CISA ADDS FOUR ACTIVELY EXPLOITED VULNERABILITIES TO KEV CATALOG: ADOBE COMMERCE, MICROSOFT WINDOWS, AND N-ABLE N-CENTRAL AFFECTED

THREAT SUMMARY

Category: Active Exploitation / Known Exploited Vulnerabilities / Template Engine Injection / Link Following / Heap-Based Buffer Overflow / Static Code Injection
Affected Product(s): Adobe Commerce, Magento, Microsoft Windows, N-able N-central
CVE(s): CVE-2026-75650, CVE-2026-81963, CVE-2026-85880, CVE-2026-86218
Primary Risks: Active Exploitation of Affected Systems / Template Engine Vulnerability / Link Following / Heap-Based Buffer Overflow / Static Code Injection
Threat Status: Confirmed Active Exploitation
Affected Environment(s): Adobe Commerce and Magento Deployments, Microsoft Windows Systems, N-able N-central Deployments, Federal Civilian Executive Branch Environments, Publicly Exposed Assets Where Affected Versions Are Present
Attack Vector(s): Exploitation of Improper Template-Engine Neutralization, Link Following, Heap-Based Buffer Overflow, and Static Code Injection Vulnerabilities — Exact Exploitation Procedures and Threat Actor Techniques Not Disclosed by CISA
CISA Action: Added CVE-2026-75650, CVE-2026-81963, CVE-2026-85880, and CVE-2026-86218 to the Known Exploited Vulnerabilities Catalog on September 8, 2026
Required Response: Identify Affected Systems, Review Official Vendor Guidance, Apply Required Remediation, Prioritize High-Risk Publicly Exposed Assets, and Assess for Prior Compromise Where BOD 26-04 Criteria Apply

---

The Cybersecurity and Infrastructure Security Agency added four vulnerabilities to its Known Exploited Vulnerabilities Catalog on September 8, 2026, after determining that each is being exploited under real-world conditions.

The additions are:

• CVE-2026-75650 — Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
• CVE-2026-81963 — Microsoft Windows Link Following Vulnerability
• CVE-2026-85880 — Microsoft Windows Heap-Based Buffer Overflow Vulnerability
• CVE-2026-86218 — N-able N-central Static Code Injection Vulnerability

CISA did not identify the threat actors exploiting the vulnerabilities, targeted organizations, victim count, affected sectors, geographic scope, or specific intrusion campaigns associated with the four additions.

The September 8 alert also did not disclose complete exploitation chains, indicators of compromise, initial access requirements, privilege requirements, post-exploitation activity, or whether any of the vulnerabilities are being combined with other weaknesses during active attacks.

The addition of vulnerabilities affecting e-commerce infrastructure, Windows environments, and remote monitoring and management platforms creates a broad operational concern because the affected technologies can occupy very different positions inside an enterprise network.

Adobe Commerce and Magento deployments may sit directly in the path of customer-facing business operations. Microsoft Windows systems can exist throughout endpoint, server, and administrative environments. N-able N-central is used for centralized monitoring and management, which can place affected systems in positions of elevated operational trust.

CISA’s KEV designation confirms active exploitation. It does not establish that every deployment is exposed in the same way or that every vulnerable system has been compromised.

---

Vulnerability Details

CVE-2026-75650 — Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine

CVE-2026-75650 affects Adobe Commerce and Magento and is classified as an improper neutralization of special elements used in a template engine vulnerability.

CISA confirmed that the vulnerability is being actively exploited.

The alert did not disclose the exact exploit sequence, required access conditions, affected application functionality, privilege level obtained after exploitation, or whether exploitation results directly in remote code execution.

Organizations should rely on official Adobe and Magento security guidance to determine affected versions, remediation steps, and product-specific impact.

---

CVE-2026-81963 — Microsoft Windows Link Following Vulnerability

CVE-2026-81963 affects Microsoft Windows and is classified as a link following vulnerability.

CISA confirmed active exploitation but did not provide technical details explaining how attackers are abusing the weakness.

Organizations should avoid assuming a specific exploitation path until official Microsoft guidance defines the affected components, required conditions, and security impact.

Windows environments containing vulnerable systems should be identified and prioritized according to exposure and operational role.

---

CVE-2026-85880 — Microsoft Windows Heap-Based Buffer Overflow

CVE-2026-85880 affects Microsoft Windows and is classified as a heap-based buffer overflow vulnerability.

CISA confirmed that attackers are exploiting the vulnerability in the wild.

CISA did not specify which outcome is occurring in active exploitation or disclose the precise Windows component involved in the attacks.

Organizations should review Microsoft’s official security guidance before drawing conclusions about privilege requirements, exploitability, or post-exploitation capability.

---

CVE-2026-86218 — N-able N-central Static Code Injection

CVE-2026-86218 affects N-able N-central and is classified as a static code injection vulnerability.

CISA confirmed active exploitation.

