10 vulnerabilities attackers are exploiting right now: what to patch this week (21 to 25 September 2026)
Every week CISA adds vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue. The bar for getting on that list is not "severe on paper" but "attackers are using it now". For a small team with limited patching hours, that makes KEV the most useful priority list there is. These are the ten entries added between 21 and 25 September 2026, copied from the catalogue, each linked to its NVD record. Nothing below is estimated or rewritten. Added Product CVE 25 Sep MikroTik RouterOS, impro
🎯 Vulnerability: Web Security Vulnerability
💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.