THE WEEK IN REVIEW

Sunday, September 20 through Saturday, September 26, 2026 | Jonathan Brown

Verification cutoff: September 26, 2026, approximately 14:00 UTC. Saturday remains in progress. This review includes developments verified by the cutoff; it does not claim to cover the rest of the day.

The daily briefings track each new exposure. The Week in Review asks what changed for defenders across the whole week.

This week, the answer is the concentration of risk in systems that confer authority: network security management, VPNs, software builds, backup and monitoring tools, web administration, and industrial-control suppliers. A second pattern appeared alongside it. Vulnerabilities initially described as a product patching problem became an investigation problem when researchers observed exploit requests, vendors reported attacks, or CISA added them to its Known Exploited Vulnerabilities catalog.

There was also a late change after Friday's daily cutoff. On September 25, CISA added Microsoft SharePoint Server CVE-2026-65660 and MikroTik RouterOS CVE-2026-67279 to KEV. The SharePoint listing strengthens the exploitation assessment beyond the September 24 honeypot capture, while leaving the number of successful intrusions unknown. The MikroTik entry brings attention back to a two-vulnerability RouterOS chain whose other component, CVE-2026-86060, was already listed. The two product families demand different investigations.

THE WEEK'S CENTRAL FACT: THE ADMINISTRATIVE PLANE IS THE ATTACK SURFACE

On September 22, CISA's KEV additions and vendor advisories sharpened the response to Check Point Security Management, Check Point Security Gateway and Spark, Arista VeloCloud Orchestrator, and F5 BIG-IP Access Policy Manager. These are the systems that define access, push configuration, administer other devices, or sit directly on the network edge. The underlying flaws and prerequisites differ. Check Point's management-server path traversal should not be confused with its gateway VPN certificate issue; the F5 APM flaw concerns a virtual server configured with both an access policy and an OAuth profile. VeloCloud orchestration can implicate both the host and managed-device trust. A blanket instruction to “patch the firewall” misses the exposure conditions and the need to inspect prior administrative actions.

Zyxel GS1900 switching infrastructure added another edge case. CISA's September 21 action concerned CVE-2026-7273, while research described exploitation and configuration or credential consequences on affected devices. For potentially exposed switches, replacing firmware is only the beginning: examine accounts, startup and running configuration, management reachability, and evidence of lateral movement. The September 24 federal action date was a remediation deadline, not the date of a newly discovered campaign.

The late-week MikroTik addition is especially instructive. CERT Polska's September 22 technical analysis separated CVE-2026-67279, which permits an unauthenticated SSH connection to reach session-channel handling after a rekey, from CVE-2026-86060, which can turn attacker-supplied input into administrative privilege. Together, CERT Polska calls the chain MikroTrick. It describes public logs beginning September 2, before patches, including a failed login for user -2 and creation of a privileged ops account. Those findings support investigation for unauthorized administration, not merely confirmation that current firmware is fixed. CERT Polska lists patched RouterOS branches 7.24.2, 7.23.4, 6.49.21, and 7.25beta3; operators must follow the maintained branch and current vendor guidance.

The common thread is control. A compromise of a management system can persist as a new account, a changed policy, a trusted certificate, a device configuration, or an issued token after the initial exploit has been closed.

Sources: CISA, “CISA Adds Four Known Exploited Vulnerabilities to Catalog,” September 22; Check Point, “Security Advisory – Action Required – Active Exploitation of CVE-2026-85102 and a Management Pre-Authentication Vulnerability CVE-2026-93616,” September 22; Arista, “Security Advisory 0183”; F5, “K000162605”; Zyxel, GS1900 security advisory; CERT Polska, “MikroTrick: technical analysis, disclosure process, and the use of LLM agents,” September 22; CISA, “CISA Adds Two Known Exploited Vulnerabilities to Catalog,” September 25.

PATCHED APPLICATIONS STILL REQUIRE AN INCIDENT DECISION

Two September 24–25 developments show why exploit activity must be described precisely.

WordPress fixed CVE-2026-87902 in version 7.1.2 and backports for supported older branches. Patchstack observed requests progressing from probes for readable files to attempts to include a PHP utility and write attacker-controlled PHP. That is evidence of attack attempts; it is not a count of successful site compromises. The code-execution path depends on specific active-theme structure and an accessible local PHP file, with additional prerequisites for the documented PEAR route. Operators should check branch-specific updates, the theme condition, web requests, and unexpected PHP files. A verified unauthorized file write changes the case from routine patching to host recovery.

