CISA KEV Flash: 10 CVEs Added — MikroTik, Microsoft SharePoint, F5 & Check Point Under Active Attack | Security Arsenal

Between September 21 and September 25, 2026, CISA added ten new CVEs to the Known Exploited Vulnerabilities (KEV) catalog — the federal government's authoritative list of vulnerabilities confirmed to be actively exploited in the wild. This is not a theoretical exposure list. Every entry on this page represents a vulnerability that adversaries are using right now against real targets.

This wave is notable for its concentration in network edge and access infrastructure: MikroTik RouterOS, F5 BIG-IP APM, Check Point gateways, Arista VeloCloud SD-WAN orchestration, and Zyxel managed switches. These are the devices that sit at the trust boundary of the enterprise — the exact tier that ransomware initial access brokers and nation-state intrusion sets have systematically targeted over the past three years. Alongside them, enterprise application platforms (Microsoft SharePoint, WordPress Core, Adobe Commerce/Magento, WSO2) provide secondary footholds for lateral movement and persistence.

If any of these products are internet-facing in your environment, treat this briefing as an emergency patch authorization.

Active Exploitation Intelligence

CVE-2026-67279 — MikroTik RouterOS Improper Enforcement of Behavioral Workflow

Added to KEV: 2026-09-25
Vulnerability type: Improper enforcement of behavioral workflow (CWE-841) — authentication/session logic bypass
Exploitation method: Allows an unauthenticated client to initiate operations outside the intended workflow sequence, effectively bypassing authentication controls on the RouterOS management plane. Pre-auth exploitation of RouterOS management interfaces has historically led to full device compromise, credential harvesting, and botnet conscription.
Threat actors: Not publicly attributed at time of publication. MikroTik devices have a long history of abuse by botnet operators (e.g., Mēris-style DDoS botnets) and as proxy infrastructure for state-aligned actors. Given the unauthenticated nature, assume mass scanning is underway.
CVSS: Not yet published by NVD at time of writing; treat as Critical given unauthenticated exploitation confirmed.
Public PoC: No confirmed public PoC at time of writing — exploitation is occurring via threat actor tooling.
CISA required action: Apply vendor mitigations per MikroTik advisory or discontinue use of the product if mitigations are unavailable. Binding deadline for federal civilian agencies applies (typically 3 weeks from KEV addition — verify current BOD 22-01 due date in the KEV catalog entry).

CVE-2026-65660 — Microsoft SharePoint Code Injection

Added to KEV: 2026-09-25
Vulnerability type: Code injection (CWE-94)
Exploitation method: Allows an authorized attacker to execute arbitrary code over the network against the SharePoint server. While authentication is required, SharePoint environments frequently over-provision access, and compromised low-privilege accounts (via phishing or credential stuffing) turn this into a full server-side RCE — the classic SharePoint exploitation chain seen in prior ToolShell-class campaigns.
Threat actors: Not publicly attributed. SharePoint has been a priority target for both ransomware affiliates (initial access → domain compromise) and espionage actors (document repository access).
CVSS: Not yet published; authenticated network RCE on SharePoint historically scores 8.0+.
Public PoC: None confirmed public.
CISA required action: Apply the Microsoft security update per the vendor advisory. Federal deadline binding per BOD 22-01.

CVE-2026-87902 — WordPress Core Remote File Inclusion

Added to KEV: 2026-09-25
Vulnerability type: Remote file inclusion (CWE-98) in page-template resolution
Exploitation method: An unauthenticated attacker can manipulate page-template resolution to include attacker-controlled files, leading to remote code execution on the underlying web server. Core-level (not plugin) RFI is rare and extremely dangerous given WordPress's ~40%+ share of the public web.
Threat actors: Not publicly attributed. Expect rapid weaponization by commodity web shell crews and SEO-spam/credential-harvesting operations; WordPress core vulnerabilities are typically folded into automated exploit kits within days.
CVSS: Not yet published; unauthenticated RFI on WordPress Core should be treated as 9.8-equivalent urgency.
Public PoC: None confirmed public at time of writing.
CISA required action: Update WordPress Core to the patched release immediately; enable automatic core updates where operationally feasible.

