Sunday, September 27, 2026|Issue 9|6 min read|Join the discussion
Edge infrastructure is back in the blast radius
Reports of two apparently unpatched NetScaler RCE flaws arrive as actively exploited SharePoint and MikroTik vulnerabilities hit CISA's urgent remediation queue, reinforcing that the systems closest to trust boundaries remain some of the most valuable places for attackers to land.
The short version
- watchTowr says two unpatched remote code execution flaws in NetScaler ADC and Gateway were exploited before any fix existed. Citrix has not confirmed them, and there are no CVEs, builds or IOCs yet.
- CISA added SharePoint Server CVE-2026-65660 to KEV on September 25 after Microsoft reported observed attacks. Federal deadline: Monday, September 28.
- MikroTik RouterOS CVE-2026-67279 joined KEV the same day. CERT Polska says attackers chain it with CVE-2026-86060 ("MikroTrick") for unauthenticated admin control over SSH.
- The WSO2 (CVE-2026-5430) and Adobe Commerce (CVE-2026-71362) KEV deadline is today.
- The common thread: edge and collaboration systems sit on trust boundaries, and most of them tell your SIEM far less than an endpoint does.
Issue at a glance
2 critical1 high1 notable
- criticalCloudwatchTowr reports two exploited, unpatched NetScaler RCE flaws
- criticalVulnerabilitySharePoint CVE-2026-65660 is exploited and due Monday
- highNetworkMikroTik's MikroTrick chain hits KEV
- notableVulnerabilityWSO2 and Adobe Commerce deadline is today
Patch clock
| CVE | Product | What it is | Severity |
|---|---|---|---|
| CVE-2026-65660 | Microsoft SharePoint Server 2016, 2019, Subscription Edition | Code injection letting an authenticated, low-privileged user execute code over the network; originally published as spoofing; Microsoft reports observed attacks | High (CVSS 8.8) |
| CVE-2026-67279 | MikroTik RouterOS | Improper enforcement of behavioral workflow in SSH lets an unauthenticated client open a session channel and send an exec request; chained with CVE-2026-86060 in MikroTrick | Medium (CVSS 6.9); critical when chained |
Also on the vulnerability desk
- Due today, September 27: WSO2 API Manager and related products (CVE-2026-5430) and Adobe Commerce/Magento Open Source (CVE-2026-71362), both added to KEV on September 24.
- Not a CVE yet: watchTowr reports two exploited NetScaler ADC/Gateway RCE flaws with no public CVE IDs, patches, affected builds or Citrix advisory as of this writing. They are separate from CVE-2026-19490, fixed August 19.
Breaking
Edge / Remote access / Zero-day
watchTowr reports two exploited, unpatched NetScaler RCE flaws
On September 26, watchTowr said two separate remote code execution vulnerabilities in NetScaler ADC and NetScaler Gateway were found during forensic investigations and exploited before any fix existed. It said Citrix communications and patches are expected early in the week of September 28.
Why it matters. NetScaler handles VPN, remote access and authentication at the network edge, so code execution there lands an attacker on the trust boundary itself. The limits matter: Citrix has not confirmed the flaws, there are no CVE IDs, watchTowr has published no evidence or victims, and nobody has said whether the August builds (14.1-73.32, 13.1-63.21) or newer are affected. This is separate from CVE-2026-19490, already on KEV.
What to do. Confirm you are at least on the August 19 builds, restrict management interfaces, and review NetScaler logs for new accounts, config changes, unexpected files and unusual outbound connections. Decide in advance whether you would take exposed appliances offline, as some admins reportedly have, and watch for Citrix's advisory.
SharePoint / KEV
SharePoint CVE-2026-65660 is exploited and due Monday
CISA added CVE-2026-65660 to KEV on September 25. Microsoft first described it as a spoofing flaw, then updated the advisory to allow remote code execution and said that as of September 25 it had reliable evidence of observed attacks.
Why it matters. It affects on-premises SharePoint Server 2016, 2019 and Subscription Edition and requires an authenticated, low-privileged user. On-prem SharePoint often holds internal documents and service integrations, so a foothold can reach well beyond the server. Microsoft has not said who is exploiting it, since when, or what attackers did after access.