Microsoft SharePoint Server CVE-2026-65660 was patched in August. The base vulnerability requires an authenticated attacker. On September 24, Canada's Cyber Centre warned of active exploitation, while Previdian documented two-stage requests against a honeypot that attempted to pair the vulnerability with a separate, earlier flaw on sites permitting anonymous viewing. The researchers did not establish that this particular anonymous chain executed successfully on a real production server. CISA's September 25 KEV listing and Microsoft's updated acknowledgment of observed attacks raise the urgency for all affected on-premises farms; neither establishes that every anonymous request succeeded. Verify both the August fix and applicable earlier updates, preserve IIS and SharePoint logs, and investigate execution or machine-key exposure if host evidence supports it.

Adobe Commerce and Magento Open Source CVE-2026-71362 and WSO2 CVE-2026-5430 entered KEV on September 24. Adobe's issue is an authorization flaw with privilege-escalation consequences; its isolated August fixes require the matching July predecessor. WSO2 describes a JWT authentication bypass in API-management components, whereas CISA's entry describes path traversal for the same CVE. That description conflict is unresolved. Administrators should use the vendor's component-specific fixes and review account, token, gateway, and customer-session changes according to actual exposure, without inventing a combined attack mechanism.

Sources: WordPress, “GHSA-7hp8-65ch-5whp,” September 22; Patchstack, “CVE-2026-87902: Attackers Started Probing WordPress Sites Hours After the Patch”; Canadian Centre for Cyber Security, “AL26-023,” September 24; Previdian, “CVE-2026-65660: Previdian observes two-stage SharePoint exploitation attempts,” September 24; Microsoft Security Response Center, CVE-2026-65660; CISA, KEV alerts of September 24 and 25; WSO2, “WSO2-2026-5328”; Adobe, “APSB26-92.”

BUILD, BACKUP, AND MONITORING TRUST CANNOT BE MEASURED BY VERSION ALONE

JetBrains TeamCity CVE-2026-63077 was already a serious build-server exposure. This week brought new reporting that the existing KEV entry was marked for ransomware use; JetBrains had confirmed exploitation. The operational consequence is wider than a compromised TeamCity host. Build agents, release artifacts, repository credentials, signing access, and deployment secrets may need review. Verify a fixed release or the applicable security patch plugin, restrict access, and decide whether produced artifacts remain trustworthy.

Veeam Agent for Microsoft Windows CVE-2026-32996 likewise demands more than a version check where exploitation was reported. A backup agent's privileges and reach make suspicious service activity, credentials, and recovery points part of the response. Orkes Conductor CVE-2026-58138 puts workflow orchestration in the same category: Fortinet reported active targeting of an unauthenticated workflow API code-execution path. A workflow engine able to run expressions or commands may reach cloud credentials and downstream services. Inspect workflow definitions and child processes when exposed.

SolarWinds published fixes for two distinct conditional unauthenticated code-execution issues, CVE-2026-28324 and CVE-2026-28325, in Observability Self-Hosted 2026.2.3. Exploitation was not established in the reviewed vendor advisories. Configuration determines exposure, so the immediate question is which servers actually satisfy each condition. The week's difference between RED and AMBER is evidence, not the brand name of the product.

Sources: JetBrains, TeamCity CVE-2026-63077 advisories and update; Veeam, “KB4852”; Arctic Wolf, September 2026 CVE-2026-32996 exploitation update; Fortinet FortiGuard, “Orkes Conductor Evaluator Remote Code Execution”; SolarWinds, advisories for CVE-2026-28324 and CVE-2026-28325.

INDUSTRIAL SUPPLIER TRUST BECAME A CONCRETE RECOVERY ISSUE

An FBI and CISA advisory published September 23 described a 2025 intrusion into a U.S. industrial-control-system integrator. The actors staged roughly 800 customer-related files for presumed exfiltration. The public advisory did not establish that every customer was accessed, that industrial processes were altered, or that the files actually left the network. It did show how an engineering supplier's projects, remote connections, and documentation can concentrate information about many facilities.

Separately, reporting published September 21 described late-August cyber incidents at two small Colorado water utilities. A governor's-office spokesperson said equipment settings, remote access, alarms, and pumping cycles were changed, while water service and public safety were not affected. The utilities, entry path, and actors remain publicly unidentified. A possible Iranian connection must not be treated as established attribution, nor should these incidents be merged with earlier water-system attacks without evidence.

Both developments argue for a direct operator test: can the utility or plant identify every integrator account and remote path, inspect controller logic against a known-good project, confirm alarm state, and operate safely if a supplier must be disconnected? NIST's September 21 initial public draft of SP 800-82 Revision 4 is a planning document, not an incident advisory or a completed standard.

Sources: FBI/CISA, joint industrial-control integrator advisory, September 23; CISA, “Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators,” September 23; SecurityWeek, “Colorado Water Utilities Hit by Cyberattacks Targeting OT Systems,” September 21; NIST, “Guide to Operational Technology (OT) Security,” SP 800-82 Revision 4 initial public draft, September 21.