CVE-2026-5430 — WSO2 Multiple Products Path Traversal

Added to KEV: 2026-09-24
Affected products: WSO2 API Control Plane, API Manager, Traffic Manager, Universal Gateway
Vulnerability type: Path traversal (CWE-22)
Exploitation method: Allows unrestricted file access/write outside the intended directory. On API management infrastructure, path traversal commonly chains to arbitrary file read (credential/config theft) or file write (web shell deployment → RCE).
Threat actors: Not publicly attributed. API gateway infrastructure is a high-value target for actors seeking to intercept, modify, or replay API traffic.
CVSS: Not yet published; treat as High-to-Critical given confirmed exploitation.
Public PoC: None confirmed public.
CISA required action: Apply WSO2 security updates per advisory WSO2-2026 advisory series; restrict management interface exposure.

CVE-2026-71362 — Adobe Commerce & Magento Incorrect Authorization

Added to KEV: 2026-09-24
Vulnerability type: Incorrect authorization (CWE-863)
Exploitation method: Authorization bypass allowing attackers to perform actions beyond their privilege level. In e-commerce platforms, this class of flaw is typically exploited for admin account creation, payment skimmer injection (Magecart-style), and customer data theft.
Threat actors: Not publicly attributed. Magento/Adobe Commerce has a decade-long history of mass exploitation by card-skimming groups within hours of patch release ("patch Tuesday, exploit Wednesday" dynamics).
CVSS: Not yet published; treat as Critical for internet-facing storefronts.
Public PoC: None confirmed public.
CISA required action: Apply the Adobe security update (APSB advisory series) immediately; audit for unauthorized admin accounts and modified checkout templates.

CVE-2026-93952 — Arista VeloCloud Orchestrator Improper Input Validation

Added to KEV: 2026-09-22
Vulnerability type: Improper input validation (CWE-20)
Exploitation method: Allows a remote attacker to access privileged functionality on the on-prem VeloCloud Orchestrator (VCO). SD-WAN orchestrators control the entire overlay network — compromise here means visibility and control over every connected branch and site.
Threat actors: Not publicly attributed. SD-WAN management planes are strategic targets for actors seeking persistent network-wide access.
CVSS: Not yet published; treat as Critical for internet-reachable VCO instances.
Public PoC: None confirmed public.
CISA required action: Apply the Arista/VMware advisory fixes; VCO management interfaces must never be internet-exposed.

CVE-2026-94127 — F5 BIG-IP APM Heap-Based Buffer Overflow

Added to KEV: 2026-09-22
Vulnerability type: Heap-based buffer overflow (CWE-122)
Exploitation method: Triggered when an access policy and an OAuth profile are configured on a virtual server. Successful exploitation can crash the Traffic Management Microkernel (TMM) — and buffer overflows in TMM have historically been exploitable for remote code execution. This affects the access policy manager tier that brokers authentication for the enterprise.
Threat actors: Not publicly attributed. F5 BIG-IP vulnerabilities are among the most rapidly weaponized edge-device flaws; prior BIG-IP CVEs (e.g., the TMUI and iControl RCE waves) were exploited by both nation-state actors and ransomware groups within days of disclosure.
CVSS: Not yet published; treat as Critical given the pre-authentication adjacency of the attack surface.
Public PoC: None confirmed public.
CISA required action: Apply F5 hotfix per the F5 security advisory; audit virtual servers with OAuth profiles + access policies as the exposed configuration.

CVE-2026-93616 — Check Point Multiple Products

Added to KEV: 2026-09-22
Affected products: Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, SmartEvent
Exploitation method: Exploitation of the management/log infrastructure of Check Point environments. The management server is the brain of the firewall estate — compromise yields policy visibility, log tampering capability, and a launch point for gateway-level attacks.
Threat actors: Not publicly attributed. Check Point management infrastructure was previously targeted in the 2024 CVE-2024-24919 campaign (information disclosure → credential theft → lateral movement).
CVSS: Not yet published; treat as High-to-Critical.
Public PoC: None confirmed public.
CISA required action: Apply the Check Point hotfix per the relevant sk (SecureKnowledge) article; restrict management interfaces to dedicated management networks.

