Cyber Risk Brief: 21 - 27 September 2026
CRB-2728 September 2026Sovereign GRC Intel24 min read
Disclaimer:This brief is governance commentary for leadership and risk teams, not incident notification, public attribution, legal advice, or quantitative risk analysis. Threat prioritization, framework mappings, attribution, and risk-zone groupings are informational only. Validate all technical claims against vendor advisories and internal telemetry before operational response.
Threat Intelligence Summary
Thirteen rows for 21 to 27 September. Canada leads: Burnaby School District (T1) is investigating a cyber incident discovered on 21 September, and personal-information impact is still unconfirmed. CCCS Alert AL26-023 (T2) covers active exploitation of SharePoint CVE-2026-65660, due today, and CCCS Alert AL26-024 (T3) covers a same-day Citrix NetScaler zero-day pair, due 30 September, with a CISA forensic-triage directive attached. Six KEV deadlines have already passed: F5 BIG-IP APM (T4), both Check Point flaws (T5, T6), VeloCloud Orchestrator (T7), Adobe Commerce (T8), and Zyxel GS1900 (T9). WordPress (T10) and MikroTik CVE-2026-67279 (T11) are also due today. Roundcube (T12) is not in KEV; CCCS said this week that exploitation is underway. PeopleSoft (T13) has been in KEV since June, and the new fact this week is a WAF-bypass technique that reopened it against organizations that never installed the patch. Sort by KEV date, then by whether the NVD description matches the headline. One KEV addition is absent on purpose: CVE-2026-5430. NVD describes JWT algorithm confusion. The KEV name and The Hacker News describe path traversal. Those are not the same flaw, so the row was not written.
Threat Register
| Threat | |||||
|---|---|---|---|---|---|
T1Canadian victim: Burnaby School District (School District 41, British Columbia). Personal-information impact unconfirmed. | Burnaby School District Cyber Incident (no CVE) • The district says a cyber incident came to its attention on Monday 21 September 2026. Internal network services and phone lines were affected.
• On the afternoon of 25 September, superintendent Karim Hachlaf said unauthorized activity was identified on the network and that it was not yet confirmed whether personal information was accessed, acquired, or removed.
• Freshet News reported the same day that the district had notified the Burnaby RCMP and the Office of the Information and Privacy Commissioner for British Columbia.
• CBC reported on 24 September that phones, Wi-Fi, and printing were disrupted. No CVE is named in the district notice or in that reporting. | — | — | High | Post-incident |
T2CCCS Alert AL26-023, 24 September 2026. Not a confirmed Canadian victim incident. | Microsoft SharePoint Code Injection (CVE-2026-65660) • CCCS Alert AL26-023 (24 September 2026) says CVE-2026-65660 is under active exploitation. NVD describes code injection that allows an authorized attacker to execute code over the network. CVSS 3.1 is 8.8.
• CCCS says that, chained with other SharePoint vulnerabilities, the flaw can reach pre-authentication remote code execution on servers configured to permit anonymous access, if earlier SharePoint updates were not fully applied.
• CISA KEV added 25 September 2026. Federal due date 28 September 2026 (this brief's publication day).
• Fixed builds named by CCCS: SharePoint Enterprise Server 2016 version 16.0.5565.1001, SharePoint Server 2019 version 16.0.10417.20198, Subscription Edition version 16.0.19725.20522. CCCS states 2016 and 2019 reached end of life on 15 July 2026. | Critical | 28 Sep | ||
T3CCCS Alert AL26-024, 27 September 2026. Not a confirmed Canadian victim incident. | Citrix NetScaler ADC/Gateway Unauthenticated RCE (CVE-2026-88771 / CVE-2026-88772) • Citrix's security bulletin (CTX697096) confirms two vulnerabilities under active exploitation as zero-days, before a fix was public. CVE-2026-88771 is improper input validation letting an unauthenticated attacker run arbitrary commands, on the default configuration, no additional feature required. CVE-2026-88772 is a memory-overflow flaw leading to remote code execution or denial of service, reachable when DTLS is enabled, which is on by default on a VPN virtual server.
