CISA just added another batch of vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, and this one’s worth paying attention to. The flaws span three widely used platforms: Microsoft SharePoint, WSO2 (an open-source integration and identity platform), and Adobe Commerce. All three are actively being exploited in the wild, not just theoretical risks sitting in a research paper somewhere.
If you’re not familiar with the KEV catalog, here’s the quick version. CISA maintains a running list of vulnerabilities that attackers are actually using right now, as opposed to the thousands of flaws that get disclosed but never see real-world exploitation. When something lands on that list, federal agencies are required to patch it within a set deadline. Everyone else, in theory, should treat it with the same urgency, even though the mandate technically only applies to federal networks.
That distinction matters here. SharePoint is a backbone tool for document management and internal collaboration at companies and agencies of every size. WSO2 shows up behind the scenes in identity management and API gateways, meaning a compromise there can ripple into whatever systems trust it. And Adobe Commerce runs a huge chunk of mid-size and enterprise online storefronts, so a flaw there is a direct line to payment data and customer records.
Think about who’s running these systems. Government agencies lean heavily on SharePoint for internal workflows and document sharing, which makes it an attractive target for anyone looking to poke around sensitive records or move laterally into bigger networks. Financial services and retail operations that depend on Adobe Commerce are staring at potential exposure of transaction data and customer accounts, which is exactly the kind of breach that triggers regulatory headaches and reputational damage. And healthcare organizations, many of which quietly rely on WSO2-style identity tools to manage who can access patient data, need to treat this as a reminder that identity infrastructure is just as critical as the systems it protects.
The bigger pattern here isn’t really about these three products specifically. It’s about how quickly the gap closes between a vulnerability disclosure and active exploitation. Attackers are increasingly fast at weaponizing known flaws, especially in software that’s everywhere. That means patch management can’t be a quarterly chore anymore. It has to be closer to a standing operational priority, particularly for anything internet-facing or handling sensitive data.
Questions Worth Sitting With
- Should the KEV patch mandate extend beyond federal agencies to critical infrastructure sectors like finance and healthcare?
- How much responsibility should software vendors bear when known flaws stay unpatched in customer environments for months?
- Is your organization’s patch cycle actually fast enough to keep up with how quickly attackers are moving these days?
- Does relying on a small number of platforms (like SharePoint or WSO2) across so many industries create too much concentrated risk?
- What would it take for smaller organizations without dedicated security teams to keep pace with this kind of threat?