CVE-2026-85102 — Check Point Security Gateway / Spark Firewall Improper Certificate Validation

Added to KEV: 2026-09-22
Vulnerability type: Improper certificate validation (CWE-295) in Site-to-Site VPN and Remote Access VPN
Exploitation method: Enables adversary-in-the-middle attacks against VPN tunnels — interception and decryption of VPN traffic, credential capture, and session hijacking. This is an espionage-grade primitive: silent interception of encrypted corporate traffic.
Threat actors: Not publicly attributed, but AitM capability against VPN concentrators is a signature objective of state-aligned collection operations.
CVSS: Not yet published; treat as High-to-Critical for any gateway terminating production VPN tunnels.
Public PoC: None confirmed public.
CISA required action: Apply the Check Point hotfix; review VPN peer certificate configurations and enable strict certificate validation.

CVE-2026-7273 — Zyxel GS1900 Series Stack-Based Buffer Overflow

Added to KEV: 2026-09-21
Vulnerability type: Stack-based buffer overflow (CWE-121) in the CGI program
Exploitation method: A LAN-based, unauthenticated attacker can trigger the overflow via crafted requests to the switch's web management CGI, achieving code execution on the switch. While LAN-adjacent (limiting initial exposure), compromised switches enable traffic interception, VLAN hopping, and persistence in the network fabric — and GS1900 units are ubiquitous in SMB and branch environments.
Threat actors: Not publicly attributed. Zyxel devices are perennial botnet and initial-access targets.
CVSS: Not yet published; treat as High (LAN-adjacency tempers but does not eliminate risk).
Public PoC: None confirmed public.
CISA required action: Apply the Zyxel firmware update; isolate switch management interfaces to a dedicated management VLAN.

Affected Organizations Assessment

Exposed Environments

MikroTik RouterOS — Pervasive in SMB, ISP/WISP, MSP-managed, and branch-office environments globally. RouterOS management interfaces (Winbox 8291, WebFig 80/443, API 8728) are routinely found internet-exposed. Shodan-indexed MikroTik populations number in the hundreds of thousands.
Microsoft SharePoint — On-premises SharePoint (Subscription Edition, 2019, 2016) is entrenched in government, legal, healthcare, and manufacturing. Patch adoption on on-prem SharePoint lags badly; many organizations defer cumulative updates for months.
WordPress Core — ~40% of the public web. Any organization with marketing sites, blogs, or microsites. Managed hosting providers typically push core updates fast; self-hosted instances are the exposure tail.
F5 BIG-IP APM — Enterprise and government remote access/VPN concentration. BIG-IP management and virtual server interfaces are high-value, low-tolerance targets.
Check Point — Enterprise perimeter and VPN. The dual CVE release (management plane + gateway certificate validation) compounds risk for Check Point-heavy estates.
Arista VeloCloud (VMware SD-WAN) — Enterprises with distributed branch footprints: retail, banking, healthcare, logistics.
WSO2 — API management in financial services, telecom, and government integration layers, especially across EMEA and APAC.
Adobe Commerce/Magento — Retail e-commerce; large legacy Magento Open Source install base with notoriously slow patching.
Zyxel GS1900 — SMB and branch switching; frequently deployed and forgotten, firmware rarely updated.

Exploitation Velocity by Sector

Historically, edge network devices (MikroTik, F5, Check Point, Zyxel) see the fastest weaponization — scanning begins within 24–72 hours of disclosure and ransomware affiliates purchase access within the first week. CMS/e-commerce (WordPress, Magento) see the broadest mass exploitation via automated tooling. Collaboration platforms (SharePoint) see targeted exploitation against government, legal, and healthcare for data theft and extortion. Sectors that should assume they are already being scanned: government, healthcare, financial services, critical infrastructure, and education.