• watchTowr reported unpatched NetScaler RCE exploitation a day before Citrix's 27 September confirmation. CISA says it has received reports and partner threat intelligence confirming active exploitation globally.
• CISA KEV added both CVEs 27 September 2026. Federal due date 30 September 2026, and CISA's BOD 26-04 requires forensic triage for compromise before the patch is applied, not patch-then-check.
• CCCS Alert AL26-024, also 27 September 2026, covers both CVEs for Canadian organizations.
• Fixed in NetScaler ADC and Gateway 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, and 13.1-37.279 (FIPS/NDcPP editions), per Citrix's bulletin. | — | Critical | 30 Sep | |
T4 | F5 BIG-IP APM OAuth RCE (CVE-2026-94127) • Heap-based buffer overflow in BIG-IP APM. NVD CVSS 4.0 is 9.3. The Hacker News reports F5's own scores as CVSS 3.1 9.8 and CVSS 4.0 9.3.
• NVD: when an APM access policy and an OAuth profile are configured on a virtual server, malicious traffic can lead to remote code execution. F5 later narrowed the condition to APM acting as an OAuth authorization server. Deployments that use APM only as an OAuth client or resource server are not affected.
• F5 says attackers are exploiting it. CISA KEV added 22 September 2026. Federal due date 25 September 2026 (passed).
• Engineering hotfixes named by The Hacker News: Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG, and Hotfix-BIGIP-17.1.3.5.0.41.14-ENG. Limiting the management interface does not stop traffic to the virtual server. An iRule mitigation is available through an F5 support ticket. | Critical | 25 Sep · passed | ||
T5 | Check Point Management Server Script Upload (CVE-2026-93616) • NVD: a directory traversal and file-upload flaw allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server. CVSS 3.1 is 9.8. EPSS on 26 September 2026 was 0.19654, the second-highest on this register.
• Check Point told The Hacker News the flaw was exploited in a handful of targeted attacks on 23 July 2026. A fix was released 22 September 2026.
• CISA KEV added 22 September 2026. Federal due date 25 September 2026 (passed).
• The Hacker News lists affected trains including R82.20, R82.10 at Jumbo Hotfix Take 44 or below, R82 at Take 126 or below, and R81.20 at Take 166 or below. LivePatch takes that fixed a different management flaw (CVE-2026-91843) do not fix this one. Fixed builds are in Check Point support article sk1000171. | Critical | 25 Sep · passed | ||
T6 | Check Point Security Gateway VPN RCE (CVE-2026-85102) • NVD: improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code. CVSS 3.1 is 9.8.
• BleepingComputer reports Check Point confirmed active exploitation. Attempts against Spark customers started 12 September 2026 from anonymizing infrastructure. Certificate subjects observed include CN=vpn, CN=vpn-user, and CN=vpnuser, each with OU=users, O=global. Check Point says that list is not complete.
• Fixes have been available since 9 September. When the fix shipped, Check Point had no evidence of exploitation. CISA KEV added 22 September 2026. Federal due date 25 September 2026 (passed).
• BleepingComputer: LivePatch Take 26 on supported R81.20, R82, or R82.10 gateways, or Jumbo Hotfix R81.20 Take 166, R82 Take 126, R82.10 Take 44, or R81.10 Take 190, or later. Spark: R82.00.10 Build 2325 or R81.10.17 Build 4968, or later. | Critical | 25 Sep · passed | ||
T7 | Arista VeloCloud Orchestrator Input Validation (CVE-2026-93952) • NVD CVSS 4.0 is 9.5. The Hacker News reports Arista's CVSS 3.1 score as 10.0. NVD: a remote attacker may access privileged internal functions and affect an on-premises VeloCloud Orchestrator host. Hosted and Dedicated VCO were patched by the vendor.
• Arista says the flaw was discovered externally and is known to be actively exploited. Only orchestrators that authenticate Edges with certificates are exposed. The attacker also needs network access to the VCO web interface and the public part of an Edge certificate.
• CISA KEV added 22 September 2026. Federal due date 25 September 2026 (passed).