THE WEEK'S DEFENSIVE DOCTRINE

First, rank assets by what they can change. An appliance that sets network policy, an orchestrator that configures customer devices, a repository that supplies production, a backup agent that controls restore, and an engineering supplier with PLC projects warrant faster investigation than a similarly scored isolated application.

Second, make patch and trust decisions separately. Confirm the fixed build and running state, then determine whether accounts, tokens, configuration, artifacts, customer environments, and recovery data could have been touched before the fix. Preserve evidence before re-imaging or rotating broadly where the incident response plan requires it.

Third, make exploit claims granular. A honeypot request, a public proof of concept, a vendor's confirmed attack, a KEV listing, and a named production compromise support different conclusions. The SharePoint case illustrates why those distinctions can change during a single week.

Fourth, validate supplier access from the operator's side. Record remote engineering entry points, session approval, project-file custody, break-glass revocation, and safe operation without the integrator. The same exercise applies to managed network devices and cloud administration.

STRATEGY

At the start of the next workweek, assign named owners to the unresolved RED exposures: affected Check Point management and VPN systems, VeloCloud Orchestrator, configured F5 APM virtual servers, Zyxel GS1900, MikroTik RouterOS, TeamCity, Veeam Agent, Orkes Conductor, WordPress under the exploit prerequisites, SharePoint farms, WSO2, and Adobe Commerce/Magento. This is an exposure-driven list, not a claim that every organization uses every product.

For each deployed product, record the vulnerable condition, the fixed state, the period of possible exposure, available logs, and the decision on compromise assessment. On management and build platforms, explicitly review credentials and downstream changes. On SharePoint, distinguish authenticated exploitation from the attempted anonymous chain. On RouterOS, inspect administrative accounts and SSH logs as well as firmware. On industrial sites, ask the integrator and plant operations to compare projects, alarms, remote sessions, and recovery copies.

Then run one recovery exercise in which an administrative platform is patched but its previous authority remains suspect. The exercise ends when the organization can demonstrate which downstream systems, tokens, artifacts, and backups it can still trust.

REGIONAL AND SECTOR ASSESSMENT

North America

The Colorado water incidents and the FBI/CISA industrial-integrator case give U.S. operators concrete OT and supplier-response work. The published evidence does not establish a regional water-service outage or compromise of every integrator customer. Canada's SharePoint and F5 alerts apply to exposed installations without demonstrating a Canadian victim cluster.

Europe

CERT Polska's RouterOS analysis supplies unusually detailed evidence about the exploit chain and early attack logs. It does not imply that only Polish networks were at risk. European operators of exposed routers, VPNs, and management servers share the same product-level response requirements.

Africa and the Middle East

No distinct new victim cluster or service interruption in either region was verified for the week's lead stories. Operators using the affected globally deployed products should assess their own exposure; geographic absence from public reports is not evidence of safety.

Asia, Russia, China, and the Indo-Pacific, including India

The week's primary advisories establish global product exposure rather than a verified new regional campaign in these categories. Japan's warning and allied reporting about North Korean IT-worker and recruitment activity add a separate contractor and developer-identity concern; the reporting does not establish that every fake interview produced a malicious software release. Do not infer Russian or Chinese attribution for the network-edge cases from the origin of the products, victims, or infrastructure.

Sector emphasis

Network operators, managed-service providers, software builders, commerce and API operators, water utilities, and industrial facilities face the most direct work from this review. Healthcare, energy, transport, telecom, and government should check the same administrative dependencies where deployed.

OUTLOOK AND UNCERTAINTY

Next week

Watch for Microsoft and CISA clarification on successful SharePoint exploitation and indicators beyond the honeypot pattern; additional MikroTik guidance and evidence of post-patch persistence; vendor or government detail on the Check Point, F5, VeloCloud, TeamCity, Veeam, and Orkes cases; and identification of the Colorado utilities' access path. Monitor any WSO2 correction of the conflicting CVE description.

What is not known

Public sources do not establish the complete victim counts, dwell time, persistence, or downstream actions across the exploited products. The SharePoint anonymous chain's success in production remains unresolved. The OT integrator's staged files do not by themselves establish customer-system intrusion or completed exfiltration. The Colorado incidents' actor and access route remain unconfirmed. No reviewed evidence establishes a single coordinated campaign behind these separate events.

Trigger for escalation

Escalate on unauthorized management accounts or certificate changes, unexpected VPN or orchestration actions, a TeamCity artifact or pipeline modification, altered recovery points, unexplained workflow execution, SharePoint host-level code execution or machine-key access, an unauthorized RouterOS ops account or related SSH sequence, and any unapproved PLC logic or alarm changes. Such evidence turns a patch program into an incident and may require rebuilding trust across connected systems.

