September 25, 2026

Command View

Verification cutoff

September 25, 2026, 13:30:55 UTC. This edition prioritizes September 24 attempts to chain SharePoint Server vulnerabilities and two newly cataloged exploited flaws in WSO2 and Adobe Commerce/Magento. F5 and Check Point exploitation remains urgent for operators with unresolved exposure; no material change to their September 22 advisories was verified today.

Priority posture

  • RED: SharePoint exploit-chain attempts and the new WSO2 and Adobe KEV listings require exposure checks, fixes, and investigation where vulnerable systems were reachable.
  • AMBER: The SharePoint capture does not prove code execution on a production server. The attempted anonymous route depends on a separate, earlier flaw and anonymous viewing.
  • WATCH: CISA calls WSO2 CVE-2026-5430 path traversal, while WSO2 describes JSON Web Token (JWT) authentication bypass. The discrepancy remains unresolved.
  • CONTEXT: A Known Exploited Vulnerabilities (KEV) listing establishes exploitation somewhere, not compromise of every affected installation.

Today's decisions

  • RED — SharePoint and incident-response owners: Verify August and earlier updates on every on-premises farm; inspect anonymous-viewing sites and investigate the two-stage request pattern.
  • RED — Identity/API platform owner: Apply WSO2's product-specific update level, then review privileged tokens and API-management changes.
  • RED — Commerce platform owner: Verify the August 2026 fix for CVE-2026-71362 and its required July predecessor where using isolated patches; investigate customer-account activity.
  • RED — Network and firewall owners: Close unresolved F5 and Check Point exposure using their separate, product-specific guidance.

Threat and Resilience Ledger

[RED] — On-premises collaboration servers | Global product exposure; Canadian alert — SharePoint exploit-chain requests observed

Canada's Cyber Centre warned September 24 about activity targeting CVE-2026-65660, a SharePoint Server code-injection vulnerability patched in August. Previdian captured 12 requests to one honeypot around 12:00 UTC September 24: two payloads sent across six URL paths. One attempted to disable a deserialization safeguard; the next carried an encrypted assembly loader. The CVE itself requires authentication. The unauthenticated requests attempted to combine it with a separate, previously patched delivery weakness on sites allowing anonymous viewing. Previdian could not demonstrate that this payload variant succeeded on a real server and did not recover the final assembly. Verify all applicable updates and farm configuration; correlate web requests with host and authentication telemetry before concluding compromise.

Evidence: confirmed honeypot exploitation attempts and government alert; successful production intrusion unproved. Attribution: unknown. Confidence: high for captured requests and vendor fixes; low for success elsewhere. Uncertainty: whether this specific chain works on real farms and what the encrypted final payload does. Sources: Canadian Centre for Cyber Security — “AL26-023 - Vulnerability Impacting Microsoft SharePoint Server - CVE-2026-65660,” September 24; Previdian — “CVE-2026-65660: Previdian observes two-stage SharePoint exploitation attempts,” September 24; Microsoft — “Microsoft SharePoint Server Remote Code Execution Vulnerability,” August 11.

[RED] — Identity and API control plane | Global product exposure — WSO2 flaw added to KEV

CISA added CVE-2026-5430 to KEV September 24, a material change since WSO2's earlier advisory. WSO2 says affected API Manager, API Control Plane, Traffic Manager, and Universal Gateway releases can accept JWTs signed with unsupported algorithms, permitting authentication bypass and potentially account takeover. CISA's notice calls the same CVE path traversal; defenders should not combine these descriptions into an unsupported attack path. KEV establishes exploitation, but not victim count or the extent of any account takeover. Apply WSO2's component-specific update and assess privileged accounts, token use, gateway policy changes, and downstream access.

Evidence: CISA KEV designation and vendor-described mechanism. Attribution: unknown. Confidence: high for exploitation status and vendor fixes; unresolved for CISA's vulnerability label. Uncertainty: attack scope and the cause of the description mismatch. Sources: CISA — “CISA Adds Two Known Exploited Vulnerabilities to Catalog,” September 24; WSO2 — “Security Advisory WSO2-2026-5328/CVE-2026-5430,” published May 3.

