CISA sets deadlines for agencies to address four exploited software flaws

CISA has added exploited vulnerabilities affecting WSO2 products, Adobe Commerce, Microsoft SharePoint and Mikrotik RouterOS to its Known Exploited Vulnerabilities catalog. Federal agencies using the affected products must apply recommended fixes or mitigations by September 27 for the WSO2 and Adobe flaws, and by September 28 for the SharePoint and RouterOS flaws. The WSO2 authentication flaw could allow an attacker to compromise administrative accounts and take control, according to the vendor. The Adobe Commerce flaw affects authorization and has been observed in attacks without an existing account. CISA has not disclosed details of the attacks involving WSO2.