Four CVEs in Five Days: CISA's September KEV Surge Hits MikroTik Routers, SharePoint and E-commerce

Introduction

The US Cybersecurity and Infrastructure Security Agency has added four actively exploited vulnerabilities to its Known Exploited Vulnerities catalog in five days, spanning network edge hardware, enterprise collaboration servers, identity middleware and e-commerce platforms. The catalog additions cover a MikroTik RouterOS flaw that chains with a second bug into a full unauthenticated router takeover, a Microsoft SharePoint flaw the vendor has upgraded from "spoofing" to remote code execution, an identity flaw in WSO2 that watchTowr caught in the wild before any public technical detail existed, and an Adobe Commerce session-switching flaw that Sansec has been blocking since August.

The pattern matters more than any single entry. Every one of these bugs sits at a trust boundary where software that was designed for trusted local callers is reachable from the open internet, and in the MikroTik case the exploit chain was already being used against real devices before the fixes were public. The federal deadline for the WSO2 and Adobe Commerce patches is today, September 27; the SharePoint and RouterOS deadline is September 28.

Main Content

A router takeover that needs no password at all

On September 5, 2026, CERT Polska published an advisory covering six vulnerabilities in MikroTik RouterOS, including a combination attackers were using to seize internet-exposed routers. MikroTik shipped fixes for all six in the same security releases, and the available evidence indicates the flaws were being exploited before the advisory became public.

Bishop Fox reproduced the chain end to end, led by adversarial operator Emilio Gallegos, and reported the results on September 17. The team's analysis — documented in a technical writeup of the MikroTrick chain — describes two independent failures that become severe only when combined.

The first, CVE-2026-67279, breaks SSH's authentication state machine. SSH normally moves through three phases: establish an encrypted connection, authenticate a user, then allow that user to open terminals or run commands. RouterOS enforces that sequence correctly on an ordinary connection. The failure appears when an unauthenticated client requests a key renegotiation — rekeying, which is routine in SSH. On vulnerable builds, completing that rekey advances the connection into the next protocol phase even though nobody has authenticated. The client can then open a session channel, request a terminal and submit an execution request. That session has no identity and no permission set, but it has already crossed the line that was supposed to keep it away from RouterOS's login process.

The second, CVE-2026-86060, is an argument injection in that login process. RouterOS uses a separate helper program to establish a login session's identity and permissions, and the SSH service hands it the client-supplied username as a command-line argument. That helper carries a legacy feature for trusted local programs: an argument beginning with a dash is not read as a username at all. Instead, the digits after the dash select an already-open file descriptor from which the helper reads a trusted identity record containing a username and permission set. The SSH service passed remote usernames into this interface without rejecting that syntax, so supplying the username -2 told the helper to read its trusted identity from file descriptor 2. On vulnerable RouterOS 7.x, that descriptor is wired to the client's own session terminal. The attacker therefore supplies the record the helper believes came from a trusted local process, and when that record names the administrator and carries the full permission set, the helper installs those values without completing normal authentication.

Bishop Fox reproduced the complete administrative takeover on vulnerable RouterOS 7.x builds. The first-stage authentication bypass also affects 6.x, but the same construction did not produce an administrative session there. The two fixes landed in different components: RouterOS 7.23.4 adds a check confirming a session has an assigned policy mask before dispatching connection-layer packets, and 6.49.21 adds the equivalent check at a different field offset. The login path fix introduces a validator that rejects empty usernames, leading dashes, leading or trailing spaces and control characters before the helper is ever invoked. Notably, the legacy file-descriptor mode itself remains in the patched helper — the fix places validation at the boundary where untrusted network input enters a trusted local interface, rather than ripping out the feature.

Persistence that outlives the logs

The more consequential finding came from authorized testing of real internet-facing MikroTik routers, where Bishop Fox encountered devices holding artifacts consistent with the campaign CERT Polska had reported. The routers' volatile login history no longer covered the suspected compromise period, but the configuration still preserved evidence of access.

That distinction is structural. RouterOS logs are memory-resident by default and can disappear when the device reboots, while accounts, scripts and scheduled tasks persist long after that history is gone. The affected devices carried a script named logrotate and a scheduler named daily-maint that ran once per day and recreated a second full-privilege account if it had been removed. Each unauthorized account used a different password on each device, consistent with automated per-device credential generation.

The persistent objects shared another unusual property: RouterOS displayed their owner as the numeric identity 0 rather than a named administrator. The team reproduced that distinction in the lab — a scheduler created through the tested chain returned owner="0", while one created through a normal admin login returned owner="admin". The researchers are careful about the limits of that signal, noting that RouterOS may also contain legitimate service-created or historical objects with unfamiliar ownership. Numeric ownership is best treated as a hunting lead rather than proof.