• Fixed, as of 22 September: 5.2.3.16 and later, and 6.4.2.8 and later. No fix yet for the 6.1 and 7.0 trains. The Hacker News lists Arista's compromise indicators, including /usr/local/sbin/.vcnode.js, /usr/local/sbin/vc-sysmond, and HTTP header x-vc-opt. | Critical | 25 Sep · passed | ||
T8 | Adobe Commerce Incorrect Authorization (CVE-2026-71362) • NVD: incorrect authorization in Adobe Commerce could let an attacker gain elevated access to sensitive resources without user interaction. CVSS 3.1 is 9.1. EPSS on 26 September 2026 was 0.87507, the highest on this register.
• This flaw was on the 17 August brief, when it was not in CISA KEV and Adobe said it was not aware of exploitation. New this week: CISA added it on 24 September 2026. Federal due date 27 September 2026 (passed before this brief's 28 September publication day).
• The Hacker News, citing Sansec, says the flaw lets an attacker switch a customer session to another customer account. The same article says Previdian saw one Australian IP attempt the flaw against honeypots on 10 September, and that Adobe has not updated its advisory to confirm exploitation. | Critical | 27 Sep · passed | ||
T9 | Zyxel GS1900 Switch Command Execution (CVE-2026-7273) • NVD: a stack-based buffer overflow in the CGI program of Zyxel GS1900-48HPv2 firmware through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to execute OS commands via a crafted HTTP request. CVSS 3.1 is 8.8.
• CISA KEV added 21 September 2026. Federal due date 24 September 2026 (passed). The Hacker News says Zyxel patched the series in June and has not revised its alert to confirm exploitation.
• The Hacker News, citing GreyNoise, says a suspected Chinese-speaking actor has exploited the flaw since 17 August 2026 and exfiltrated data from 996 Zyxel switches across 48 countries. Countries named in that report are Italy, the United States, Taiwan, France, and South Korea. Canada is not named.
• Fixed firmware is the 2.90 second build for each GS1900 model The Hacker News lists, for example GS1900-48HPv2 2.90(ABTQ.2)C0. | Critical | 24 Sep · passed | ||
T10 | WordPress Core Page-Template Inclusion (CVE-2026-87902) • NVD CVSS 3.1 is 8.1. SecurityWeek reported a score of 9.2. NVD and WordPress's advisory, as quoted by SecurityWeek: an unauthenticated attacker can make get_page_template() include a chosen readable local .php file outside the active theme. Remote code execution follows only if server and theme preconditions are both met.
• Those conditions, per SecurityWeek quoting WordPress: the top-level directory of the active child or parent theme starts with "page-", and the web server account can read the target .php file. pearcmd.php is a known path when register_argc_argv is On. Themes named include Twenty Twelve, Twenty Fourteen, Neve, Hestia, and Sydney.
• Fixed on 22 September 2026 in WordPress 7.1.2, backported through 4.7.x. Patchstack told SecurityWeek exploitation began within hours and had escalated to compromises by 23 September.
• CISA KEV added 25 September 2026. Federal due date 28 September 2026 (this brief's publication day). The Hermes sheet had marked this row KEV=NO. | Critical | 28 Sep | ||
T11 | MikroTik RouterOS SSH Rekey (CVE-2026-67279) • NVD CVSS 4.0 is 6.9. An unauthenticated client can open a session channel after a rekey even though user authentication never completed, and on affected builds can create or overwrite files in the RouterOS file namespace, including support files with configuration and diagnostics.
• Fixed in RouterOS 6.49.21, 7.23.4, and 7.24.2, per NVD.
• New this week relative to the 14 September brief: CISA added CVE-2026-67279 to KEV on 25 September 2026. Federal due date 28 September 2026 (publication day). The score on this row is for CVE-2026-67279 only.
