TL;DR
CISA added five critical vulnerabilities to its Known Exploited Vulnerabilities list today, including WSO2 path traversal (CVE-2026-5430) and Adobe Commerce authorization bypass (CVE-2026-71362). Roundcube Webmail's critical flaw is now being actively exploited in code-injection campaigns. Patching for federal systems is due by September 27.
Executive Summary
- CISA's Known Exploited Vulnerabilities catalog was updated with five critical flaws in WSO2, Adobe Commerce, Arista, F5, and Check Point, all reportedly under active attack.
- Roundcube Webmail's high-severity code-injection vulnerability (CVE-2026-48842) is now actively exploited, with Canada's Centre for Cyber Security documenting attacks.
- New supply-chain and infrastructure-targeting malware emerged: Carbonato botnet exploits insecure Docker hosts via AI agent integration, and MacSync malware uses iCloud calendar events to deliver macOS payloads.
- Exposed GitLab project email addresses are being leveraged by attackers to push unauthorized code changes to repositories.
- Microsoft released nearly 1,000 security patches, marking its largest single patch batch ever, including multiple Windows and product vulnerabilities.
Top Threats Today
1. WSO2 and Adobe Commerce Path Traversal and Authorization Bypass Under Active Exploitation
Severity: CRITICAL Affected: Technology Retail
CISA added CVE-2026-5430 (WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway) and CVE-2026-71362 (Adobe Commerce and Magento) to its Known Exploited Vulnerabilities catalog on September 24, 2026 [1][2]. CVE-2026-5430 is a path traversal vulnerability allowing unrestricted file upload and remote code execution [1]. CVE-2026-71362 is an incorrect authorization flaw permitting attackers to gain elevated access to sensitive resources without user interaction [2]. Both vulnerabilities have federal remediation deadlines of September 27, 2026 [1][2].
Sources:[1] CISA KEV[2] CISA KEV
Recommended Action
- Identify and inventory all instances of WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway in your environment.
- Apply vendor-provided security patches immediately; federal agencies must remediate by September 27, 2026.
- Monitor for unauthorized file uploads and unexpected authentication changes in Adobe Commerce and Magento deployments.
- Enable logging and alerting on access policy and OAuth profile modifications in affected systems.
2. Roundcube Webmail Code-Injection Vulnerability Actively Exploited
Severity: HIGH Affected: Technology
A high-severity Roundcube Webmail vulnerability patched in May is now being actively exploited in attacks, according to the Canadian Centre for Cyber Security ⚠[1]. The vulnerability is identified as CVE-2026-48842 and is being leveraged in code-injection attacks ⚠[1].
Sources:[1] BleepingComputer
Recommended Action
- Verify that all Roundcube Webmail instances are running patched versions released after May 2026.
- Review Roundcube logs for suspicious code-injection patterns, particularly in email body or header processing.
- If unpatched Roundcube systems are in use, immediately apply the May patch or disable webmail access until patching is complete.
3. Carbonato Botnet Exploits Exposed Docker Daemons via AI Framework Hijacking
Severity: HIGH Affected: Technology
A new botnet malware called Carbonato is targeting insecure hosts running exposed Docker daemons to install the Hermes Agent AI framework and take control [1]. The campaign leverages misconfigured Docker environments to establish persistent command-and-control infrastructure via AI agent integration ⚠[1].
Sources:[1] BleepingComputer
Recommended Action
- Audit Docker daemon configurations to ensure TCP ports are not exposed to untrusted networks; bind Docker sockets to localhost only.
- Implement network segmentation to restrict outbound connections from Docker hosts to known-good registries and repositories.
- Monitor for unexpected Hermes Agent or suspicious AI framework installations on Docker hosts.
- Enable Docker audit logging and review for unauthorized container creation or privileged operations.
4. GitLab Private Email Exposure Enables Unauthorized Code Push
Severity: HIGH Affected: Technology
Private GitLab email addresses that allow developers to push issues or tasks to a project are being deliberately exposed in READMEs, contributing guides, and support pages used to collect bug reports [1]. Attackers are leveraging these exposed addresses to push unauthorized code changes to repositories [1].
