Vulnerability Management Analyst: 2026-09-25
20 minutes in total
AL26-022 - Vulnerability impacting F5 BIG-IP Access Policy Manager (APM) - CVE-2026-94127
Canadian Centre for Cyber Security, 2026-09-22. Read, 3 min.
The Cyber Centre warns that CVE-2026-94127, a heap-based buffer overflow in F5 BIG-IP APM where an APM access policy and an OAuth profile are configured on the same virtual server, may let an unauthenticated attacker execute code, and that F5 has indicated it is exploited in the wild. F5's own record limits the flaw to APM configured as an OAuth Authorization Server, and fixed hotfixes exist for 17.1, 17.5, and 21.1, with an iRule available from F5 Support.
Why it matters for this role: Before ranking every BIG-IP as urgent, check which ones run APM as an OAuth Authorization Server, the only configuration F5's record says is exposed.
AL26-023 - Vulnerability Impacting Microsoft SharePoint Server - CVE-2026-65660
Canadian Centre for Cyber Security, 2026-09-24. Read, 4 min.
The Canadian Centre for Cyber Security says it is aware of active exploitation of CVE-2026-65660, a code injection flaw that could let an authenticated attacker execute code on SharePoint Server and that, chained with other SharePoint vulnerabilities, can achieve pre-authentication remote code execution on servers configured to permit anonymous access. The alert lists fixed builds for SharePoint Server 2016, 2019, and Subscription Edition, and notes that 2016 and 2019 reached end of life on July 15, 2026.
Why it matters for this role: Rank SharePoint servers that permit anonymous access first, since that is the configuration where the Cyber Centre says chaining reaches code execution without authentication.
Check Point, 2026-09-22. Read, 3 min.
Check Point reports a wave of exploitation attempts since September 12 against Spark customers using CVE-2026-85102, a pre-authentication remote code execution flaw in Security Gateway VPN certificate handling that it fixed on September 9. Separately, it identified a handful of pinpointed attacks on July 23, 2026 exploiting CVE-2026-93616, a newly discovered pre-authentication path traversal in the Security Management web service, and made a fix available with this advisory.
Why it matters for this role: Verify Security Management servers against the fixed Jumbo Hotfix takes for CVE-2026-93616, because Check Point says LivePatch Take 28/29 does not address the issue.
CVE-2026-87902: Attackers Started Probing WordPress Sites Hours After the Patch
Patchstack, 2026-09-22. Read, 10 min.
WordPress 7.1.2 fixes CVE-2026-87902, an unauthenticated local file inclusion in page template resolution that Patchstack lists at CVSS 9.2 and says can lead to code execution under certain conditions, and Patchstack saw the first probing requests on September 22, the day the fix was published. Its September 23 update says attackers are now using the flaw to write PHP files to disk and that public scanning tooling for the CVE is in circulation.
Why it matters for this role: Schedule WordPress sites by exposure now that Patchstack reports public scanning tooling for CVE-2026-87902 and attackers writing PHP files to disk within a day of the fix.
The quiz for this edition has closed.