What to do. Apply Microsoft's update now, then hunt backward: look for unexpected web shells or files, unusual w3wp.exe child processes and new or changed service accounts since before you patched. Patching closes the flaw; it does not tell you whether it was already used.
CVE-2026-65660
Network / Routers / KEV
MikroTik's MikroTrick chain hits KEV
CISA added RouterOS CVE-2026-67279 to KEV on September 25. CERT Polska, which found the flaws, says attackers combine it with CVE-2026-86060, an argument injection in the login process, to take full control of devices whose SSH service is reachable from public networks.
Why it matters. Scored alone, CVE-2026-67279 is a 6.9. As part of a chain it becomes unauthenticated admin access to a router. CERT Polska reports attacks against internet-reachable RouterOS devices and confirmed the patches stop them. This is why the attack path, not the individual score, is the unit that matters.
What to do. Update to a fixed RouterOS release (7.25beta3, 7.24.2, 7.23.4 or 6.49.21 per CERT Polska), restrict SSH from public networks, then check for unknown users, scripts, scheduler tasks, proxies and tunnels as CERT Polska recommends.
CVE-2026-67279, CVE-2026-86060
KEV / Deadline
WSO2 and Adobe Commerce deadline is today
The federal KEV deadline for WSO2 CVE-2026-5430 and Adobe Commerce/Magento CVE-2026-71362 is September 27.
Why it matters. Both were exploited before many teams patched, and sources still describe the WSO2 flaw differently. Hitting the deadline closes the door but says nothing about who came in first.
What to do. Confirm patched versions, then assess compromise: review API gateway admin activity and uploaded files on WSO2, and admin accounts and checkout-page changes on Commerce.
CVE-2026-5430, CVE-2026-71362
Trends
Edge appliances remain Tier-0 attack surface
F5, Check Point, VeloCloud, Zyxel, MikroTik and now NetScaler: the last two weeks of this brief read like a tour of network and identity trust boundaries. These systems concentrate authority, which is why they keep getting targeted. The mature question is not only whether a CVE was patched, but whether the attack path was eliminated and whether it was used first.
Attack paths matter more than individual CVEs
MikroTrick is the clean example: a 6.9 plus an argument injection equals unauthenticated admin control. SharePoint shows the same pattern from the other direction, with a flaw first rated as spoofing now tied to code execution and attacks. The unit of risk is increasingly the path to consequence, not the individual CVE.
Vulnerability intelligence can outrun vulnerability management
Three versions of the same problem in one week: Kiteworks warned of a credible threat with no CVE, NetScaler has reported exploitation with no public CVE, and SharePoint was patched in August and only later confirmed exploited. Programs keyed only on CVE IDs and patch availability will see all three late.
Edge devices have an observability problem
Endpoints ship rich process and file telemetry; most appliances ship far less. Practical SIEM questions to ask of every edge device: would you see a new admin account, a config change, a new scheduled task, or unusual outbound traffic from the appliance itself? CERT Polska's post-patch checklist for RouterOS is a good template for what to look for.
Clearance corner
KEV deadlines now arrive in pairs, with triage attached
Agencies face two KEV deadlines in two days: WSO2 and Adobe today, SharePoint, MikroTik and WordPress Core on Monday. Under BOD 26-04, CISA's catalog entries also flag whether forensic triage is required, so remediation is not complete when the patch lands. Document the patch, the hunt and the result as separate deliverables.
What we are watching next
Citrix's response
Whether Citrix confirms the two NetScaler flaws and publishes CVEs, fixed builds and IOCs early in the week of September 28.
Monday deadline
SharePoint CVE-2026-65660 and MikroTik CVE-2026-67279 are due Monday, September 28.
SharePoint post-exploitation
Whether Microsoft or responders describe who is exploiting CVE-2026-65660 and what they do once inside.
MikroTrick follow-on
Further reporting on compromised RouterOS devices and what attackers are using them for.
Edge hunting as a category
Whether vendors and agencies start treating appliances as a routine threat-hunting target rather than a patch-and-forget asset.
Sources
Join the discussion
Loading comments…