KEV Intelligence Brief — September 30, 2026

Prepared by: Cybersecurity Intelligence | Distribution: Federal Contractors, DevOps, SecOps Leadership Reporting Period: September 24–30, 2026 | Entries Covered: 8 CVEs across 7 vendors

Eight new entries landed in CISA's Known Exploited Vulnerabilities catalog over the past week, spanning network infrastructure, enterprise middleware, mobile operating systems, and web platforms. Three patch deadlines have already passed as of today. The pattern across this cohort is consistent and alarming: the majority of exploitable conditions require no authentication, and several enable direct remote code execution on internet-facing systems. Organizations under BOD 26-04 obligations should treat any missed deadline as an active compliance and risk incident, not merely a scheduling gap.

Deadline Watch: Overdue and Expiring Today

Three vulnerabilities reached their patch deadlines before today, and one expires right now — September 30.

Citrix NetScaler (CVE-2026-88771 and CVE-2026-88772) carried a September 30 deadline, which expires today. Both affect NetScaler ADC and NetScaler Gateway — perimeter systems that are, by design, internet-exposed. CVE-2026-88771 is an improper input validation flaw enabling unauthenticated arbitrary command execution. CVE-2026-88772 is a memory buffer mismanagement vulnerability opening the door to remote code execution or denial of service. Running these two in tandem, an adversary gains a pre-auth RCE path into what is typically one of the most trusted devices in the network edge stack. If patches are not applied today, the immediate interim control is isolation: pull NetScaler management interfaces off public-facing network segments and enforce strict ACLs. Credential rotation for any accounts traversing the gateway should be treated as mandatory, not optional, given the likelihood of session interception.

Microsoft SharePoint (CVE-2026-65660), MikroTik RouterOS (CVE-2026-67279), and WordPress Core (CVE-2026-87902) all carried a September 28 deadline — now two days overdue. The SharePoint code injection vulnerability requires an authorized user, which lowers the immediacy of exploitation slightly but makes it highly relevant in environments where phishing or credential compromise is already in play. If an attacker holds any valid SharePoint credentials, this becomes a reliable lateral movement and code execution vector. Teams running on-premises SharePoint that have not yet applied Microsoft's patch should immediately audit recent privileged session activity and restrict site-collection administration permissions where operationally feasible.

The MikroTik RouterOS entry deserves particular attention. CVE-2026-67279 is not merely a standalone flaw — it is explicitly noted as a chain component enabling unauthenticated exploitation of CVE-2026-86060. This kind of documented chaining behavior in a KEV entry signals active, structured exploitation, not proof-of-concept abuse. MikroTik devices are heavily deployed in SMB, ISP, and operational technology environments that frequently lack mature patch cadences. Any internet-exposed RouterOS instance running an unpatched build should be considered compromised until proven otherwise. Treat it as a forensic triage priority under BOD 26-04 requirements.

WordPress Core (CVE-2026-87902) enables unauthenticated remote file inclusion, allowing attackers to force page-template resolution to load arbitrary local PHP files outside the active theme directories — a direct path to RCE. WordPress installations managed through hosting providers or CDN-integrated pipelines may have automatic updates enabled, but self-hosted or enterprise WordPress environments — particularly those customized for federal or contractor portals — require manual verification. Confirm patch status through your CMS version endpoint and audit wp-content directories for unexpected PHP files that may indicate prior exploitation.