Policy

CISA listed three bugs attackers are already using

WordPress on September 25, Apple on September 29, Cisco Catalyst SD-WAN Manager on September 30. The posts are the alerts. The catalog holds the due dates.

By Emilio Santos October 1, 2026 12 min read
Cabinets in a colocation room
The catalog does not care which team owns the box. Photo: Circuit & Capital

For five days at the end of September, the Cybersecurity and Infrastructure Security Agency’s account on X did the thing it does when a bug is no longer theoretical. It posted an addition to the Known Exploited Vulnerabilities catalog, and it pointed at the same short link each time. Friday, September 25: WordPress Core, remote file inclusion, CVE-2026-87902. Tuesday, September 29: an Apple out-of-bounds write, CVE-2026-86950. Wednesday, September 30: Cisco Catalyst SD-WAN Manager, a hex-encoding issue, CVE-2026-76504. Each post is an alert. The catalog entry is the specification: what CISA says the bug can do, the date it was added, the date a federal civilian agency is supposed to be done, and the vendor page CISA considers the remediation.

This is an operator note, not a description of how to use the bugs. If you run the product, the job is to confirm that, apply the vendor’s fix, and write down the date. If you do not run it, write that down too, so the next person does not reopen the thread.

What the catalog is, and who it binds

CISA describes the catalog as the authoritative list of vulnerabilities that have been exploited in the wild. Binding Operational Directive 22-01 is the document that requires Federal Civilian Executive Branch agencies to remediate a listed vulnerability by the due date on the entry. CISA’s own program page says the directive does not bind everyone else. It also says CISA wants state and local governments, and private companies, to treat the list as the queue that goes first.

The entries added in this stretch carry a second instruction on the catalog page itself. For each of the three, CISA marks forensic triage under BOD 26-04 as required, and the stated action is to apply the vendor’s mitigations in line with that directive, or to stop using the product if no mitigation exists. This briefing does not restate BOD 26-04. The point for a private company is narrower. A due date with your agency’s name on it is a federal clock. The same row is still evidence that someone is already using the bug against organizations that have no federal clock at all.

Ransomware use, on all three entries, is marked unknown. Unknown is not a clean bill. It means CISA has not published that link. Do not brief a board that “this is not ransomware” off that field.

The three posts, and the three rows

WordPress Core, CVE-2026-87902. Added September 25. Due September 28. CISA’s row calls it a remote file inclusion in WordPress Core: an unauthenticated attacker could make page-template resolution include a chosen readable local PHP file outside the active theme directories, leading to remote code execution. The catalog points at the WordPress security advisory as the vendor instruction. The federal due date had already passed by the time this briefing was published. If a marketing site, a customer portal, or a blog on a box you still patch is on a vulnerable release, the lateness is the fact. Confirm the version against that advisory, update, and keep the record. A host that “manages WordPress for you” is still your outage if the core was not moved.

Apple, CVE-2026-86950. Added September 29. Due October 2. CISA says iOS, macOS, and iPadOS contain an out-of-bounds write in CoreGraphics that may lead to arbitrary code execution. The catalog points at three Apple support pages as the vendor instructions. The federal due date is the day after this briefing. Phones and laptops are a different queue from a data-center patch, which is why this one gets missed. Ask who can see whether managed devices are on the fixed release, and what happens to a device that has not checked in.

Cisco Catalyst SD-WAN Manager, CVE-2026-76504. Added September 30. Due October 3. CISA’s description is a hex-encoding vulnerability: an unauthenticated, remote attacker could reach an affected system with the privileges of the admin user because of improper handling of URI encoding in an HTTP request. The catalog links Cisco’s advisory. That is the page that says which releases are affected and which builds are fixed. A management plane that can push configuration to branches is not a low-value target just because the hostname is unfamiliar to the finance team. If the manager is reachable, it is on the list. If a Cisco-operated cloud is in the path, confirm with Cisco what they already patched and what you still run yourself. Do not assume the two are the same box.

The post tells you the name. The catalog tells you the date. The vendor page tells you the fix. Skip one of the three and you are guessing.

The catalog had more than the three posts

The account’s posts were the loud three. The catalog page, read on October 1, shows the week was busier than that, and those other rows are just as much “known exploited” as the ones that fit in a social post.

On September 27 CISA added two Citrix NetScaler issues, CVE-2026-88771 and CVE-2026-88772, both due September 30. The first is an improper input validation bug that CISA says could let an unauthenticated attacker run arbitrary commands on NetScaler ADC and NetScaler Gateway. The second is a memory-handling bug that CISA says could allow remote code execution or a denial of service. Those federal due dates have passed. A later catalog row, CVE-2026-88779, is a separate NetScaler entry, added October 4 and due October 7. That note is Citrix NetScaler is on the exploited catalog again. A remote-access gateway is the sort of system a company forgets it still has until a customer cannot log in.

On October 1 the catalog added Fortinet FortiMail, CVE-2026-104286, due October 4. CISA describes a path-traversal issue that may let an unauthenticated attacker write arbitrary files via crafted HTTP or HTTPS requests. This desk is not treating a single day’s catalog as a complete history. It is treating the row as the official add, the way the three posts were the official alerts.

None of this is a vulnerability-management program. It is the week’s evidence that “we will look at it in the monthly window” is a choice to stay exposed to bugs CISA has already called exploited. The monthly window can still exist. These rows do not wait for it.

What to do on Thursday

Make a list of five product names: WordPress, Apple devices, Catalyst SD-WAN Manager, NetScaler, FortiMail. Next to each, write yes, no, or “owned by the host.” For every yes, write the version you are on, the version the vendor page says is fixed, the person who can change it, and the date you will check again. For a federal contractor, also write the catalog due date, because your customer may ask why you missed it even when BOD 22-01 does not name you.

Do not turn the list into a claim that you were or were not compromised. CISA’s action line for these entries includes forensic triage for agencies under BOD 26-04. A private company can still decide, with its own counsel and its own logs, whether a bug that was exploited in the wild deserves a look backward as well as a patch forward. That decision is not this article.

If the same week produces a customer question from a public company, the patch date and the materiality date are different clocks. Item 1.05 of Form 8-K runs from the materiality determination, not from the morning a CVE is posted. A known-exploited bug is not automatically a material incident. It is a fact your customer’s counsel may ask you to explain quickly. The note on that clock is the SEC piece. The way you learn whether a library or a core you did not think you ran is actually in the stack is the ingredients list in the SBOM piece.

Sources

Related: The SEC clock starts when you decide it matters and The software ingredients list now covers the suite. For the second question, “do we run this,” use the SBOM request pack, then Ask a vendor for an SBOM.

ES
Emilio Santos writes and edits every piece on Circuit & Capital.
circuit50capital@circuits.fit