• The Hacker News on 23 September describes this CVE as one half of the MikroTrick chain with CVE-2026-86060, which CISA had already listed on 10 September. That second CVE is not the score shown here. | Critical | 28 Sep | ||
T12 | Roundcube virtuser_query SQL Injection (CVE-2026-48842) • NVD: pre-authentication SQL injection in the virtuser_query plugin of Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, via a preg_replace() backslash escape bypass. CVSS 3.1 is 8.1. Not in the CISA KEV catalog as of 26 September 2026.
• The Hacker News reports that the Canadian Centre for Cyber Security said this week the flaw is being actively exploited, citing open-source reporting, and that no further exploitation detail was disclosed. Patches shipped in May 2026 as 1.6.16 and 1.7.1.
• Shadowserver figures in that article: more than 523,000 Roundcube instances exposed to the internet, with 10 flagged as vulnerable as of 23 September 2026. | High | Immediate | ||
T13 | Oracle PeopleSoft PeopleTools WAF-Bypass Revives Exploitation (CVE-2026-35273) • CVE-2026-35273 is a pre-authentication SSRF-to-RCE flaw in PeopleSoft Enterprise PeopleTools 8.61 and 8.62, CVSS 3.1 9.8. Oracle shipped an out-of-band patch (CPU187) on 10 June 2026 after ShinyHunters exploited it as a zero-day against roughly 300 instances across 100-plus organizations, most of them universities. CISA added it to KEV on 12 June 2026.
• New this week: BleepingComputer, citing Google Mandiant and GTIG, reported 26 September that ShinyHunters is bypassing the WAF rules organizations used to virtually patch the flaw instead of upgrading. Many WAFs compare the literal request path before decoding and block '/PSEMHUB/'; Oracle WebLogic decodes an encoded path and routes it to the same vulnerable endpoint anyway. The technique has let ShinyHunters resume attacks against still-unpatched servers, deploying web shells and the SIDEEYE backdoor.
• Separately, ShinyHunters told BleepingComputer on 22 September that it used a second, unpatched PeopleSoft flaw — no CVE, not confirmed by Oracle or CISA — to breach the FBI's jobs platform and move laterally into FBI AWS GovCloud infrastructure. That claim is not the basis for this row; CVE-2026-35273 and the Mandiant-reported WAF bypass are. | Critical | 15 Jun · passed | ||
| Select a row for narrative, affected systems, remediation, and sources. | |||||
Threat Actor Profiling
T1 has no named actor or technique in the district notice or the Canadian reporting. T2 through T11 follow vendor or CISA statements of exploitation without a named group, except T9, where The Hacker News relays GreyNoise's description of a suspected Chinese-speaking cluster. T12 is a CCCS exploitation warning with no further detail. T13 is the one attributed row this week: Google Mandiant and GTIG name ShinyHunters for the WAF-bypass campaign. MITRE technique codes are hover-to-define abbreviations. A row with no sourced technique says so in prose instead of borrowing a code.
| Threats | Actor | Sectors | MITRE tradecraft | Kill chain |
|---|---|---|---|---|
| T1 | Unattributed. The district notice, CBC, and Freshet News do not name a group or a method | Education, Public Sector | No ATT&CK technique is named in the district notice, CBC, or Freshet News. | Not established in sourced reporting |
| T2 | Unattributed exploitation of SharePoint. CCCS confirms active exploitation and does not name a group | Cross-sector, Public Sector | Reach a server that allows anonymous access → chain SharePoint flaws to pre-authentication code execution → code runs over the network | |
| T3 | Unattributed. Citrix and CISA confirm exploitation as a zero-day and do not name a group; watchTowr first reported unpatched exploitation | Cross-sector, Network Infrastructure | Send a crafted request to the gateway with no login → arbitrary commands run on the appliance (CVE-2026-88771), or a DTLS memory overflow gives code execution (CVE-2026-88772) | |
| T4 | Unattributed. F5 and CISA confirm exploitation of the APM flaw and do not name a group | Cross-sector, Identity and Access | Send crafted traffic to the APM virtual server acting as an OAuth authorization server → heap overflow → code execution. F5 traces: failed UserInfo requests, then a TMM crash | |