Sources:[1] BleepingComputer
Recommended Action
- Audit all public-facing documentation (READMEs, CONTRIBUTING files, support pages) for exposed GitLab project email addresses.
- Remove or mask any exposed project-specific email addresses from public repositories.
- Enable GitLab push protection rules and require code review approval before merging external contributions.
- Monitor repository push logs for unexpected commits from unfamiliar or external accounts.
5. MacSync Malware Uses iCloud Calendars for Payload Delivery; Corp MDM Spyware Targets Logistics
Severity: HIGH Affected: Technology Transportation
A new variant of MacSync malware targeting macOS systems now uses public iCloud calendar events to deliver new native payloads, expanding its attack surface [2]. Separately, an Android spyware campaign dubbed Corp MDM is targeting the logistics sector, distributing malicious APK files through fake Google Play pages branded as CEVA and TKW Logistics [1]. The Corp MDM malware steals SMS messages and intercepts and redirects phone calls [1].
Sources:[1] The Hacker News[2] BleepingComputer
Recommended Action
- macOS users: disable automatic calendar subscriptions from untrusted sources and review iCloud calendar settings for unexpected events.
- Implement mobile device management (MDM) policies to restrict sideloaded APK installations; advise users to install apps only from official Google Play Store.
- Logistics organizations: educate employees on the risks of downloading logistics-branded apps from non-official channels; verify app authenticity before installation.
- Monitor for unusual SMS activity, call redirects, and unexpected calendar updates on managed devices.
Additional Notable Findings
- Microsoft Patch Batch: Microsoft issued updates to plug at least 974 security holes in Windows and other software, its largest single patch batch ever [12]. Patches include CVE-2026-69730, CVE-2026-69829, CVE-2026-81963, and CVE-2026-85880 [12].
- F5 BIG-IP APM RCE: CISA added CVE-2026-94127 (F5 BIG-IP APM heap-based buffer overflow) to its KEV catalog on September 22, 2026 [34]. The vulnerability allows unauthenticated remote code execution when an access policy and OAuth profile are configured [34].
- Arista VeloCloud Orchestrator Improper Validation: CVE-2026-93952 affecting Arista VeloCloud Orchestrator on-prem was added to CISA KEV on September 22, 2026 [33]. The improper input validation may allow remote attackers to access privileged internal functionality [33].
- OnePlus Root Vulnerability: The Hacker News reports that a OnePlus 15 running the latest OxygenOS can be rooted by a malicious Android app that requests no special permissions, via chaining of two OnePlus software flaws [1].
- third-party[.]com Domain Abuse: The placeholder domain “third-party[.]com”, commonly used as a documentation placeholder referenced across 1,700+ repositories, has been observed serving ClickFix lures to Windows browsers [3].
- Ongoing: Check Point Multiple Products path traversal (CVE-2026-93616) remains under active exploitation; added to CISA KEV on September 22 [35].
Today’s Action Checklist
- ☐ URGENT: Patch WSO2 API products and Adobe Commerce/Magento installations before September 27 federal deadline.
- ☐ URGENT: Update or disable Roundcube Webmail; apply May 2026 patch for CVE-2026-48842 to all instances.
- ☐ HIGH: Audit and restrict Docker daemon network exposure; verify no TCP ports are publicly accessible.
- ☐ HIGH: Scan public documentation and READMEs for exposed GitLab project email addresses; remove and rotate credentials.
- ☐ HIGH: Apply Microsoft’s September patch batch to all Windows and supported Microsoft software; prioritize systems with network exposure.
- ☐ HIGH: Deploy F5 BIG-IP APM patches and monitor for unauthorized OAuth profile or access policy changes.
- ☐ MEDIUM: Review macOS endpoint settings for unexpected iCloud calendar subscriptions; disable untrusted calendar sources.
- ☐ MEDIUM: Logistics sector: issue employee awareness on malicious logistics-branded mobile apps; enforce Google Play–only installation policies.