🛡️ Cybersecurity Vulnerability Watch

Week of: September 20–26, 2026 Reporting window: Most recently completed Sunday–Saturday (excludes the in-progress week).

1. Top Action Item

Patch internet-facing Microsoft SharePoint servers immediately to address CVE-2026-65660, a code injection vulnerability that CISA added to its Known Exploited Vulnerabilities catalog this week citing evidence of active exploitation. Anyone running on-premises SharePoint — particularly any instance reachable from the internet — should treat this as an emergency change. MikroTik RouterOS was added to KEV at the same time for a second actively exploited flaw, so RouterOS devices in your environment need patching in the same window. If you cannot patch within hours, take the affected systems off the public internet.

2. Exploited This Week

Microsoft Office SharePoint — CVE-2026-65660

• Source: The Hacker News
• Link: The Hacker News
• Severity: CVSS 8.8
• What's happening: CISA added this SharePoint code injection flaw to the Known Exploited Vulnerabilities catalog on Friday, citing evidence of active exploitation in the wild.
• Fix: Apply the vendor patch referenced in the CISA KEV entry (see source); remove internet exposure in the interim.

MikroTik RouterOS — CVE not stated in source

• Source: The Hacker News
• Link: The Hacker News
• Severity: see source
• What's happening: CISA added a second flaw, affecting MikroTik RouterOS, to the KEV catalog on the same day, also citing evidence of active exploitation.
• Fix: Apply the RouterOS update referenced in the CISA KEV entry (see source for the CVE and patched version).

Oracle PeopleSoft — CVE-2026-35273

• Source: The Hacker News
• Link: The Hacker News
• Severity: CVSS 9.8
• What's happening: Google is warning of renewed mass exploitation of this critical unauthenticated remote code execution flaw — first exploited as a zero-day — in a ShinyHunters-linked campaign that bypasses WAFs to deploy web shells across multiple sectors globally.
• Fix: Apply Oracle's PeopleSoft patch and hunt for attacker-deployed web shells; WAF coverage alone is demonstrably insufficient.

Roundcube Webmail — CVE-2026-48842

• Source: The Hacker News
• Link: The Hacker News
• Severity: CVSS 8.1
• What's happening: The Canadian Centre for Cyber Security warned that this pre-authentication SQL injection in the virtuser_query plugin is being actively exploited in the wild.
• Fix: Upgrade Roundcube Webmail to 1.6.16 (for 1.6.x) or 1.7.1 (for 1.7.x).

3. Critical Patch Roundup

Microsoft / Chromium (Edge)

• Source: Google Chrome Releases (referenced by Microsoft MSRC advisories)
• Link: Google Chrome Releases
• Severity: see source
• What's happening: A batch of Chromium CVEs — CVE-2026-95274 through CVE-2026-95283 — covering DevTools output encoding, MediaStream reference resolution, Themes input validation, Views and Platform use-after-free, WakeLock authorization, Omnibox UI misrepresentation, a V8 race condition, and buffer overflows in ANGLE and Tint. Microsoft Edge (Chromium-based) ingests Chromium and is fixed by the corresponding Chromium update.
• Fix: Update Microsoft Edge / Chromium-based browsers to the release that ingests these fixes (see source).

Elementor Website Builder (WordPress plugin) — CVE not yet assigned

• Source: The Hacker News
• Link: The Hacker News
• Severity: CVSS 8.8
• What's happening: An unauthenticated attacker can exploit a cross-site request forgery flaw to create rogue administrator accounts and seize control of a WordPress site, but only after a logged-in admin clicks a crafted link. Only certain plugin versions are affected.
• Fix: Update the Elementor plugin to the fixed release (see source for the exact affected and fixed versions).

Microsoft Office and Windows

• Source: Microsoft MSRC
• Link: Microsoft MSRC — CVE-2026-78510
• Severity: see source
• What's happening: MSRC published informational updates to an Outlook and Word remote code execution vulnerability (CVE-2026-78510) and a Windows Secure Kernel Mode elevation of privilege vulnerability (CVE-2026-85921); the advisories note title, CVSS, and acknowledgement updates only.
• Fix: Apply the Microsoft updates associated with these CVEs per the MSRC update guide (see source).

4. Home / SOHO Impact

• If you run a MikroTik router or home-lab unit, update RouterOS now — a MikroTik RouterOS flaw was added to CISA's actively exploited list this week.
• Update Microsoft Edge (and Chrome) on every computer — this week's Chromium fixes include a V8 race condition, use-after-free bugs, and memory-corruption issues in graphics components.
• If you host your own email with Roundcube Webmail, upgrade to 1.6.16 or 1.7.1 today — attackers are actively exploiting the pre-auth SQL injection.
• Never run commands copied from a "verify you are human" / CAPTCHA page. The Lunex/Psychadelic Stealer campaign uses fake Cloudflare-style verification pages to push malware that steals browser credentials.
• If you run a WordPress site, update the Elementor plugin — a crafted link clicked by an admin can hand an attacker full control of the site.
• Mac users: be wary of script-based installers and lures. A new PamStealer variant uses a JavaScript-for-Automation dropper and server-side decryption; stick to software from official sources.

