Incident Responder: 2026-09-25
28 minutes in total
AL26-022 - Vulnerability impacting F5 BIG-IP Access Policy Manager (APM) - CVE-2026-94127
Canadian Centre for Cyber Security, 2026-09-22. Read, 3 min.
The Cyber Centre warns that CVE-2026-94127, a heap-based buffer overflow in F5 BIG-IP APM where an APM access policy and an OAuth profile are configured on the same virtual server, may let an unauthenticated attacker execute code, and that F5 has indicated it is exploited in the wild. F5's own record limits the flaw to APM configured as an OAuth Authorization Server, and fixed hotfixes exist for 17.1, 17.5, and 21.1, with an iRule available from F5 Support.
Why it matters for this role: The Cyber Centre's compromise checks for affected BIG-IP systems are OAuth authentication failures in rapid succession or large volume in the access logs, plus suspicious activity in administrative accounts and access policies.
AL26-023 - Vulnerability Impacting Microsoft SharePoint Server - CVE-2026-65660
Canadian Centre for Cyber Security, 2026-09-24. Read, 4 min.
The Canadian Centre for Cyber Security says it is aware of active exploitation of CVE-2026-65660, a code injection flaw that could let an authenticated attacker execute code on SharePoint Server and that, chained with other SharePoint vulnerabilities, can achieve pre-authentication remote code execution on servers configured to permit anonymous access. The alert lists fixed builds for SharePoint Server 2016, 2019, and Subscription Edition, and notes that 2016 and 2019 reached end of life on July 15, 2026.
Why it matters for this role: An unpatched SharePoint server calls for a look at web shells, deserialization activity, and access to IIS machine keys, all of which the Cyber Centre lists as signs to monitor.
Check Point, 2026-09-22. Read, 3 min.
Check Point reports a wave of exploitation attempts since September 12 against Spark customers using CVE-2026-85102, a pre-authentication remote code execution flaw in Security Gateway VPN certificate handling that it fixed on September 9. Separately, it identified a handful of pinpointed attacks on July 23, 2026 exploiting CVE-2026-93616, a newly discovered pre-authentication path traversal in the Security Management web service, and made a fix available with this advisory.
Why it matters for this role: If a gateway missed the September 9 fix, look for second-stage activity from users who logged in through Mobile Access, which Check Point says often involves internal port and service scans.
The Rogue RMM Stack: One Phish, Multiple Persistence Paths
Huntress, 2026-09-23. Read, 8 min.
In one Huntress SOC investigation, a secure-document phishing lure hid the installation of a rogue ITarian remote monitoring and management client, followed by a ScreenConnect session for persistent access. Huntress says attackers stack remote-access clients so they keep a backup path if the first installation is found and removed.
Why it matters for this role: Closing an RMM intrusion means sweeping for a second remote-access client, since in this case a rogue ITarian install was followed by a ScreenConnect session.
CVE-2026-87902: Attackers Started Probing WordPress Sites Hours After the Patch
Patchstack, 2026-09-22. Read, 10 min.
WordPress 7.1.2 fixes CVE-2026-87902, an unauthenticated local file inclusion in page template resolution that Patchstack lists at CVSS 9.2 and says can lead to code execution under certain conditions, and Patchstack saw the first probing requests on September 22, the day the fix was published. Its September 23 update says attackers are now using the flaw to write PHP files to disk and that public scanning tooling for the CVE is in circulation.
Why it matters for this role: Look for PHP files written to disk on any WordPress site left unpatched since September 22, the activity Patchstack reported in its September 23 update.
The quiz for this edition has closed.