ThreatCluster

Critical Remote Code Execution Vulnerabilities in SENAITE and SharePoint

First seen 25 Sep 2026, 15:53 UTC • •73

Article Content

1 / 7

Browse articles

ThreatCluster •September 26, 2026 at 05:24 UTC

•CVE-2026-54569 affects SENAITE with remote code execution capabilities.
•CVE-2026-65660 is actively exploited in the wild, confirmed by CISA.
•Immediate updates to Security Gateway products are essential for protection.

Two critical remote code execution vulnerabilities have been identified in SENAITE and Microsoft SharePoint. The SENAITE vulnerability (CVE-2026-54569), published on August 26, 2026, allows attackers to execute arbitrary code on affected systems. The Microsoft SharePoint vulnerability (CVE-2026-65660), published on August 11, 2026, was added to the CISA KEV list on September 25, 2026, indicating active exploitation. Both vulnerabilities affect multiple versions of security gateways, including R81, R80, R77, and R75. Security professionals are urged to update their systems immediately to mitigate these risks. The attack vectors involve exploiting weaknesses in web server enforcement and Windows SMB protocols. Logs will indicate violations related to these attacks. The situation is critical, with active exploitation confirmed for SharePoint.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 45d ago How this analysis works

Timeline

2026-08-11

CVE-2026-65660 published

Microsoft SharePoint vulnerability disclosed, allowing remote code execution.

Advisories.Checkpoint

2026-08-26

CVE-2026-54569 published

SENAITE vulnerability disclosed, enabling remote code execution on affected systems.

Advisories.Checkpoint

2026-09-25

CVE-2026-65660 added to CISA KEV

CISA confirmed active exploitation of the Microsoft SharePoint vulnerability.

Advisories.Checkpoint

2026-09-25

First public PoC for CVE-2026-65660

Proof-of-concept code for the SharePoint vulnerability released, increasing risk of exploitation.

Advisories.Checkpoint

More articles in this cluster (6)

Threat Graph

7 entities, 10 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Zero-day Exploit
T1190 - Exploit Public-Facing Application
T1203 - Exploitation for Client Execution

Vulnerability (2)

CVE-2026-54569
CVE-2026-65660

Affected Platform (2)

Microsoft SharePoint
Windows

Relationships

CVE-2026-54569 targets Microsoft SharePoint
CVE-2026-54569 targets Windows
CVE-2026-65660 targets Microsoft SharePoint
CVE-2026-65660 targets Windows
Zero-day Exploit targets Microsoft SharePoint
Zero-day Exploit targets Windows
T1190 - Exploit Public-Facing Application targets Microsoft SharePoint
T1190 - Exploit Public-Facing Application targets Windows
T1203 - Exploitation for Client Execution targets Microsoft SharePoint
T1203 - Exploitation for Client Execution targets Windows

Following this threat?

Track CVE-2026-54569 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical RCE Vulnerability in Confection WordPress Plugin (CVE-2026-115252) A critical vulnerability, CVE-2026-115252, has been identified in the Confection WordPress Cable plugin, affecting versions 0.4.0 to 0.4.7. This flaw allows unauthenticated attackers to execute arbitrary PHP code on the server by writing unmodified settings into a PHP file without proper checks. The vulnerability has…

CVE-2026-121392 in FreeRDP Exposes RDP Sessions to Interception A vulnerability, CVE-2026-121392, has been identified in FreeRDP versions prior to 3.32.2, which allows man-in-the-middle attackers to bypass server identity checks. The flaw arises from improper certificate validation in the tls_verify_certificate() function, permitting attackers with a trusted certificate to…