Detection Engineering

Sigma Rules

The following rules target observable exploitation behaviors for the highest-priority CVEs in this batch: suspicious child processes from SharePoint/WordPress web server workers, anomalous VPN authentication artifacts (F5/Check Point), and unexpected management-plane access to network edge devices.

YAML

---
title: Webshell Spawn From Web Server Worker Process - SharePoint WordPress Magento
id: 8f3a1c2e-9b4d-4e6f-a1b2-kev2026092501
status: experimental
description: Detects suspicious child processes spawned by IIS (w3wp), Apache/Nginx/PHP workers, or Java processes associated with SharePoint, WordPress, Magento, or WSO2. Consistent with post-exploitation following CVE-2026-65660 (SharePoint code injection), CVE-2026-87902 (WordPress RFI), CVE-2026-71362 (Magento authz bypass), and CVE-2026-5430 (WSO2 path traversal).
author: Security Arsenal Threat Intelligence
date: 2026/09/25
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\php-cgi.exe'
      - '\php.exe'
      - '\java.exe'
      - '\tomcat9.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\nltest.exe'
      - '\ipconfig.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate SharePoint timer jobs and search crawl components (review command lines)
  - WSO2/Java application servers executing management scripts
level: high
tags:
  - attack.execution
  - attack.t1059
  - attack.t1190
  - cve.2026.65660
  - cve.2026.87902
  - cve.2026.5430
---
title: Webshell or Command Execution From Web Server Process - Linux
id: 7e2b9d1f-4a5c-4d8e-b3f4-kev2026092502
status: experimental
description: Detects shell or reconnaissance commands spawned by web server, PHP-FPM, or Java processes on Linux. Targets post-exploitation of CVE-2026-87902 (WordPress Core RFI), CVE-2026-5430 (WSO2 path traversal), and CVE-2026-71362 (Adobe Commerce/Magento).
author: Security Arsenal Threat Intelligence
date: 2026/09/25
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/apache2'
      - '/httpd'
      - '/nginx'
      - '/php-fpm'
      - '/java'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
      - '/id'
      - '/whoami'
      - '/uname'
      - '/cat'
  condition: selection_parent and selection_child
falsepositives:
  - Application plugins legitimately shelling out (review full command line and working directory)
  - Health-check scripts
level: high
tags:
  - attack.execution
  - attack.t1059
  - attack.t1190
  - cve.2026.87902
---
title: Anomalous Access to Network Edge Device Management Interfaces
id: 5c1d8e3a-2f6b-4a9d-c5e6-kev2026092203
status: experimental
description: Detects authentication or connection attempts to edge device management planes (MikroTik RouterOS, F5 BIG-IP, Check Point, Zyxel, VeloCloud Orchestrator) from unusual source IPs or outside maintenance windows. Relevant to CVE-2026-67279, CVE-2026-94127, CVE-2026-93616, CVE-2026-85102, CVE-2026-7273, and CVE-2026-93952 exploitation and pre-exploitation reconnaissance.
author: Security Arsenal Threat Intelligence
date: 2026/09/25
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: firewall
  product: zeek
detection:
  selection_dst_port:
    dst_port:
      - 8291    # MikroTik Winbox
      - 8728    # MikroTik API
      - 8729    # MikroTik API-SSL
      - 443
      - 8443
      - 22
  selection_dst_ip:
    dst_ip|cidr:
      - 'DEVICE_MGMT_SUBNET_PLACEHOLDER/24'
  filter_mgmt_sources:
    src_ip|cidr:
      - 'APPROVED_MGMT_HOSTS_PLACEHOLDER/28'
      - 'JUMPBOX_SUBNET_PLACEHOLDER/24'
  condition: selection_dst_port and selection_dst_ip and not filter_mgmt_sources
falsepositives:
  - Network scanning tools (Nessus, Qualys, Tenable) - maintain a scanner exclusion list
  - New administrators or automation not yet in the approved list
level: medium
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1078
  - cve.2026.67279
  - cve.2026.94127
  - cve.2026.85102

Deployment note: Replace DEVICE_MGMT_SUBNET_PLACEHOLDER and APPROVED_MGMT_HOSTS_PLACEHOLDER with your actual management network CIDRs and approved jump-host ranges before deployment. Tune the web-server rules against your SharePoint and WSO2 baselines for 48–72 hours in monitor mode.