[RED] — Customer-account and commerce platform | Global product exposure — Adobe Commerce/Magento flaw added to KEV

CISA added CVE-2026-71362 to KEV September 24, when Canada's Cyber Centre also updated its Adobe advisory. Adobe's August 11 bulletin describes unauthenticated incorrect authorization leading to privilege escalation, rated CVSS 9.1. Its statement that it knew of no exploitation belonged to that August bulletin; the later government assessment changes today's posture. Adobe Commerce, Commerce B2B, and Magento Open Source require the applicable August fix. For isolated patches, Adobe requires the matching July patch first and verification by installed component. Investigate unusual customer-session and account changes where exposure existed. The bulletin's references to code execution include other CVEs and must not be assigned to CVE-2026-71362.

Evidence: KEV designation and Adobe patch guidance; no verified victim count. Attribution: unknown. Confidence: high for severity, affected branches, and fix sequence; moderate for exploitation scope. Uncertainty: successful account access and available forensic indicators. Sources: CISA — “CISA Adds Two Known Exploited Vulnerabilities to Catalog,” September 24; Canadian Centre for Cyber Security — “Adobe security advisory (AV26-808) – Update 2,” September 24; Adobe — “Security update available for Adobe Commerce | APSB26-92,” August 11; Adobe Commerce — “Security update available for Adobe Commerce - APSB26-92,” updated September 5.

Defensive Posture Changes

Treat SharePoint as a two-flaw chain

Check the August code-injection fix and earlier SharePoint updates separately. Search for POST requests to AddGallery.aspx and designgallery.aspx with DisplayMode=Edit, including repeated /_layouts/ segments; correlate with IIS, SharePoint, endpoint, and authentication logs. A matching request is an attempted attack, not proof of execution. If execution is verified, preserve evidence and investigate machine keys, web shells, administrative changes, and lateral access.

Validate identity and commerce trust after patching

For WSO2, review privileged tokens and downstream access; revoke or rotate credentials where investigation establishes exposure. For Adobe Commerce, inspect customer-account and session changes. The August isolated fixes depend on matching July fixes and component patches. Verify the per-CVE state with Adobe's Commerce Version Tool or the supported cloud patch workflow.

Close older edge exposure by configuration

For F5, determine whether an APM access policy and OAuth profile share a virtual server, then validate the branch-specific hotfix. Check Point's Security Gateway VPN certificate flaw and Security Management web-service flaw have separate remedies. Preserve logs and assess prior access where either system was exposed.

Regional and Sector Pulse

  • North America — RED: Canada's September 24 SharePoint and Adobe notices change defensive priority. They do not establish a Canadian victim cluster.
  • Global platform exposure — RED: Affected SharePoint, WSO2, and Adobe installations span sectors. No sector-specific victim count or operational outage is established by today's evidence.
  • Europe; Africa; Middle East; Asia; Russia; China; Indo-Pacific (including India) — WATCH: No distinct regional victim or actor finding was verified for these developments. Prioritize local installations and exposure conditions without inferring geographic targeting.

Vulnerability and Supplier Watchlist

Microsoft SharePoint Server

Issue: CVE-2026-65660; authenticated code execution, with attempted unauthenticated chaining through a separate anonymous-delivery flaw.
Affected scope: vulnerable on-premises SharePoint Server 2016, 2019, and Subscription Edition. The attempted anonymous route additionally requires anonymous viewing and missing earlier updates.
Fixed release: 2016 16.0.5565.1001; 2019 16.0.10417.20198; Subscription Edition 16.0.19725.20522. Verify all applicable updates and farm configuration; Canada notes 2016 and 2019 are out of support.
Severity: Microsoft CVSS 8.8 for the authenticated CVE.
Status: RED — exploit-chain attempts observed; real-server success unverified.

WSO2 API Manager and associated components

Issue: CVE-2026-5430; WSO2 describes JWT authentication bypass; CISA uses a conflicting path-traversal label.
Affected scope: named API Manager 4.1.0–4.6.0 releases and specified 4.5.0/4.6.0 API Control Plane, Traffic Manager, and Universal Gateway components below fixed update levels.
Fixed release: API Manager 4.1.0.257, 4.2.0.197, 4.3.0.108, 4.4.0.72, 4.5.0.57, or 4.6.0.21, respectively. Consult WSO2 for companion-component levels and public community fixes.
Severity: WSO2 critical, CVSS 10.0; 9.8 for single-tenant deployments.
Status: RED — newly KEV-listed.

