Weekly digest

Exploited SharePoint and NetScaler flaws lead this week's cloud and security digest

September 28, 2026

CISA added actively exploited flaws in Microsoft SharePoint, Citrix NetScaler and WSO2 products to its catalog this week. Here is what the sources report, and what to check in your own environment.

Three exploited-vulnerability stories stood out this week. Each paragraph cites the reports it rests on, and the sources are listed at the end.

SharePoint flaw added to CISA's exploited-vulnerabilities catalog

According to The Hacker News, CISA added flaws affecting Microsoft SharePoint and Mikrotik RouterOS to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. SecurityWeek reported on September 27 that the SharePoint flaw is CVE-2026-65660.¹²

CISA's catalog entry describes CVE-2026-65660 as a code injection vulnerability that could allow an authorized attacker to execute code over a network. CISA set a due date of September 28 for U.S. federal agencies to act on it. NVD lists a CVSS v3.1 base score of 8.8, which it rates high.³⁴

What to check in your environment

• Confirm whether any Microsoft SharePoint servers in your environment are reachable from the internet, and whether the vendor's fix has been applied to them.
• Review recent SharePoint server logs for unexpected code execution or new files, since exploitation of this flaw is reported.
• Treat CISA's due date for federal agencies as a useful benchmark for your own patching timeline.

Citrix confirms exploited NetScaler remote code execution flaws

BleepingComputer reported on September 27 that Citrix has confirmed two critical NetScaler remote code execution vulnerabilities, CVE-2026-88771 and CVE-2026-88772, are being exploited in attacks. Citrix has released security updates to fix the flaws.⁵

CISA added both flaws to its Known Exploited Vulnerabilities catalog on September 27. It describes CVE-2026-88771 as an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands, and CVE-2026-88772 as an improper restriction of operations within the bounds of a memory buffer, which could allow remote code execution or denial of service.³

CISA set a due date of September 30 for U.S. federal agencies to act on both flaws. NVD lists a CVSS v4.0 base score of 9.5 for each of them, which it rates critical.³⁶⁷

What to check in your environment

• Identify every NetScaler ADC and NetScaler Gateway appliance you run, including any that are exposed to the internet.
• Confirm that Citrix's security updates have been applied to each appliance, and ask your provider if the appliances are managed for you.
• After patching, review appliance logs for signs of earlier exploitation, since the flaws are reported as exploited in attacks.

WSO2 flaw added to CISA's exploited-vulnerabilities list

BleepingComputer reported on September 25 that CISA warns hackers are exploiting a critical authentication bypass vulnerability, CVE-2026-5430, affecting multiple products from enterprise software provider WSO2. The Hacker News reported the same day that CISA added two critical flaws, affecting WSO2 and Adobe Commerce and Magento, to its catalog based on evidence of active exploitation.⁸⁹

CISA's catalog entry, added on September 24, describes CVE-2026-5430 as a path traversal vulnerability in WSO2 API Control Plane, API Manager, Traffic Manager and Universal Gateway that could allow unrestricted file upload and lead to remote code execution. CISA set a due date of September 27 for U.S. federal agencies. NVD lists a CVSS v3.1 base score of 10.0, which it rates critical.³¹⁰

What to check in your environment

• Find out whether any WSO2 products in your environment are internet-facing, and which versions they run.
• Confirm that the vendor's fixes or mitigations have been applied, and restrict access to management interfaces in the meantime.
• Check upload directories and web server logs on affected systems for unexpected files, given the reported risk of unrestricted file upload.

Sources

1. The Hacker News thehackernews.com
2. SecurityWeek www.securityweek.com
3. CISA KEV catalog www.cisa.gov
4. NVD nvd.nist.gov
5. BleepingComputer www.bleepingcomputer.com
6. NVD nvd.nist.gov
7. NVD nvd.nist.gov
8. BleepingComputer www.bleepingcomputer.com
9. The Hacker News thehackernews.com
10. NVD nvd.nist.gov

This digest is compiled from the public sources above and reviewed by our team before it is published. Incidents change quickly, so check the linked sources for the latest. Last reviewed September 28, 2026.

Talk to us about your environment More insights