KQL — Microsoft Sentinel Hunting Query

This query hunts for post-exploitation behavior associated with this KEV wave: web server worker processes spawning shells (SharePoint/WordPress exploitation), suspicious connections to edge-device management ports, and unusual authentication patterns against VPN concentrators.

KQL — Microsoft Sentinel / Defender

// Security Arsenal - KEV Wave 2026-09-21..25 Hunt
// Targets: CVE-2026-65660, CVE-2026-87902, CVE-2026-5430, CVE-2026-71362 (web tier)
//          CVE-2026-67279, CVE-2026-94127, CVE-2026-85102 (edge device tier)
let Lookback = 14d;
let SuspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","certutil.exe","bitsadmin.exe","mshta.exe","wscript.exe","cscript.exe","rundll32.exe","regsvr32.exe","whoami.exe","net.exe","nltest.exe"]);
let WebParents = dynamic(["w3wp.exe","httpd.exe","nginx.exe","php-cgi.exe","java.exe","tomcat9.exe"]);
let EdgeMgmtPorts = dynamic([8291,8728,8729,8443,4433,19080]);
// Part 1: Web server worker spawning suspicious child processes
let WebProcessHunt =
DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessFileName in~ (WebParents)
| where FileName in~ (SuspiciousChildren)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, InitiatingProcessRemoteIP = "", ReportId
| extend HuntCategory = "WebShell_ChildProcess";
// Part 2: Inbound connections to edge device management ports from non-management sources
let EdgeMgmtHunt =
DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where RemotePort in (EdgeMgmtPorts) and ActionType == "InboundConnectionAccepted"
| extend HuntCategory = "EdgeMgmt_Inbound"
| project TimeGenerated, DeviceName, InitiatingProcessFileName = FileName, InitiatingProcessCommandLine = "", FileName = "", ProcessCommandLine = "", AccountName = "", InitiatingProcessRemoteIP = RemoteIP, ReportId, HuntCategory;
// Part 3: VPN/APM authentication anomalies - failed auth bursts followed by success (AitM / cert bypass probing)
let AuthAnomalyHunt =
SigninLogs
| where TimeGenerated > ago(Lookback)
| summarize FailedCount = countif(ResultType != 0), SuccessCount = countif(ResultType == 0), Apps = make_set(AppDisplayName) by IPAddress, UserPrincipalName, bin(TimeGenerated, 1h)
| where FailedCount >= 5 and SuccessCount >= 1
| extend HuntCategory = "Auth_BurstThenSuccess"
| project TimeGenerated, DeviceName = "", InitiatingProcessFileName = "", InitiatingProcessCommandLine = "", FileName = "", ProcessCommandLine = "", AccountName = UserPrincipalName, InitiatingProcessRemoteIP = IPAddress, ReportId = "", HuntCategory, FailedCount, SuccessCount, Apps;
union WebProcessHunt, EdgeMgmtHunt, AuthAnomalyHunt
| sort by TimeGenerated desc

Remediation & Inventory Script

The following PowerShell script inventories exposed instances across the affected product families, checks patch/update status where locally queryable, flags internet-facing management interfaces, and produces a prioritized remediation report.

PowerShell

<#
.SYNOPSIS
    Security Arsenal - KEV Wave 2026-09-21..25 Exposure Inventory & Patch Verification
.DESCRIPTION
    Inventories vulnerable products affected by the latest CISA KEV additions,
    verifies patch status where possible, and flags risky configurations:
      - Microsoft SharePoint on-prem build check (CVE-2026-65660)
      - WordPress Core version check (CVE-2026-87902)
      - Network scan for MikroTik / F5 / Check Point / Zyxel / VeloCloud mgmt interfaces
    Run as Administrator on a management host with network visibility.
.PARAMETER Subnets
    One or more CIDR ranges to scan for edge device management interfaces.
.EXAMPLE
    .\Invoke-KEVWaveInventory.ps1 -Subnets "10.0.0.0/24","192.168.1.0/24" -OutputPath "C:\Reports"
#>
[CmdletBinding()]
param(
    [string[]]$Subnets = @("192.168.1.0/24"),
    [string]$OutputPath = "$env:TEMP\KEVWaveReport",
    [string[]]$WordPressPaths = @("C:\inetpub\wwwroot", "D:\websites"),
    [switch]$SharePointServer
)