SOURCES

Network edge and administrative control

CISA — “CISA Adds Four Known Exploited Vulnerabilities to Catalog,” September 22, 2026:
https://www.cisa.gov/news-events/alerts/2026/09/22/cisa-adds-four-known-exploited-vulnerabilities-catalog

CISA — “CISA Adds Two Known Exploited Vulnerabilities to Catalog,” September 25, 2026:
https://www.cisa.gov/news-events/alerts/2026/09/25/cisa-adds-two-known-exploited-vulnerabilities-catalog

Check Point — “Security Advisory – Action Required – Active Exploitation of CVE-2026-85102 and a Management Pre-Authentication Vulnerability CVE-2026-93616,” September 22, 2026:
https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/

Arista — “Security Advisory 0183”:
https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183

F5 — “K000162605”:
https://my.f5.com/manage/s/article/K000162605

Zyxel — GS1900 security advisory:
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026

CERT Polska — “MikroTrick: technical analysis, disclosure process, and the use of LLM agents,” September 22, 2026:
https://cert.pl/en/posts/2026/09/mikrotrick-technical-analysis/

SharePoint, web, identity, and commerce

Canadian Centre for Cyber Security — “AL26-023 - Vulnerability Impacting Microsoft SharePoint Server - CVE-2026-65660,” September 24, 2026:
https://www.cyber.gc.ca/en/alerts-advisories/al26-023-vulnerability-impacting-microsoft-sharepoint-server-cve-2026-65660

Previdian — “CVE-2026-65660: Previdian observes two-stage SharePoint exploitation attempts,” September 24, 2026:
https://blog.previdian.com/cve-2026-65660-previdian-observes-two-stage-sharepoint-exploitation-attempts/

Microsoft Security Response Center — CVE-2026-65660:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660

WordPress — “GHSA-7hp8-65ch-5whp,” September 22, 2026:
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp

Patchstack — “CVE-2026-87902: Attackers Started Probing WordPress Sites Hours After the Patch”:
https://patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/

CISA — “CISA Adds Two Known Exploited Vulnerabilities to Catalog,” September 24, 2026:
https://www.cisa.gov/news-events/alerts/2026/09/24/cisa-adds-two-known-exploited-vulnerabilities-catalog

WSO2 — “WSO2-2026-5328/CVE-2026-5430”:
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/

Adobe — “Security update available for Adobe Commerce | APSB26-92,” August 11, 2026:
https://helpx.adobe.com/security/products/magento/apsb26-92.html

Build, backup, monitoring, and orchestration

JetBrains — TeamCity CVE-2026-63077 advisory and update:
https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/
https://blog.jetbrains.com/teamcity/2026/08/cve-2026-63077-update/

Veeam — “KB4852”:
https://www.veeam.com/kb4852

Arctic Wolf — CVE-2026-32996 exploitation update:
https://arcticwolf.com/resources/blog/update-active-exploitation-cve-2026-32996-of-veeam-agent/

Fortinet FortiGuard — “Orkes Conductor Evaluator Remote Code Execution”:
https://www.fortiguard.com/outbreak-alert/orkes-conductor-rce

SolarWinds — advisories for CVE-2026-28324 and CVE-2026-28325:
https://www.solarwinds.com/trust-center/security-advisories/cve-2026-28324
https://www.solarwinds.com/trust-center/security-advisories/cve-2026-28325

Industrial control and regional activity

FBI/CISA — joint advisory, September 23, 2026:
https://www.ic3.gov/CSA/2026/260923.pdf

CISA — “Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators,” September 23, 2026:
https://www.cisa.gov/resources-tools/resources/considerations-critical-infrastructure-operators-working-third-party-ics-integrators

SecurityWeek — “Colorado Water Utilities Hit by Cyberattacks Targeting OT Systems,” September 21, 2026:
https://www.securityweek.com/colorado-water-utilities-hit-by-cyberattacks-targeting-ot-systems/

NIST — “Guide to Operational Technology (OT) Security,” SP 800-82 Revision 4 initial public draft:
https://csrc.nist.gov/pubs/sp/800/82/r4/ipd

FBI — North Korean IT-worker advisory, September 18, 2026:
https://www.ic3.gov/CSA/2026/260918.pdf

This briefing was prepared from the verified written editions and additional late-week sources. It is intended for defensive awareness and operational decision-making, not as a substitute for incident response, vendor guidance, or legal advice.

Jonathan Brown writes independent, decision-focused analysis on cybersecurity, infrastructure resilience, and operational risk, with an emphasis on primary-source verification and explicit uncertainty.

Support this work by sharing the briefing with operators who can act on it. Corrections supported by primary evidence are welcomed; material errors should be amended transparently. Feel free to subscribe, comment, or buy us a coffee! Thanks.