grc-scanSecurity & governance
← Back to homethe latest briefing →
Patch tracker28 September 2026Archived edition

What to patch now

This edition was published on 28 September 2026 and is kept here unchanged as a record. The threats and cases it describes may have moved on — read the latest briefing for the current picture.

The takeaway

This week's fixes span the whole chain that keeps a business online — the website it runs, the router at the front desk, and the network gear its IT provider manages out of sight.

  • Run WordPress or Adobe Commerce/Magento? Update now — both let an outsider in without any login.
  • Have a MikroTik router or a Check Point Spark firewall? Check for a firmware update today.
  • Rely on an IT provider for VPN, remote access, or SharePoint? Ask them to confirm patches are applied.

What to patch now — 28 September 2026

Source: CISA Known Exploited Vulnerabilities (KEV) catalog — the most recently added entries as of today. Every vulnerability below has been confirmed by CISA as actively exploited in the wild, meaning attackers are already using it, not just researching it. If you (or a supplier) run any of this software, treat it as urgent.

1. WordPress Core — a template flaw lets an outsider run their own code on your site, no login needed (CVE-2026-87902)

🛠️ WordPress Core · added 25 Sep 2026 · CISA fix-by date 28 Sep 2026 (due today)

What it is: "Remote file inclusion" means a bug in how WordPress decides which template file to load for a page can be tricked into loading a completely different .php file from elsewhere on the server instead — one the attacker chose. Where that file can be made to contain attacker instructions, this becomes a way to run arbitrary code on your site with no account and no password.

Who's affected: Any business running a WordPress website — this is a flaw in WordPress Core itself, not a plugin or theme, so it isn't limited to a particular type of site. WordPress runs a very large share of small-business websites.

What to do: Update WordPress to the latest version today — most hosts apply core security updates automatically, but don't assume; check your site's dashboard or ask your web host or developer to confirm it's done.

2. Adobe Commerce and Magento — a missing permissions check exposes sensitive store data without any trickery (CVE-2026-71362)

🛠️ Adobe Commerce and Magento · added 24 Sep 2026 · CISA fix-by date 27 Sep 2026 (1 day overdue)

What it is: "Incorrect authorization" means the software fails to properly check whether a request is allowed to see or do something before acting on it. Unlike a phishing trick or a booby-trapped file, this one needs no user interaction at all — an attacker can reach protected data or functionality directly over the network.

Who's affected: Any small e-shop running Adobe Commerce or the free Magento Open Source platform — the same widely-used online-store software flagged again this month.

What to do: Apply Adobe's patch (bulletin APSB26-92) now — the deadline has passed. If an agency or developer manages your store, ask them today whether it's applied; this one exposes store data without needing to trick anyone first.

3. MikroTik RouterOS — a flaw in how the router handles remote sessions can be chained into a full takeover with no password (CVE-2026-67279)

🛠️ MikroTik RouterOS · added 25 Sep 2026 · CISA fix-by date 28 Sep 2026 (due today)

What it is: RouterOS is the operating system that runs MikroTik's routers — a popular budget choice for small-office internet connections. This bug lets someone with no account open a management session and issue commands they shouldn't be able to; CISA notes it can be combined with a second flaw to fully compromise the router without ever logging in.

Who's affected: Any small business using a MikroTik router or firewall for its office internet — a common, affordable choice for small offices, and also used by some broadband providers to deliver connections to business customers.

What to do: Update RouterOS to the vendor's September 2026 patched release — check the router's own "check for updates" option, or ask whoever set up your network hardware to confirm it's current.

4. Microsoft SharePoint — a code-injection bug lets someone with any access to the site run their own code on the server (CVE-2026-65660)

🛠️ Microsoft SharePoint · added 25 Sep 2026 · CISA fix-by date 28 Sep 2026 (due today)

What it is: This affects SharePoint Server — the version an organisation installs and runs on its own equipment — not SharePoint Online inside Microsoft 365, which Microsoft patches for you automatically. "Code injection" means a user who already has some access to the site (even a low-privileged account) can smuggle in code that then runs on the server itself, well beyond what that account should be able to do.

