Five exploited vulnerabilities warrant inventory checks and assigned remediation owners. Layer8’s priorities weigh exposure and business impact; fixes below reflect an October 3 review.
All five entered CISA’s exploited catalog during September 20–26. Catalog addition does not establish first disclosure.
| CVE | Applicability and impact | Remediation | KEV added |
|---|---|---|---|
| CVE-2026-65660 | On-premises SharePoint 2016, 2019 or Subscription Edition: authorized low-level users can execute code. | Install every applicable vendor update. | Sept 25 |
| CVE-2026-94127 | BIG-IP APM OAuth Authorization Server: unauthenticated code execution; client-only or resource-server-only deployments excluded. | Obtain F5’s matching 21.1, 17.5 or 17.1 engineering hotfix. | Sept 22 |
| CVE-2026-71362 | Adobe Commerce, B2B and Magento: unauthenticated privilege escalation. | Apply the installed branch’s August security release using Adobe’s matrix. | Sept 24 |
| CVE-2026-93952 | On-premises Arista VeloCloud Orchestrator with Edge certificate authentication: orchestrator/data compromise; hosted and dedicated deployments already patched. | Update the matching train to 5.2.3.16 or 6.4.2.8; other trains require vendor support. | Sept 22 |
| CVE-2026-67279 | RouterOS with reachable SSH: unauthenticated file tampering. | Upgrade the matching branch to 7.24.2, 7.23.4 or 6.49.21. | Sept 25 |
Adobe’s August bulletin reported no known exploitation; September’s catalog entry is later evidence. Arista’s fix-list addition date remains unconfirmed. Patching alone does not establish that a compromised system is clean.
Where servers and networking are included, Layer8’s Managed IT would match asset versions and features, assign patch owners and track exceptions. This could reduce exposure from delayed maintenance. Acceptance should verify the approved update, service function and rollback readiness; suspected compromise requires separately scoped investigation.