$ErrorActionPreference = 'SilentlyContinue'
$report = [System.Collections.Generic.List[object]]::new()
New-Item -ItemType Directory -Path $OutputPath -Force | Out-Null

function Add-Finding {
    param($Category, $Asset, $Status, $Severity, $Detail, $CVE)
    $report.Add([pscustomobject]@{
        Timestamp = (Get-Date).ToString('s')
        Category  = $Category
        Asset     = $Asset
        Status    = $Status
        Severity  = $Severity
        Detail    = $Detail
        CVE       = $CVE
    })
}

# ---------------- 1. SharePoint patch verification (CVE-2026-65660) ----------------
Write-Host "[*] Checking SharePoint installation status..." -ForegroundColor Cyan
$spInstalled = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\*" -ErrorAction SilentlyContinue
if ($spInstalled) {
    $spSetup = Get-WmiObject -Class Win32_Product -Filter "Name LIKE '%SharePoint%'" -ErrorAction SilentlyContinue
    foreach ($p in $spSetup) {
        Add-Finding -Category "SharePoint" -Asset $env:COMPUTERNAME -Status "REVIEW REQUIRED" `
            -Severity "CRITICAL" -CVE "CVE-2026-65660" `
            -Detail "Product: $($p.Name) v$($p.Version). Verify September 2026 (or later) SharePoint CU/security update installed via Central Admin > Check product and patch installation status."
    }
    # Check installed updates for recent SharePoint KBs
    $recentKBs = Get-HotFix | Where-Object { $_.InstalledOn -gt (Get-Date).AddDays(-45) }
    if ($recentKBs) {
        Add-Finding -Category "SharePoint" -Asset $env:COMPUTERNAME -Status "INFO" -Severity "INFO" `
            -CVE "CVE-2026-65660" -Detail "Recent updates found: $(($recentKBs.HotFixID) -join ', '). Confirm the specific KEV remediation KB is present."
    } else {
        Add-Finding -Category "SharePoint" -Asset $env:COMPUTERNAME -Status "LIKELY UNPATCHED" -Severity "CRITICAL" `
            -CVE "CVE-2026-65660" -Detail "No hotfixes installed in the last 45 days. Apply the Microsoft security update immediately."
    }
} else {
    Add-Finding -Category "SharePoint" -Asset $env:COMPUTERNAME -Status "NOT INSTALLED" -Severity "INFO" `
        -CVE "CVE-2026-65660" -Detail "SharePoint registry keys not found on this host."
}

# ---------------- 2. WordPress Core version check (CVE-2026-87902) ----------------
Write-Host "[*] Scanning for WordPress Core installations..." -ForegroundColor Cyan
foreach ($base in $WordPressPaths) {
    Get-ChildItem -Path $base -Recurse -Filter "version.php" -Depth 4 -ErrorAction SilentlyContinue |
        Where-Object { $_.FullName -like "*wp-includes*" } | ForEach-Object {
            $content = Get-Content $_.FullName -Raw
            if ($content -match "\
$wp_version\s*=\s*'([\d\.]+)'") {
                $ver = $Matches[1]
                Add-Finding -Category "WordPress" -Asset $_.FullName -Status "VERSION FOUND" -Severity "CRITICAL" `
                    -CVE "CVE-2026-87902" `
                    -Detail "WordPress Core v$ver detected. Verify against the patched release in the WordPress security advisory; enable auto core updates: define('WP_AUTO_UPDATE_CORE', true);"
            }
        }
}