Who's affected: Businesses that host their own SharePoint Server for shared documents or an intranet, rather than using the cloud (Microsoft 365) version.

What to do: If you self-host SharePoint Server, apply Microsoft's patch now — ask your IT provider to confirm. If you use SharePoint Online / Microsoft 365, no action is needed on your part.

5. Check Point — two separate flaws, one in the management console and one in VPN firewalls including the small-business "Spark" line (CVE-2026-93616, CVE-2026-85102)

🛠️ Check Point Security Management Server, Multi-Domain Server, Log Server, SmartEvent, Security Gateway and Spark Firewall · added 22 Sep 2026 · CISA fix-by date 25 Sep 2026 (3 days overdue)

What it is: Two unrelated bugs disclosed together. The first is a "path traversal" flaw in Check Point's management/logging tools that lets an attacker with no login upload and run their own script instead of the file they were supposed to write. The second is a certificate-checking gap in Check Point firewalls running VPN (including the Spark line, sold specifically for small and branch offices) that an unauthenticated attacker can exploit to run code on the firewall itself.

Who's affected: Businesses using a Check Point firewall — including a Spark unit for office VPN or site-to-site connectivity — plus larger environments running Check Point's central management console.

What to do: Apply Check Point's fixes referenced in advisories sk1000171 and sk1000117. If a reseller or IT provider set up your Check Point kit, ask them to confirm today which of the two applies and whether it's patched — the deadline has passed.

6. Citrix NetScaler — two bugs, one letting an attacker crash or run code on the device and one skipping the login entirely (CVE-2026-88772, CVE-2026-88771)

🛠️ Citrix NetScaler ADC and NetScaler Gateway · added 27 Sep 2026 · CISA fix-by date 30 Sep 2026

What it is: Two flaws in the same release. One is a memory-handling bug that can crash the device or, worse, let an attacker run their own code on it. The other is an input-validation flaw that lets an unauthenticated attacker run arbitrary commands directly — no credentials involved at all.

Who's affected: Businesses using Citrix NetScaler as a remote-access gateway (for staff VPN) or to manage traffic to internal applications — typically set up and run by an IT provider rather than in-house.

What to do: Apply Citrix's fix as soon as possible; ask your IT provider whether NetScaler is part of your remote-access setup and whether it has been patched.

7. Three enterprise tools your IT provider or software vendor might run behind the scenes (CVE-2026-93952, CVE-2026-94127, CVE-2026-5430)

🛠️ Arista VeloCloud Orchestrator · F5 BIG-IP APM · WSO2 API Manager and related products · added 22–24 Sep 2026 · CISA fix-by dates 25–27 Sep 2026 (overdue)

What it is: Three unrelated products, none of which a small business would typically run itself. Arista's VeloCloud Orchestrator is a central dashboard providers use to manage business internet/SD-WAN connections, and a flaw here lets an attacker reach privileged internal functions. F5's BIG-IP APM is a widely used gateway that controls access to internal applications; a memory-overflow bug here lets an unauthenticated attacker run code on it. WSO2's API management software has a flaw that lets a file upload escape its intended folder and run as code.

Who's affected: Not something you'd install yourself — but if your IT provider, broadband/SD-WAN provider, or a software vendor operates any of these behind the scenes on your behalf, their compromise becomes your problem.

What to do: Ask your IT provider, connectivity provider, or software vendor whether they use Arista VeloCloud, F5 BIG-IP, or WSO2 products, and whether the relevant patch has been applied.

This is an awareness summary of public CISA KEV data, not professional security advice. CISA "fix-by" dates are US federal deadlines; for everyone else they're a strong urgency signal, not a legal obligation. Always confirm the affected versions and the fix against the vendor's own advisory.

Reading about a breach — could it happen to you?

Most of these stories start with something an attacker can see from the outside: an exposed service, a spoofable domain, weak encryption. You can check your own domain for the same things in about a minute — free, no login, nothing intrusive.

Run a free posture scan →Check your Cyber Essentials readiness

Compiled from CISA's public Known Exploited Vulnerabilities catalog. This briefing is for awareness purposes only and does not constitute professional security advice; always confirm affected versions and the fix against the vendor's own advisory.