| T5 | Unattributed. Check Point described a handful of targeted management-server attacks on 23 July 2026. No group is named | Cross-sector, Network Infrastructure | Directory traversal and file upload with no login → upload a script → run it on the management server | |
| T6 | Unattributed. Check Point confirmed VPN exploitation attempts from anonymizing infrastructure since 12 September 2026. No group is named | Cross-sector, Network Infrastructure | Present a crafted VPN certificate during negotiation with no login → code execution on the gateway | |
| T7 | Unattributed. Arista says the VeloCloud flaw was discovered externally and is being exploited. No group is named | Cross-sector, Network Infrastructure | Use the public part of an Edge certificate and reach the VCO web interface → privileged internal functions → files appear in /usr/local/sbin (.vcnode.js, vc-sysmond), x-vc-opt header in requests | |
| T8 | Unattributed session-switching attempts. The Hacker News cites Sansec and one Previdian honeypot IP. Adobe has not confirmed exploitation. No group is named | Retail, E-commerce | Attempt the flaw (one honeypot hit on 10 September) → switch a customer session to another customer account → act as that customer without their password | |
| T9 | GreyNoise-reported cluster exploiting Zyxel GS1900 switches since 17 August. The Hacker News says the activity is suspected Chinese-speaking and may be the same as, or overlap, the cluster Acronis calls Red Heron | Cross-sector, Network Infrastructure | Send a crafted HTTP request from the LAN with no login → OS commands run on the switch → configuration and hashed root credentials collected → sent out over TFTP (GreyNoise) | |
| T10 | Unattributed. Patchstack told SecurityWeek that exploitation of the WordPress flaw began within hours of disclosure. No group is named | Cross-sector, Web | Unauthenticated request makes get_page_template() include a local .php file → code runs only if the theme folder starts with page- and the server can read the file (pearcmd.php with register_argc_argv On) | |
| T11 | Unattributed MikroTrick activity described by CERT Polska via The Hacker News. No group is named. This row's KEV date is 25 September | Cross-sector, Network Infrastructure | Open an SSH session channel after a rekey without authenticating → create or overwrite files in the RouterOS namespace. With CVE-2026-86060 the chain reaches the admin console (CERT Polska traces: user -2, account ops) | |
| T12 | Unattributed. CCCS told The Hacker News the Roundcube flaw is being exploited and gave no further detail. No group is named for this CVE | Cross-sector, Email | Send crafted input to the virtuser_query plugin with no login → SQL injection reaches the database. CCCS disclosed no later steps | |
| T13 | ShinyHunters. Google Mandiant and GTIG, via BleepingComputer, attribute the WAF-bypass campaign to this group; the same actor separately claims an unconfirmed second PeopleSoft flaw used against the FBI | Higher Education, Cross-sector | URL-encode the /PSEMHUB/ path so the WAF rule misses it → WebLogic decodes it and routes to the vulnerable endpoint → web shell → SIDEEYE backdoor (Mandiant and GTIG) |
▶Table methodology & sourcing notes
- T1 has no sourced ATT&CK technique. Assigning ransomware or a public-exploit code would invent a method the district has not described.
- T5 and T6 are separate actor rows: the management-server attacks (23 July) and the VPN exploitation attempts (from 12 September) are distinct events on different surfaces, each unattributed. T9's Red Heron overlap is The Hacker News's wording, not a confirmed attribution. T11's score is CVE-2026-67279 only.
- Kill-chain steps come only from the cited reporting. Where a source stops, the chain stops (T12 Roundcube). MITRE codes are our classification of those sourced steps, not techniques a vendor or agency named.
- T3's score is CVE-2026-88771; CVE-2026-88772 is a same-severity companion flaw described in the row's summary, not a separate register entry. T13's ShinyHunters attribution covers only the WAF-bypass campaign Mandiant and GTIG reported — the group's separate FBI claim is unconfirmed and not the basis for this row.