5. Enterprise Impact

• Treat SharePoint and MikroTik as emergency changes. Both are in CISA KEV this week. Inventory every on-prem SharePoint instance and every RouterOS device, patch, and confirm no internet-exposed instances remain unpatched.
• Oracle PeopleSoft: patch and hunt. CVE-2026-35273 (CVSS 9.8) is under renewed mass exploitation with WAF bypass and web shell deployment — assume WAFs are not a control here, and scan PeopleSoft web roots for dropped shells and persistence.
• Roundcube Webmail: patch and review logs. CVE-2026-48842 is a pre-auth SQL injection, so successful exploitation leaves no authentication trail to alert on. Check for anomalous database queries and mailbox access around the exploitation window.
• Audit GitHub Actions usage. Two actions-cool actions (issues-helper, maintain-one-comment) were disabled a second time after becoming accessible again and resuming execution of Mini Shai-Hulud malware; remove or replace them in workflows and review logs of any workflow that invoked them since May 2026.
• Kiteworks customers: the vendor urged customers to shut systems down for a nine-hour weekend window after receiving threat intelligence from federal authorities about a possible imminent attack. Monitor the vendor's channel for follow-up guidance and patch/maintain current versions.
• Review service accounts in Microsoft 365. Reporting on M365 data theft in Chile shows forgotten "ghost" service accounts can defeat otherwise sound employee-account lockdowns — inventory and disable unused service accounts.
• Cloudflare Containers customers: a flaw that let one container read another customer's leftover disk data has been fixed by Cloudflare; verify you are on the current platform build and review data-handling assumptions for multi-tenant workloads.
• AI agent deployments are an emerging exposure class this week: prompt injection in the Manus agentic app and the "Salesbleed" Salesforce-to-Slack chain both show that agents can be steered into trusted internal channels. Restrict agent access to external content and outbound messaging scopes.

6. What To Patch First

1. Microsoft SharePoint — CVE-2026-65660, vendor patch per CISA KEV (exploited in the wild, KEV addition)
2. MikroTik RouterOS — CVE per CISA KEV entry, see source (exploited in the wild, KEV addition)
3. Oracle PeopleSoft — CVE-2026-35273, vendor patch (CVSS 9.8, mass exploitation, WAF bypass)
4. Roundcube Webmail — upgrade to 1.6.16 / 1.7.1, CVE-2026-48842 (actively exploited, pre-auth SQLi)
5. Microsoft Edge / Chromium browsers — current Chromium release covering CVE-2026-95274 through CVE-2026-95283 (widely deployed, multiple memory-safety flaws)
6. Elementor WordPress plugin — fixed release per vendor, no CVE yet (CVSS 8.8, full site takeover, widely deployed)
7. Microsoft Office / Windows — updates per MSRC for CVE-2026-78510 and CVE-2026-85921 (widely deployed, severity see source)

Sources

• SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild — https://thehackernews.com/2026/09/sharepoint-rce-and-mikrotik-routeros.html
• Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells — https://thehackernews.com/2026/09/attackers-bypass-wafs-to-exploit-oracle.html
• Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild — https://thehackernews.com/2026/09/roundcube-pre-auth-sql-injection-flaw.html
• Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link — https://thehackernews.com/2026/09/elementor-csrf-flaw-lets-attackers-take.html
• Google Chrome Releases (Chromium CVEs ingested by Microsoft Edge) — https://chromereleases.googleblog.com/2026
• CVE-2026-78510 Microsoft Outlook and Word Remote Code Execution Vulnerability — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78510
• CVE-2026-85921 Windows Secure Kernel Mode Elevation of Privilege Vulnerability — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85921
• Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware — https://thehackernews.com/2026/09/compromised-github-actions-came-back.html
• Kiteworks Urges Customers to Shut Down Systems for 9 Hours Over Possible Cyber Attack — https://thehackernews.com/2026/09/kiteworks-urges-customers-to-shut-down.html
• Cloudflare Fixes Flaw That Let One Container Read Another Customer's Leftover Disk Data — https://thehackernews.com/2026/09/cloudflare-fixes-flaw-that-let-one.html
• Ghost Service Accounts Enable M365 Data Theft in Chile — https://www.darkreading.com/cyberattacks-data-breaches/ghost-service-accounts-m365-data-theft-chile
• 'Salesbleed' Exploits Salesforce Agents to Enable Slack Phishing — https://www.darkreading.com/application-security/salesbleed-exploits-salesforce-agents-slack-phishing
• Prompt-Injection Bug Hits $4B Agentic AI App 'Manus' — https://www.darkreading.com/application-security/prompt-injection-bug-agentic-ai-app-manus
• Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials — https://thehackernews.com/2026/09/lunex-stealer-abuses-amd-driver-to.html
• PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence — https://thehackernews.com/2026/09/pamstealer-macos-malware-adds-live-c2.html