# ---------------- 3. Edge device management interface discovery ----------------
Write-Host "[*] Scanning subnets for exposed edge device management interfaces..." -ForegroundColor Cyan
$portMap = @{
    8291  = @{ Product = "MikroTik Winbox";       CVE = "CVE-2026-67279" }
    8728  = @{ Product = "MikroTik API";          CVE = "CVE-2026-67279" }
    8729  = @{ Product = "MikroTik API-SSL";      CVE = "CVE-2026-67279" }
    443   = @{ Product = "Web Mgmt (F5/CP/VeloCloud/Generic)"; CVE = "CVE-2026-94127/CVE-2026-93616/CVE-2026-93952" }
    8443  = @{ Product = "Alt Web Mgmt";          CVE = "CVE-2026-93952" }
    19080 = @{ Product = "VeloCloud Orchestrator"; CVE = "CVE-2026-93952" }
    80    = @{ Product = "Web Mgmt HTTP (Zyxel CGI target)"; CVE = "CVE-2026-7273" }
}

function Test-Port {
    param($IP, $Port, $TimeoutMs = 400)
    $client = New-Object System.Net.Sockets.TcpClient
    try {
        $async = $client.BeginConnect($IP, $Port, $null, $null)
        $ok = $async.AsyncWaitHandle.WaitOne($TimeoutMs, $false)
        if ($ok -and $client.Connected) { $client.EndConnect($async); return $true }
    } catch {} finally { $client.Close() }
    return $false
}

foreach ($subnet in $Subnets) {
    $parts = $subnet -split '/'
    $baseIP = $parts[0].Split('.')
    Write-Host "    -> Scanning $subnet" -ForegroundColor Gray
    1..254 | ForEach-Object -Parallel {
        $ip = "$($using:baseIP[0]).$($using:baseIP[1]).$($using:baseIP[2]).$_"
        foreach ($port in $using:portMap.Keys) {
            if (Test-Port -IP $ip -Port $port) {
                $info = $using:portMap[$port]
                [pscustomobject]@{ IP = $ip; Port = $port; Product = $info.Product; CVE = $info.CVE }
            }
        }
    } -ThrottleLimit 64 | ForEach-Object {
        Add-Finding -Category "EdgeDevice" -Asset "$($_.IP):$($_.Port)" -Status "EXPOSED - VERIFY & PATCH" `
            -Severity "CRITICAL" -CVE $_.CVE `
            -Detail "$($_.Product) management interface reachable. Confirm vendor advisory applied; restrict to dedicated management network."
    }
}

# ---------------- 4. Validation guidance & report ----------------
Write-Host "[*] Generating report..." -ForegroundColor Cyan
$csvPath = Join-Path $OutputPath "KEVWave_2026-09-25_Inventory_$(Get-Date -Format 'yyyyMMdd_HHmm').csv"
$report | Sort-Object Severity, Category | Export-Csv -Path $csvPath -NoTypeInformation

Write-Host ""
Write-Host "=== KEV WAVE INVENTORY COMPLETE ===" -ForegroundColor Green
Write-Host "Critical findings: $(($report | Where-Object Severity -eq 'CRITICAL').Count)" -ForegroundColor Red
Write-Host "Report saved to: $csvPath" -ForegroundColor Green
Write-Host ""
Write-Host "POST-PATCH VALIDATION CHECKLIST:" -ForegroundColor Yellow
Write-Host "  1. SharePoint: Central Admin > Servers in Farm > confirm configuration database version matches post-patch build."
Write-Host "  2. WordPress: wp core version (WP-CLI) matches the patched release; test template rendering on staging."
Write-Host "  3. MikroTik: /system package print - confirm RouterOS at fixed release; disable Winbox/API from WAN: /ip firewall filter."
Write-Host "  4. F5 BIG-IP: tmsh show sys version - confirm hotfix; review virtual servers with OAuth profiles."
Write-Host "  5. Check Point: show installer status / cpinfo -y all - confirm JHF take includes the fix."
Write-Host "  6. Re-run this script to confirm management interfaces are no longer reachable from unauthorized segments."