Control Deficiency & Framework Mapping
| Threat | Control gaps | ISO 27001 | NIST CSF 2.0 | CIS Controls | Privacy Act / PIPEDA | ITSG-33 | OSFI B-13 | ISO 42001 |
|---|---|---|---|---|---|---|---|---|
T1Burnaby School District Cyber Incident (no CVE) |
| — | — | |||||
T2Microsoft SharePoint Code Injection (CVE-2026-65660) |
| — | — | |||||
T3Citrix NetScaler ADC/Gateway Unauthenticated RCE (CVE-2026-88771 / CVE-2026-88772) |
| — | — | |||||
T4F5 BIG-IP APM OAuth RCE (CVE-2026-94127) |
| — | — | |||||
T5Check Point Management Server Script Upload (CVE-2026-93616) |
| — | — | |||||
T6Check Point Security Gateway VPN RCE (CVE-2026-85102) |
| — | — | |||||
T7Arista VeloCloud Orchestrator Input Validation (CVE-2026-93952) |
| — | — | |||||
T8Adobe Commerce Incorrect Authorization (CVE-2026-71362) |
| — | — | |||||
T9Zyxel GS1900 Switch Command Execution (CVE-2026-7273) |
| — | — | |||||
T10WordPress Core Page-Template Inclusion (CVE-2026-87902) |
| — | — | |||||
T11MikroTik RouterOS SSH Rekey (CVE-2026-67279) |
| — | — | |||||
T12Roundcube virtuser_query SQL Injection (CVE-2026-48842) |
| — | — | |||||
T13Oracle PeopleSoft PeopleTools WAF-Bypass Revives Exploitation (CVE-2026-35273) |
| — | — |
Privacy Act / PIPEDA & OSFI: The column is blank on every row. T1 is a British Columbia school board. The sourced privacy fact is the district's notification to the Office of the Information and Privacy Commissioner for British Columbia, reported by Freshet News on 25 September. That is not a PIPEDA file. T2 and T3 are CCCS alerts, not confirmed Canadian victim incidents. CVE rows T3–T13 do not by themselves establish a PIPEDA breach. No row this week is an AI system, so ISO 42001 is unmapped. Federally regulated institutions should still map T3–T9 and T11 against B-13 patch evidence on access gateways, firewall management, SD-WAN orchestrators, campus switches, edge routers, and internet-facing application delivery controllers.
Risk Triage
Threats are assigned to primary zones based on their dominant organizational risk characteristic. A threat may appear in a secondary zone when it presents a materially distinct compounding risk dimension.
Active exploitation or weaponized capability with immediate organizational exposure if unaddressed.
- T3Citrix NetScaler — CCCS AL26-024, KEV due 30 September
CVE-2026-88771 needs no configuration flag and no authentication. CISA's BOD 26-04 requires forensic triage for compromise before the patch is applied, not after.
- T4F5 BIG-IP APM — KEV due 25 September, passed
Unauthenticated code execution only when APM is an OAuth authorization server. NVD CVSS 4.0 is 9.3. F5 also scored it 9.8 on CVSS 3.1. A management-interface ACL does not close the virtual server.
- T5T6Check Point management and VPN — both due 25 September, passed
Unauthenticated script upload on the management server (EPSS 19.65%) and unauthenticated VPN code execution. Spark attempts have been observed since 12 September. Check Point has not said whether those attempts succeeded.
- T7VeloCloud Orchestrator — due 25 September, passed
NVD CVSS 4.0 is 9.5. Arista scored CVSS 3.1 at 10.0. Only certificate-authenticated on-premises orchestrators are exposed. The 6.1 and 7.0 trains had no fix on 22 September.
- T8T9Adobe Commerce EPSS 87.51%, and Zyxel due 24 September
Adobe was briefed on 17 August and entered KEV on 24 September, due 27 September. Zyxel is LAN-reachable and unauthenticated. GreyNoise, via The Hacker News, counts 996 switches. Canada is not in the countries named.
- T2T10T11Due today: SharePoint, WordPress, MikroTik CVE-2026-67279
SharePoint is CCCS AL26-023. WordPress NVD score is 8.1, not the 9.2 SecurityWeek reported, and code execution needs theme and PHP preconditions. MikroTik's NVD CVSS 4.0 is 6.9. The Hermes sheet had marked SharePoint and WordPress as not KEV.
