, issued two alerts that overlap with the list above:
- a critical, actively exploited vulnerability in F5 BIG-IP APM (CVE-2026-94127), on 23 September;
- a critical vulnerability in WordPress Core, on 24 September.
When a national authority and CISA point at the same product in the same week, that product goes to the top of the queue.
A breach worth checking your address against
LimeLeads was added to Have I Been Pwned on 22 September with 17,838,396 accounts. If your team's work addresses ever went into a B2B lead database, check the breach page and look at the password reuse question, not only the address.
How to use a list like this in an hour
- Start with what faces the internet. Seven of the ten entries sit at the edge: VPN and access gateways (F5 BIG-IP APM, Check Point), SD-WAN orchestration (VeloCloud), routers and switches (MikroTik, Zyxel), and public web platforms (WordPress, Magento). An exploited edge device is how many ransomware incidents start.
- Search your inventory by product name, not by memory. "We don't run SharePoint" is a claim, and the asset list is the evidence.
- Patch or apply the vendor mitigation, then confirm the version. A patch that was downloaded but not applied reads as done in a ticket and is still exploitable.
- If you cannot patch today, reduce exposure: restrict the management interface to known addresses, disable the affected feature, or put the service behind an access gateway you trust.
Where this comes from, and how to get it every hour
We run a small collector that reads official sources every hour: DNSC, CERT-EU, CERT-FR (ANSSI), CERT-Bund (BSI), the UK NCSC, CISA KEV, Have I Been Pwned, and three specialist newsrooms. It copies each item exactly, with its source link, and publishes the result on one page:
https://devaland.cloud/alerte-live.html (in Romanian, with every title kept in its original language).
Nothing on that page or in this post is written by a model. That was a deliberate choice: a security page that paraphrases an advisory wrongly does more harm than no page at all. If you want the DNSC alerts and new actively exploited vulnerabilities by email within the hour, there is a double opt-in form on the same page, at most one email every six hours, and a one-click unsubscribe.
If the worst has already happened, our checklist for the first 60 minutes after a ransomware attack (in Romanian) follows the published guidance from DNSC, the NCSC and No More Ransom.
Sources: CISA KEV catalogue (dateAdded 21 to 25 September 2026), DNSC alerts of 23 and 24 September 2026, Have I Been Pwned (LimeLeads, added 22 September 2026). Checked on 27 September 2026.
Top comments (0)