CISA added CVE-2026-86060 to the KEV catalog on September 11, 2026, and added CVE-2026-67279 on September 25, giving federal civilian agencies until September 28 to apply fixes. As The Hacker News reported, CERT Polska notes the unauthenticated execution path can also manipulate files in the RouterOS-managed file namespace, including support files containing configuration and diagnostic information; Bishop Fox confirmed the authentication-state bypass but did not exercise those file operations.

SharePoint, WSO2 and Adobe Commerce join the list

The rest of the week's additions span very different software. Microsoft initially described CVE-2026-65660, affecting SharePoint Server, as a spoofing vulnerability before updating its advisory to state it could be abused to obtain remote code execution. Microsoft says that as of September 25, 2026, it had "reliable evidence of observed attacks" against exploitation of the vulnerability, and has not disclosed who was behind the exploitation, when it started, how many organizations were targeted or what attackers did once inside the vulnerable service.

CVE-2026-5430 in WSO2 came with a sharper evidentiary trail. watchTowr said it has seen in-the-wild exploitation attempts against its honeypots since at least September 13, 2026. "We captured forged JWT tokens targeting the flaw on September 13 and reproduced the vulnerability ourselves, despite the lack of public technical details," said Yordan Ganchev, principal threat intelligence specialist at watchTowr. "That gave us direct evidence that this wasn't merely a theoretical vulnerability or a critical severity score on paper. It was exploitable, and attackers were already acting on it." Ganchev also stressed the deployment footprint: WSO2's technology is used by nearly 1,000 customers across banking, government, telecommunications and logistics.

CVE-2026-71362, in Adobe Commerce and Magento, was detected and blocked by Sansec in August 2026. The Dutch e-commerce security company said the flaw lets attackers switch a customer session to another customer account, granting access to the victim's account and private customer data. Telemetry from AT&T subsidiary Previdian showed a lone IP address in Australia attempting to exploit the flaw against its honeypot sensors on September 10, though Adobe has yet to update its advisory to confirm exploitation status.

Federal agencies were given until September 27, 2026 — today — to apply fixes for both. The full list is tracked in the CISA Known Exploited Vulnerabilities catalog.

What defenders should take from the cluster

The common thread across these four entries is that the exploited weakness is rarely the headline feature. It is a legacy compatibility path, a state machine that trusts a signal it did not check, a filename-shaped argument and a file descriptor, a session object that outlives its own audit trail. MikroTrick, in Bishop Fox's framing, exposes a design risk in privileged software: a feature intended only for trusted local callers becomes remote attack surface when an upstream component loses track of authentication state.

Two operational lessons follow. The first is that patch status and compromise status are separate questions. The installed version establishes whether a router remains exposed; accounts, scripts, schedulers and configuration history establish whether someone used that exposure. Because RouterOS logs are volatile, those durable configuration objects may be the better record. The second is that a differential, non-invasive detector is possible. Bishop Fox's test for CVE-2026-67279 sends no username, no authentication attempt, no command and no subsystem request: it compares a control connection that completes key exchange against a test connection that performs an additional rekey before requesting the same session channel. A vulnerable build refuses the control request but opens the channel after rekeying. Only that differential produces a vulnerable verdict — timeouts and unsupported algorithms stay inconclusive rather than being read as patched.

Conclusion

Four catalog entries in five days is a busy week by any measure, and this one clusters across the entire stack an organization depends on: the router at the edge, the identity layer in the middle, the collaboration server and the storefront. The deadlines are immediate — September 27 for WSO2 and Adobe Commerce, September 28 for SharePoint and RouterOS.

For organizations running MikroTik hardware, patching is necessary but not sufficient. Bishop Fox's field research found compromised routers whose login history had already been erased by a reboot, with persistence living on in configuration objects. Patching stops new exploitation; it does not remove an access that has already been established. Teams should inventory which of their own devices are internet-facing, compare them against a known-good configuration, and hunt specifically for privileged accounts, scripts and schedulers carrying a numeric owner="0". Related coverage of these vendor and vulnerability themes runs in our cybersecurity coverage section.

Images

A MikroTik hAP ac² RouterBOARD opened to expose the mainboard, switch chipset and Ethernet magnetics implicated in the login-helper trust path.

An internet-facing MikroTik RouterBOARD of the class affected by the MikroTrick chain — the kind of device reachable by an unauthenticated attacker over SSH.

References

• Bishop Fox, "MikroTrick: Inside the RouterOS Takeover Chain," Sep 17, 2026 — https://bishopfox.com/blog/mikrotrick-inside-the-routeros-takeover-chain
• The Hacker News, "SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild," Sep 25, 2026 — https://thehackernews.com/2026/09/sharepoint-rce-and-mikrotik-routeros.html
• The Hacker News, "WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV," Sep 24, 2026 — https://thehackernews.com/2026/09/wso2-and-adobe-commerce-flaws-exploited.html
• CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CERT Polska advisory on six MikroTik RouterOS vulnerabilities, Sep 5, 2026
• watchTowr and Sansec honeypot telemetry on CVE-2026-5430 and CVE-2026-71362