Remote-access gateways under attack, a patched SharePoint flaw goes live, and CISA changes the signal.

What happened

Two flaws, both rated 9.8 of 10. The first (CVE-2026-85102) is in how Check Point Security Gateways and Spark firewalls handle VPN certificates, and lets an attacker in without logging in. Check Point says exploitation attempts against Spark customers have been happening globally since Sep 12; the fix has been available since Sep 9. The second (CVE-2026-93616) is in the Security Management server; Check Point saw a handful of pinpointed attacks on July 23, and the fix shipped Sep 22. CISA added both to its exploited list on Sep 22, with a federal deadline of Sep 25.

Are you exposed?

If your firewall is a Check Point (including the Spark models many MSPs sell to smaller offices) and it runs the VPN, or if you have a Check Point management server. Financial-services firms are frequent Check Point customers.

What to do, by when

This week: confirm the gateway fix (sk1000117) and the management fix (sk1000171) are installed, in writing. Ask for a review of VPN logs for unusual certificate-based logins since Sep 12, and for any internal port scanning afterwards, which is what an attacker does once inside.

Sources: Check Point security advisory · CISA KEV addition, Sep 22, 2026 · Security Affairs · SecurityWeek

What happened

Microsoft confirmed “reliable evidence of observed attacks” against CVE-2026-65660, a code-injection flaw in SharePoint that Microsoft fixed in its August 2026 updates. Viettel Security published a technical write-up on Sep 22; the first exploitation attempts were seen on Sep 24. CISA added it to the exploited list on Sep 25 and gave federal agencies three days. It is the 16th SharePoint flaw in that catalog.

Are you exposed?

If you run SharePoint Server on your own hardware or in your own cloud tenancy and haven’t installed the August update. If you only use SharePoint through Microsoft 365, Microsoft patches it for you, but ask your IT team to confirm there’s no leftover on-premises SharePoint from a past project. There usually is.

What to do, by when

This week: confirm the August SharePoint security update is installed on every SharePoint server, including test and archive boxes. An attacker needs a low-level login to use this flaw, so also confirm that former employees’ accounts are disabled.

Sources: CISA KEV addition, Sep 25, 2026 · SecurityWeek · Viettel Security write-up · Previdian · The Hacker News · eSecurity Planet

What happened

WordPress released version 7.1.2 on Sep 22 to fix a flaw (CVE-2026-87902) that lets an attacker with no login run code on the web server in certain setups. The first attack attempt was seen at 11:49 UTC that same day, and within a day attack traffic was more than ten times the first evening’s volume, according to Patchstack. CISA added it to the exploited list on Sep 25.

Are you exposed?

Most companies your size have a WordPress marketing site, usually run by an agency or a hosting company, and usually forgotten by IT. The flaw needs specific conditions (a theme folder whose name starts with “page-”, and a PHP setting that is on in the official Docker PHP image and in default cPanel hosting with PHP older than 8.5), but you won’t know which apply without asking.

What to do, by when

This week: ask whoever runs the website to confirm, in writing, that it is on WordPress 7.1.2 and that automatic core updates are on. Ask them to review the server for unexpected files in the temporary folders. A defaced or malware-serving website is a customer-facing incident, not an IT one.

Sources: BleepingComputer · WordPress 7.1.2 release · Patchstack · KEV addition (The Hacker News)

What happened

F5 disclosed and hotfixed a flaw in BIG-IP Access Policy Manager on Sep 22 that lets an attacker run code without logging in. F5 found it internally and says it has been exploited. CISA added it the same day with a three-day federal deadline.

Are you exposed?

Only if a BIG-IP APM access policy and an OAuth profile are configured on a virtual server acting as an OAuth Authorization Server. Using BIG-IP as an OAuth client or resource server is not affected. Most mid-market companies don’t run BIG-IP at all; those that do are usually larger financial-services or healthcare organizations.

What to do, by when

One question to your IT lead: “Do we run F5 BIG-IP, and is APM configured as an OAuth authorization server anywhere?” If no, you’re done. If yes, apply the hotfix in your next change window this week.

Sources: The Hacker News · Rapid7 analysis · KEV addition (Security Affairs)

What happened

CISA retired its long-running weekly bulletin and pointed subscribers to its Known Exploited Vulnerabilities catalog, its alerts and advisories, and the CVE program instead, citing real-world risk “rather than severity scores alone.” Separately, since April 15 NIST fully analyzes only vulnerabilities that are in that catalog or that affect federal or critical software; everything else is “lowest priority, not scheduled.”

Why it matters

Many IT teams and MSPs built their patching rhythm on those two sources. A program that waits for a severity score from the national database may now wait indefinitely for one. The signal that matters is “is this being exploited, and do we run it?”, which is exactly how this brief is built. This week’s SharePoint item is the cautionary tale: a scored, patched flaw that sat for six weeks.

What to do

Ask whoever runs patching two questions: “Did we rely on the CISA weekly bulletin or on NVD scores to decide what to patch first?” and “What replaces it?” The answer you want: the KEV catalog (email updates and a machine-readable feed), vendor advisories for the products we run, and a rule that anything in KEV gets patched within days, not the monthly cycle.

Sources: CISA: sunsetting the Weekly Vulnerability Bulletin · NIST: NVD operations update, April 2026 · CISA KEV catalog · KEV data feeds (JSON / CSV)