September 25, 2026 is shaping up as a high-pressure day for defenders. Multiple critical vulnerabilities have crossed the threshold from theoretical risk into confirmed active exploitation, while a creative macOS malware campaign demonstrates that threat actors continue to abuse legitimate cloud infrastructure to evade detection. Taken together, today's threat landscape underscores a recurring truth: unpatched internet-facing services and trusted platform abuse remain the two most reliable entry points for attackers.

Roundcube Webmail is once again in the crosshairs. A high-severity code injection vulnerability patched back in May is now being actively exploited in the wild, with the Canadian Centre for Cyber Security confirming real-world attacks. Roundcube is widely deployed by organizations, ISPs, and government entities as a browser-based email client, making it an attractive target for credential harvesting and initial access. Code injection flaws in webmail platforms are particularly dangerous because they can be triggered simply by a victim opening or previewing a malicious email, requiring no additional user interaction beyond routine mail handling. Organizations running Roundcube should treat this as an emergency patch situation. If immediate patching is not possible, consider restricting access to the Roundcube interface to trusted IP ranges or VPN-only access until the fix is applied.

On the enterprise middleware front, CISA has added CVE-2026-5430, a path traversal vulnerability affecting WSO2 Multiple Products, to its Known Exploited Vulnerabilities catalog. WSO2 products are commonly used as API gateways, identity servers, and integration platforms in large enterprise and government environments. Path traversal vulnerabilities in these components can allow unauthenticated or low-privileged attackers to read sensitive files outside the intended directory structure, potentially exposing configuration files, credentials, private keys, and internal network details. Given WSO2's role as a trust broker in many architectures, a compromise here can cascade rapidly into broader identity and API abuse. Security teams should audit all WSO2 deployments immediately, apply available patches, and review web application firewall rules to detect and block directory traversal patterns in request paths.

Also added to CISA's KEV catalog is CVE-2026-71362, an incorrect authorization vulnerability in Adobe Commerce and Magento. E-commerce platforms are perennial targets because they sit at the intersection of customer data, payment processing, and business operations. Incorrect authorization flaws can allow attackers to access administrative functions, manipulate orders, exfiltrate customer records, or inject malicious scripts into checkout flows. Organizations running Adobe Commerce or Magento should prioritize patching immediately and conduct a review of recent administrative activity logs for any anomalous access patterns, unexpected admin account creation, or unauthorized configuration changes.

A notable sidebar from today's advisories: CISA has revoked its advisory on the Siemens Mendix Runtime vulnerability after re-investigation confirmed the reported behavior is expected platform configuration rather than an exploitable flaw. This is a useful reminder that not every reported vulnerability survives scrutiny, and that defenders should track advisory status actively rather than treating initial disclosures as final.

Shifting to the endpoint threat landscape, a new MacSync malware variant is targeting macOS systems using a genuinely clever technique: embedding payload delivery instructions inside public iCloud calendar events. By abusing a legitimate, trusted Apple service, the malware blends its command-and-control traffic into normal iCloud communications, making it harder to detect through traditional network monitoring that might block or flag unknown domains. The malware delivers native macOS payloads, suggesting a capable and macOS-focused threat actor. This technique highlights the growing sophistication of macOS-targeted campaigns and the need for endpoint detection capabilities that go beyond network-layer controls.

Defensive priorities for today:

- Patch Roundcube Webmail immediately; restrict access to VPN or trusted IPs if patching is delayed and monitor mail server logs for anomalous server-side script execution.
- Apply WSO2 patches for CVE-2026-5430 without delay; add WAF rules to detect path traversal sequences and audit file access logs on WSO2 hosts for unusual read activity.
- Update Adobe Commerce and Magento to address CVE-2026-71362; review admin audit logs for unauthorized access and verify integrity of checkout and payment page code.
- For macOS environments, deploy endpoint detection and response tools capable of behavioral analysis; monitor for unusual processes spawned from calendar or iCloud-related applications and consider restricting iCloud calendar sharing policies where operationally feasible.
- Cross-reference your asset inventory against all three KEV entries and treat any confirmed exposure as requiring immediate escalation under your vulnerability SLA policy.
- Remove the Siemens Mendix advisory from active remediation queues if it was previously tracked, but verify your specific configuration against Siemens guidance.

The convergence of webmail exploitation, enterprise middleware path traversal, e-commerce authorization bypass, and cloud-abusing macOS malware in a single day reflects the breadth of attack surface that modern security teams must defend simultaneously. Prioritization, rapid patching cadence, and behavioral detection capabilities are your most effective tools.

This briefing is informational only and does not substitute for official vendor advisories or guidance from CISA and relevant national cybersecurity authorities.