IT security 2026-09-25

Level Critical — 90/100 — 2026-09-25

Critical day: 7 stories ranked, 5 of the top 7 reported as actively exploited, 5 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: Adobe Commerce and Magento Incorrect Authorization Vulnerability (88/100).

1. Adobe Commerce and Magento Incorrect Authorization Vulnerability — 88/100 (CVE-2026-71362)
2. WSO2 Multiple Products Path Traversal Vulnerability — 68/100 (CVE-2026-5430)
3. WordPress Core Remote File Inclusion Vulnerability — 66/100 (CVE-2026-87902)
4. Microsoft SharePoint Code Injection Vulnerability — 66/100 (CVE-2026-65660)
5. Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability — 60/100 (CVE-2026-67279)
6. CVE-2026-97063 — X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GE… — 36/100 (CVE-2026-97063)
7. broadcom rabbitmq server: RabbitMQ is a messaging and streaming broker. — 29/100 (CVE-2026-67237)