SOC Analyst: 2026-09-25
21 minutes in total
AL26-022 - Vulnerability impacting F5 BIG-IP Access Policy Manager (APM) - CVE-2026-94127
Canadian Centre for Cyber Security, 2026-09-22. Read, 3 min.
The Cyber Centre warns that CVE-2026-94127, a heap-based buffer overflow in F5 BIG-IP APM where an APM access policy and an OAuth profile are configured on the same virtual server, may let an unauthenticated attacker execute code, and that F5 has indicated it is exploited in the wild. F5's own record limits the flaw to APM configured as an OAuth Authorization Server, and fixed hotfixes exist for 17.1, 17.5, and 21.1, with an iRule available from F5 Support.
Why it matters for this role: Triage OAuth authentication failures on BIG-IP APM in bulk rather than one at a time, since the Cyber Centre's indicator is failures in rapid succession or large volume.
AL26-023 - Vulnerability Impacting Microsoft SharePoint Server - CVE-2026-65660
Canadian Centre for Cyber Security, 2026-09-24. Read, 4 min.
The Canadian Centre for Cyber Security says it is aware of active exploitation of CVE-2026-65660, a code injection flaw that could let an authenticated attacker execute code on SharePoint Server and that, chained with other SharePoint vulnerabilities, can achieve pre-authentication remote code execution on servers configured to permit anonymous access. The alert lists fixed builds for SharePoint Server 2016, 2019, and Subscription Edition, and notes that 2016 and 2019 reached end of life on July 15, 2026.
Why it matters for this role: Give SharePoint, IIS, and AMSI detections closer attention during triage, because the Cyber Centre reports active exploitation and names those sources to monitor.
Check Point, 2026-09-22. Read, 3 min.
Check Point reports a wave of exploitation attempts since September 12 against Spark customers using CVE-2026-85102, a pre-authentication remote code execution flaw in Security Gateway VPN certificate handling that it fixed on September 9. Separately, it identified a handful of pinpointed attacks on July 23, 2026 exploiting CVE-2026-93616, a newly discovered pre-authentication path traversal in the Security Management web service, and made a fix available with this advisory.
Why it matters for this role: Expect attempts against Spark firewalls to arrive from anonymization infrastructure such as VPN services and proxies, which is where Check Point saw the wave that began September 12.
One URL, Three Different Tricks
SANS Internet Storm Center, 2026-09-24. Read, 3 min.
SANS Internet Storm Center handler Xavier Mertens examined a phishing link that combines a random userinfo string before an @, a hostname label ending in hyphens on a lookalike domain, and the recipient's email address appended to the path. A naive filter sees email addresses or a link to the recipient's own domain, a strict validator may drop the link as an invalid hostname, and the browser follows a valid URL to the phishing page.
Why it matters for this role: Parse reported phishing links by the browser's rules, with the host ending at the first slash, because this link used a userinfo string and the recipient's own address to mislead simpler parsers.
The Rogue RMM Stack: One Phish, Multiple Persistence Paths
Huntress, 2026-09-23. Read, 8 min.
In one Huntress SOC investigation, a secure-document phishing lure hid the installation of a rogue ITarian remote monitoring and management client, followed by a ScreenConnect session for persistent access. Huntress says attackers stack remote-access clients so they keep a backup path if the first installation is found and removed.
Why it matters for this role: An alert on a new RMM install that follows a document the user expected to read is the moment to check it against the approved tool list, before a second client follows.
The quiz for this edition has closed.