Adobe Commerce, Commerce B2B, and Magento Open Source

Issue: CVE-2026-71362; unauthenticated incorrect authorization and privilege escalation.
Affected scope: Adobe Commerce 2.4.9-2026-jul and earlier and named 2.4.8–2.4.4 July branches; Commerce B2B's named 1.5.3–1.3.3 July branches; Magento Open Source's named 2.4.9–2.4.6 July branches. Verify component and patch state.
Fixed release: matching -2026-aug security fix, or the corresponding isolated August patch after the matching July predecessor. Adobe's Commerce Version Tool verifies per-CVE status.
Severity: Adobe critical, CVSS 9.1.
Status: RED — newly KEV-listed; patch order matters.

Outlook and Uncertainty

Next 24 hours

Watch for SharePoint exploitation confirmed outside a honeypot, recovery of the encrypted final payload, clarification of WSO2's conflicting classification, and updated Adobe detection guidance. Check for substantive F5 or Check Point forensic revisions before closing earlier response work.

What is not known

The SharePoint capture does not prove successful execution in production. The new KEV entries provide no public victim counts. Adobe's August no-exploitation statement predates September's KEV addition. Public indicators are incomplete.

Trigger for escalation

SharePoint web shells, machine-key access, or verified code execution trigger host and identity recovery. Unauthorized WSO2 privileged tokens trigger downstream service and secret review. Unauthorized Adobe customer-account changes trigger a commerce incident investigation.

© 2026 Border Cyber Group. All rights reserved.

Source Register

SharePoint CVE-2026-65660

Canadian Centre for Cyber Security — “AL26-023 - Vulnerability Impacting Microsoft SharePoint Server - CVE-2026-65660,” September 24, 2026:
https://www.cyber.gc.ca/en/alerts-advisories/al26-023-vulnerability-impacting-microsoft-sharepoint-server-cve-2026-65660

Previdian — “CVE-2026-65660: Previdian observes two-stage SharePoint exploitation attempts,” September 24, 2026:
https://blog.previdian.com/cve-2026-65660-previdian-observes-two-stage-sharepoint-exploitation-attempts/

Microsoft Security Response Center — “Microsoft SharePoint Server Remote Code Execution Vulnerability,” August 11, 2026:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660

WSO2 CVE-2026-5430

CISA — “CISA Adds Two Known Exploited Vulnerabilities to Catalog,” September 24, 2026:
https://www.cisa.gov/news-events/alerts/2026/09/24/cisa-adds-two-known-exploited-vulnerabilities-catalog

WSO2 — “Security Advisory WSO2-2026-5328/CVE-2026-5430,” published May 3, 2026:
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/

Adobe Commerce / Magento CVE-2026-71362

Canadian Centre for Cyber Security — “Adobe security advisory (AV26-808) – Update 2,” September 24, 2026:
https://www.cyber.gc.ca/en/alerts-advisories/adobe-security-advisory-av26-808

Adobe — “Security update available for Adobe Commerce | APSB26-92,” August 11, 2026:
https://helpx.adobe.com/security/products/magento/apsb26-92.html

Adobe Commerce — “Security update available for Adobe Commerce - APSB26-92,” updated September 5, 2026:
https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-40380

F5 and Check Point carry-forward guidance

Canadian Centre for Cyber Security — “AL26-022 - Vulnerability impacting F5 BIG-IP Access Policy Manager (APM) – CVE-2026-94127,” September 22, 2026:
https://www.cyber.gc.ca/en/alerts-advisories/al26-022-vulnerability-impacting-f5-big-ip-access-policy-manager-apm-cve-2026-94127

Check Point Research — “Security Advisory – Action Required – Active Exploitation of CVE-2026-85102 and a Management Pre-Authentication Vulnerability CVE-2026-93616,” September 22, 2026:
https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/

This briefing is intended for defensive awareness and operational decision-making, not as a substitute for incident response, vendor guidance, or legal advice.

Jonathan Brown writes independent, decision-focused analysis on cybersecurity, infrastructure resilience, and operational risk, with an emphasis on primary-source verification and explicit uncertainty.

Support this work by sharing the briefing with operators who can act on it. Corrections supported by primary evidence are welcomed; material errors should be amended transparently. Feel free to subscribe, comment, or buy us a coffee! Thanks.

© 2026 Border Cyber Group. All rights reserved.