Patch & Remediation Priorities

Priority Order (patch first → last)

CVE-2026-67279 — MikroTik RouterOS (pre-auth) — Unauthenticated exploitation + massive exposed population = highest mass-exploitation risk. Update RouterOS to the fixed release per mikrotik.com/download; firewall Winbox/API/WebFig from WAN immediately.
CVE-2026-94127 — F5 BIG-IP APM (heap overflow, edge) — Audit virtual servers with access policy + OAuth profile; apply the F5 hotfix via MyF5 / iHealth. Prior BIG-IP KEVs were weaponized within days.
CVE-2026-65660 — Microsoft SharePoint (code injection) — Apply the September 2026+ SharePoint security update per Microsoft Security Update Guide. On-prem SharePoint is a proven ransomware initial-access vector.
CVE-2026-87902 — WordPress Core (unauthenticated RFI) — Update core immediately (wordpress.org/news/category/security/); enable auto-updates; deploy WAF virtual patching in the interim.
CVE-2026-85102 — Check Point Gateway VPN cert validation — Apply the Check Point hotfix per the relevant sk article via Check Point Support Center. Active AitM against VPN tunnels means silent interception may already be occurring — review VPN logs.
CVE-2026-93616 — Check Point Management/Log Servers — Patch management plane; restrict to dedicated management networks (should already be segmented — verify).
CVE-2026-5430 — WSO2 (path traversal) — Apply WSO2 security update; audit for unexpected files in web-accessible directories.
CVE-2026-71362 — Adobe Commerce/Magento (authz bypass) — Apply APSB patch; audit admin users, review checkout templates for skimmer injection.
CVE-2026-93952 — Arista VeloCloud Orchestrator — Apply vendor fix; confirm VCO is not internet-reachable.
CVE-2026-7273 — Zyxel GS1900 (LAN-adjacent) — Firmware update; isolate management to dedicated VLAN. Lower urgency due to LAN requirement, but don't skip — flat networks make this trivially reachable post-foothold.

Workarounds Where Patches Are Unavailable

MikroTik: Disable Winbox, API, and WebFig from WAN interfaces (/ip firewall filter drop rules); restrict to management VLAN by source IP.
SharePoint: Place the farm behind a WAF with virtual patching; enforce MFA and least-privilege on all SharePoint service and user accounts; monitor w3wp.exe child processes (rules above).
WordPress: WAF rule blocking template-resolution parameter manipulation; disable direct PHP execution in uploads; consider read-only filesystem for core.
F5: Where feasible, remove OAuth profiles from affected virtual servers until patched; restrict self-IP access.
Check Point VPN: Enforce strict peer certificate validation; consider temporarily restricting VPN to certificate-authenticated clients only.
All edge devices: If the management interface is internet-facing today, that is itself a finding. Fix the architecture, not just the version.

CISA Compliance Deadlines

Under BOD 22-01, federal civilian executive branch agencies must remediate KEV entries by the due date specified in each catalog entry (typically 2–3 weeks from addition for these CVEs — verify each entry's "Due date" field at cisa.gov/known-exploited-vulnerabilities-catalog). Private-sector organizations are not legally bound, but the KEV deadline is the best available triage benchmark: CISA is telling you the exploitation clock has already run out.

Bottom Line

This KEV wave is an edge-device and access-infrastructure event. The pattern — RouterOS, BIG-IP APM, Check Point VPN, SD-WAN orchestration — mirrors the intrusion playbook that has defined the last several years of ransomware and espionage operations: compromise the box that guards the door, then live inside the network's trust fabric. SharePoint and WordPress add mass-scale secondary vectors.

Patch the perimeter first. Verify with detection, not assumption. And if your management interfaces are internet-reachable, that was already a breach waiting for a CVE number.

Related Resources

Security Arsenal Penetration Testing Managed SOC & MDR AlertMonitor Platform From The Dark Side Intel Hub

CISA KEV Flash: 10 CVEs Added — MikroTik, Microsoft SharePoint, F5 & Check Point Under Active Attack