Cybersecurity Specialist: 2026-09-25
24 minutes in total
AL26-023 - Vulnerability Impacting Microsoft SharePoint Server - CVE-2026-65660
Canadian Centre for Cyber Security, 2026-09-24. Read, 4 min.
The Canadian Centre for Cyber Security says it is aware of active exploitation of CVE-2026-65660, a code injection flaw that could let an authenticated attacker execute code on SharePoint Server and that, chained with other SharePoint vulnerabilities, can achieve pre-authentication remote code execution on servers configured to permit anonymous access. The alert lists fixed builds for SharePoint Server 2016, 2019, and Subscription Edition, and notes that 2016 and 2019 reached end of life on July 15, 2026.
Why it matters for this role: Any SharePoint 2016 or 2019 farm still in your estate needs both the fixed build and a migration plan, since the Cyber Centre reports active exploitation and both versions are out of support.
Check Point, 2026-09-22. Read, 3 min.
Check Point reports a wave of exploitation attempts since September 12 against Spark customers using CVE-2026-85102, a pre-authentication remote code execution flaw in Security Gateway VPN certificate handling that it fixed on September 9. Separately, it identified a handful of pinpointed attacks on July 23, 2026 exploiting CVE-2026-93616, a newly discovered pre-authentication path traversal in the Security Management web service, and made a fix available with this advisory.
Why it matters for this role: Confirm that Check Point gateways and Spark firewalls on the affected versions carry the September 9 fix, and install this week's Security Management fix, since Check Point reports exploitation of both flaws.
CVE-2026-87902: Attackers Started Probing WordPress Sites Hours After the Patch
Patchstack, 2026-09-22. Read, 10 min.
WordPress 7.1.2 fixes CVE-2026-87902, an unauthenticated local file inclusion in page template resolution that Patchstack lists at CVSS 9.2 and says can lead to code execution under certain conditions, and Patchstack saw the first probing requests on September 22, the day the fix was published. Its September 23 update says attackers are now using the flaw to write PHP files to disk and that public scanning tooling for the CVE is in circulation.
Why it matters for this role: Forgotten WordPress sites on old branches are no longer an excuse to wait, because every affected branch back to 4.7 now has its own patched release and attackers began probing on the day of the fix.
Spraying in the Andes: TeamFiltration Returns to Exploit Forgotten Service Accounts
Proofpoint, 2026-09-22. Read, 7 min.
Proofpoint identified a TeamFiltration campaign it tracks as UNK_CondorFiltration that targeted over 5,700 accounts across 28 Microsoft 365 tenants in Latin America, focusing on Chilean organizations. All seven accounts it compromised were unmanaged functional or service accounts with no prior legitimate login baseline and no MFA enforcement, which Proofpoint says strongly indicates default or predictable passwords that were never rotated.
Why it matters for this role: Find the service and functional accounts in your Microsoft 365 tenant that nobody signs in to, and confirm each one has MFA enforced and a password that has been rotated.
The quiz for this edition has closed.