CISA did not disclose the exact injection method, required access level, exploitation path, or confirmed post-exploitation activity.

Organizations operating N-central should review official N-able security guidance and determine whether exposed or high-privilege deployments require immediate remediation or compromise assessment.

---

Operational Impact

• Immediate inventory of affected Adobe Commerce and Magento deployments
• Identification of vulnerable Microsoft Windows systems
• Identification of N-able N-central servers and management infrastructure
• Prioritization of publicly exposed assets
• Accelerated deployment of vendor-provided patches or mitigations
• Compromise assessments for systems exposed before remediation

Applying required remediation addresses the known vulnerability.

It does not determine whether exploitation occurred before the vulnerability was corrected.

---

Federal Response

Binding Operational Directive 26-04, Prioritizing Security Updates Based on Risk, establishes vulnerability-management requirements for Federal Civilian Executive Branch agencies.

The directive reinforces the role of the KEV Catalog in federal vulnerability management and requires agencies to prioritize rapid remediation of high-risk KEV vulnerabilities affecting publicly exposed assets when exploitation can grant total control of the affected asset.

BOD 26-04 also establishes expectations for determining when federal agencies must investigate whether a threat actor compromised a system before a patch or mitigation was applied.

The addition of the four vulnerabilities to the KEV Catalog confirms active exploitation.

It does not establish that each vulnerability meets identical exposure, privilege, or post-exploitation conditions in every environment.

The directive applies directly to Federal Civilian Executive Branch agencies.

CISA continues to encourage state, local, private-sector, and other organizations to adopt risk-based vulnerability management and prioritize vulnerabilities listed in the KEV Catalog.

---

KEV

CISA added:

• CVE-2026-75650 — Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
• CVE-2026-81963 — Microsoft Windows Link Following Vulnerability
• CVE-2026-85880 — Microsoft Windows Heap-Based Buffer Overflow Vulnerability
• CVE-2026-86218 — N-able N-central Static Code Injection Vulnerability

A KEV designation means CISA has evidence that a vulnerability is being actively exploited.

KEV inclusion does not identify the attacker, intrusion method, targeted organization, victim count, campaign name, or confirmed post-exploitation behavior unless CISA separately provides that information.

Potential additions to the KEV Catalog must include:

• A valid CVE identifier
• Evidence of active exploitation
• Clear mitigation guidance

The September 8 additions indicate that organizations should treat the four vulnerabilities as active operational security issues rather than routine patch-cycle items.

---

Defensive Guidance

• Inventory all Adobe Commerce and Magento deployments.
• Identify Internet-facing Adobe Commerce and Magento systems.
• Inventory Microsoft Windows systems across endpoint and server environments.
• Identify N-able N-central deployments and management servers.
• Review the KEV entries for all four CVEs.
• Review official vendor security advisories and affected-version information.
• Apply vendor-provided patches or mitigations as soon as possible.
• Prioritize externally exposed assets.
• Assess exposed systems for signs of compromise before returning them to normal operation.

---

30-Day Outlook

• Continued exploitation activity involving unpatched systems affected by the four KEV-listed vulnerabilities
• Increased remediation activity across federal environments following the September 8 KEV additions
• Greater prioritization of publicly exposed affected assets where exploitation could create significant operational risk
• Increased review of Adobe Commerce, Magento, Microsoft Windows, and N-able N-central deployments for affected versions
• Accelerated application of vendor-provided patches, updates, or mitigations as organizations respond to confirmed active exploitation
• Increased compromise assessments for systems that remained exposed before remediation, particularly where BOD 26-04 requirements apply
• Additional technical guidance from affected vendors as remediation efforts continue
• Possible disclosure of further exploitation details, indicators, or attack conditions as investigations and vendor analysis develop
• Continued security attention on N-able N-central deployments following its addition to the KEV Catalog
• Increased monitoring of affected Windows and Internet-facing application environments following remediation
• Continued KEV-driven prioritization as organizations assess exposure based on asset criticality, Internet accessibility, and potential operational impact

---

TRJ Verdict

CISA’s addition of CVE-2026-75650, CVE-2026-81963, CVE-2026-85880, and CVE-2026-86218 to the Known Exploited Vulnerabilities Catalog confirms that attackers are actively exploiting weaknesses across Adobe Commerce, Magento, Microsoft Windows, and N-able N-central environments.

The significance of this update is the range of infrastructure involved.

The four vulnerabilities affect e-commerce systems, operating-system environments, and centralized management technology, creating different risk profiles across enterprise networks.

CISA has not disclosed who is exploiting the vulnerabilities, which organizations have been compromised, or what post-exploitation activity has occurred.

Organizations should focus on the confirmed risk: identify affected systems, review official vendor guidance, apply required remediation, prioritize exposed assets, and assess for prior compromise where appropriate.

Applying the required remediation addresses the vulnerability.

A compromise assessment determines whether an attacker was already inside.

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---