Daily brief · 2026-09-27 · updated 2026-10-12

5 Critical Security Fixes You Need Today

▶

Microsoft SharePoint, Mikrotik RouterOS

On September 25, 2026, CISA added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The first issue is CVE-2026-65660, an actively exploited code injection vulnerability in Microsoft SharePoint. The second issue is CVE-2026-67279, which affects Mikrotik RouterOS and is also being actively exploited. These additions highlight ongoing threats against Microsoft SharePoint, Mikrotik RouterOS.

Why it matters: These vulnerabilities are facing active exploitation by threat actors in the wild.

What to do: Patch Microsoft SharePoint and Mikrotik RouterOS to versions addressing CVE-2026-65660 and CVE-2026-67279.

CVEs: CVE-2026-65660, CVE-2026-67279

WordPress Core

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. This newly added flaw is CVE-2026-87902, which is a remote file inclusion vulnerability affecting WordPress Core. The agency confirmed that this WordPress Core vulnerability is currently being actively exploited.

Why it matters: This matters because there is active exploitation of WordPress installations occurring in the wild.

What to do: Update WordPress Core to patched version addressing CVE-2026-87902.

CVEs: CVE-2026-87902

WSO2 products, Adobe Commerce, Magento

On September 24, 2026, CISA added two more actively exploited vulnerabilities to the KEV catalog. The first is CVE-2026-5430, a path traversal vulnerability affecting multiple WSO2 products. The second is CVE-2026-71362, which is an authorization vulnerability in Adobe Commerce and Magento. Both vulnerabilities impact WSO2 products, Adobe Commerce, Magento.

Why it matters: This is significant because active exploitation has been confirmed by CISA.

What to do: Patch WSO2 products and Adobe Commerce/Magento installations to versions addressing both CVEs.

CVEs: CVE-2026-5430, CVE-2026-71362

G980H dash cam series

CISA has issued an Industrial Control Systems advisory for the G980H dash cam series regarding thirteen critical vulnerabilities that affect authentication and device control. These thirteen CVEs are present in the G980H dash cam firmware version 30010_QHG980HN5294SysFW+. If successfully exploited, an attacker could bypass authentication controls to gain unauthorized access to sensitive data and privileged device functionality. Furthermore, exploitation could allow attackers to modify device configuration and disrupt device operation for the G980H dash cam series.

Why it matters: This could lead to the complete compromise of dash cam devices, including unauthorized data access, unauthorized control, and operational disruption.

What to do: Contact G980H dash cam vendor for firmware patch or discontinue use of affected units.

CVEs: CVE-2026-84399, CVE-2026-82566, CVE-2026-85496, CVE-2026-77967, CVE-2026-88761, CVE-2026-82716, CVE-2026-84403, CVE-2026-75558, CVE-2026-81630, CVE-2026-87118, CVE-2026-82708, CVE-2026-79959, CVE-2026-82585

Omni C20 <1.6.4

CISA issued an ICS advisory detailing vulnerabilities in the Omni C20 that allow for remote code execution. Specifically, Omni C20 versions below 1.6.4 contain three critical vulnerabilities affecting the Omni C20 <1.6.4. Successful exploitation of these vulnerabilities would allow an attacker to run system-level commands. This could also enable attackers to execute arbitrary code on the affected devices.

Why it matters: This enables the complete compromise of affected systems through command or code execution.

What to do: Upgrade Omni C20 to version 1.6.4 or later.

CVEs: CVE-2026-93289, CVE-2026-93290, CVE-2026-93291

Tags: microsoft-sharepoint-mikrotik-routeros, wordpress-core, wso2-products-adobe-commerce-magento, g980h-dash-cam-series, omni-c20-1-6-4