- T12Roundcube virtuser_query, patched in May, exploitation warned this week
CCCS said the May 1.6.16 / 1.7.1 fix is now under active exploitation. Shadowserver flagged 10 vulnerable hosts of more than 523,000 exposed. Not in CISA KEV as of 26 September.
- T13PeopleSoft, KEV since June, WAF bypass reopened it 26 September
Mandiant and GTIG report ShinyHunters bypassing the WAF rule orgs used instead of patching CVE-2026-35273. Servers that never installed CPU187 are exposed again.
Confirmed campaign or large-scale exposure with direct impact on organizations or their data.
- T1Burnaby School District, discovered 21 September
Phones and internal network services are down. Unauthorized activity is confirmed. Whether personal information was taken is not. The district notified Burnaby RCMP and the B.C. privacy commissioner.
- T13PeopleSoft WAF-bypass campaign, reported 26 September
Mandiant and GTIG say ShinyHunters is resuming attacks on servers that relied on a WAF rule instead of the June patch. FBI breach claim on a separate, unconfirmed flaw is not part of this row.
Structural control deficiencies revealed by the week's threats, independent of any single exploit.
- T1A school board is notifying a commissioner before it can say what left
The control being tested is the investigation record, not a patch. Phone fallbacks and a pre-tested family channel, not one stood up after phones failed, are part of that record.
- T2SharePoint 2016 and 2019 are past the end-of-life date CCCS cites
CCCS says both products reached end of life on 15 July 2026. A fixed build on an unsupported product is not a support plan.
- T5T6Gateway patch status does not cover the management server or local Spark
CVE-2026-93616 is the policy server. The VPN workaround does not apply to locally managed Spark firewalls.
- T8T11A prior brief is not evidence the KEV date was actioned
Adobe Commerce was on the 17 August brief and entered KEV this week. MikroTik's 6.9 score is not a reason to miss a publication-day deadline.
- T13A WAF rule was treated as remediation, not a bridge to a patch
Organizations that blocked '/PSEMHUB/' at the WAF in June and never installed CPU187 are exposed again to the same CVE through an encoded path.
Cross-cutting pattern requiring board-level awareness and programme-level response.
- T1T2T3One Canadian victim, two Canadian alerts
Burnaby is the victim row. AL26-023 and AL26-024 are the alerts. Nipigon, IDScan, the Quebec school email, and leak-site claims are not on the register.
- T3T4T5T6T7Five network control planes, all past or at the federal date
Access policy, firewall management, VPN termination, the SD-WAN orchestrator, and now the NetScaler application delivery controller. Deferred upgrades on those planes are enterprise-wide risk acceptance.
- T2T10The sheet marked two publication-day KEV rows as not KEV
Direct catalog reconciliation put SharePoint and WordPress on the register. CVE-2026-5430 was left off because NVD and the KEV name describe different flaw classes.
Remediation Actions
Consolidated actions for all thirteen threats, organized by time horizon. T-badges indicate which threat each action addresses. T1 is in the first column because the action is family caution and an open privacy question, not a patch. Six federal deadlines have already passed. Three more are due today, and one is due 30 September.
0 – 24 hours
Immediate response
- T1Families of Burnaby students: use the district's published absence channels and treat unexpected requests for personal information as suspect, as the superintendent asked on 25 September.
- T2Install the SharePoint build CCCS names, or migrate off Server 2016 and 2019. CCCS says those products reached end of life on 15 July 2026. Federal due date is today.
- T3Upgrade NetScaler ADC/Gateway to 14.1-73.37, 13.1-64.23, or the matching FIPS/NDcPP build. If DTLS must stay on temporarily, that only covers CVE-2026-88772, not CVE-2026-88771. Federal due date is 30 September.
- T4If APM is an OAuth authorization server, install the engineering hotfix for 21.1, 17.5, or 17.1. If you cannot, apply F5's iRule from a support ticket. The federal due date was 25 September.
