Three days after WordPress shipped a fix for a core flaw that anyone on the internet can reach, the US Cybersecurity and Infrastructure Security Agency (CISA) says attackers are already using it. On 25 September CISA added CVE-2026-87902, which it lists as a WordPress Core Remote File Inclusion Vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.
The same day it added two more: a Microsoft SharePoint code injection bug and a MikroTik RouterOS flaw. CISA's alerts do not say who is behind the attacks, how many targets have been hit, or how the flaws are being used. What they do establish is that exploitation is happening, which is the point at which patching stops being routine.
A fresh WordPress fix is already under attack
WordPress released version 7.1.2 on 22 September, with security backports reaching all the way back to the 4.7 branch. As we reported when the fix landed, the flaw sits in how WordPress picks a page template. According to the NVD record, an unauthenticated attacker can make get_page_template() include a chosen readable local .php file from outside the active theme's directories, and if pre-conditions on both the server and the active theme are met, this can lead to remote code execution. The record scores it 8.1, high.
That caveat matters, but it is not a reason to wait. Whether a particular site can be pushed all the way to code execution depends on its theme layout and server configuration, and both change over time. CISA's listing does not say which configurations the attackers are hitting.
A MikroTik bug already seen in the wild
The second addition, CVE-2026-67279 (CVSS 6.9), is a RouterOS SSH flaw. The NVD record says the SSH server enters the connection protocol after a client-requested rekey even though user authentication was never attempted, which lets an unauthenticated client open a session channel and send an exec request. On affected builds that allows unauthenticated creation, overwrite and reconstruction of files in RouterOS's managed file namespace, including support files containing configuration and diagnostic data. MikroTik fixed it in RouterOS 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable). CERT Polska had already reported attacks on MikroTik routers over SSH earlier this month; the KEV listing now puts that on the federal patch clock.
SharePoint, again, with almost no detail
The third, CVE-2026-65660, is listed as a Microsoft SharePoint code injection vulnerability that could allow an authorized attacker to execute code over a network. No CVSS score has been published in our records, and the KEV entry carries no further technical detail; Microsoft's own advisory is where the specifics live. It is the latest in a long run of SharePoint entries on the catalog this year, after four SharePoint additions in July.
Update WordPress to 7.1.2 and RouterOS to a fixed build
- WordPress: update to 7.1.2, or the patched release on your supported branch, and confirm the update actually applied on managed or auto-updating sites.
- MikroTik: move to RouterOS 6.49.21, 7.23.4 or 7.24.2, and keep SSH off the open internet.
- SharePoint: apply the fix referenced in Microsoft's advisory for CVE-2026-65660 on every on-premises server.
Under Binding Operational Directive 26-04, US federal civilian agencies must prioritise KEV-listed flaws. Everyone else is only encouraged to, but a KEV entry is the clearest signal defenders get that a bug has moved from theoretical to used. For WordPress, the gap between the fix and CISA's exploitation listing was three days, so anyone on a weekly or monthly update cycle should not wait for the next one.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.