- T5Install the Check Point management fix in support article sk1000171. A LivePatch that fixed CVE-2026-91843 does not fix CVE-2026-93616.
- T6Install LivePatch Take 26 or the Jumbo take BleepingComputer lists. Update Spark to R82.00.10 Build 2325 or R81.10.17 Build 4968, or later.
- T7Upgrade VeloCloud Orchestrator 5.2 to 5.2.3.16 or later and 6.4 to 6.4.2.8 or later. Restrict the web interface on 6.1 and 7.0 until a fix exists.
- T8Confirm the August Adobe update for CVE-2026-71362 is on every Commerce and Magento property. The federal due date was 27 September.
- T9Upgrade each Zyxel GS1900 to the fixed 2.90 firmware. The federal due date was 24 September.
- T10Update WordPress to 7.1.2 or the backport for your branch. Federal due date is today. Do not treat the flaw as unconditional code execution.
- T11Upgrade RouterOS to 6.49.21, 7.23.4, or 7.24.2. Federal due date for CVE-2026-67279 is today. Then look for user -2 and an account named ops.
- T12Confirm Roundcube is 1.6.16 or 1.7.1 or later where virtuser_query is enabled. Those releases shipped in May.
- T13Confirm CPU187 is installed on every PeopleTools 8.61/8.62 instance. A WAF rule blocking '/PSEMHUB/' does not stop the encoded-path bypass Mandiant reported.
7 days
Short-term hardening
- T1Write down what Burnaby told the B.C. privacy commissioner and the RCMP, and who owns the question of whether personal information left the network.
- T2List internet-facing SharePoint servers, turn off anonymous access you do not need, and enable AMSI full request-body scanning where operations allow it.
- T3Run BOD 26-04 forensic triage on every internet-facing NetScaler before or during the patch window, not after. A clean patch does not answer whether the appliance was already compromised.
- T5Hunt management servers for the 23 July window. Installing the September fix does not show whether the server was attacked then.
- T6Search for unusual certificate-based Mobile Access logins, including subjects other than the three Check Point published.
- T7Look for Arista's file and header indicators before you upgrade a suspect orchestrator, and preserve logs if you find them.
- T11Inventory every RouterOS device with SSH reachable from an untrusted network. The default home firewall is not that inventory.
- T13Hunt for web shells and the SIDEEYE backdoor on PeopleSoft instances that relied on a WAF rule instead of CPU187.
14 – 30 days
Programme remediation
- T1Test phone and student-information fallbacks for a multi-day network outage, and confirm the website absence channel works when school phones and Wi-Fi are both down.
- T6Bring locally managed Spark firewalls into the same change record as centrally managed gateways. The VPN workaround does not cover them.
- T7After a VeloCloud upgrade, rotate credentials and review the state of managed Edge devices.
- T12Record the Roundcube version on every host that still has virtuser_query enabled. Shadowserver flagged 10 vulnerable instances as of 23 September, out of more than 523,000 exposed.
Ongoing
Structural controls
- T3T4T5T6T7T9T11Treat access gateways, firewall management, VPN termination, SD-WAN orchestrators, campus switches, edge routers, and application delivery controllers as one tier-0 evidence pack.
- T2Do not leave SharePoint Server 2016 or 2019 in production on the argument that a fixed build exists. CCCS says both are end of life.
- T8T11When CISA lists a CVE this brief already carried, open a new evidence line. The August or 14 September write-up is not proof the new due date was met.
- T2T10Reconcile the CISA catalog directly. This week's sheet marked SharePoint and WordPress as not KEV. Both are due today.
- T13Do not accept a WAF or reverse-proxy rule as closure evidence for an unpatched CVE. Require the patch level, and re-test the rule against an encoded path.
Provenance
Intelligence Sources
Cadence
Published weekly. Each issue distills the week's most material threats from primary security reporting and vendor advisories, cross-referenced against authoritative sources (CVE/NVD, CISA KEV, and MITRE ATT&CK) and mapped to the compliance obligations that govern your response. Use Subscribe or Share on any issue to join the distribution list.
See how this week's threats map to your control gaps.
Book a briefing →