ThreatCluster

Critical Remote Code Execution Vulnerabilities in SENAITE and SharePoint

First seen 25 Sep 2026, 15:53 UTC • •73

Article Content

1 / 5

Browse articles

ThreatCluster •September 25, 2026 at 16:28 UTC

•CVE-2026-54569 affects SENAITE with remote code execution capabilities.
•CVE-2026-65660 is actively exploited in the wild, confirmed by CISA.
•Immediate updates to Security Gateway products are essential for protection.

Two critical remote code execution vulnerabilities have been identified in SENAITE and Microsoft SharePoint. The SENAITE vulnerability (CVE-2026-54569), published on August 26, 2026, allows attackers to execute arbitrary code on affected systems. The Microsoft SharePoint vulnerability (CVE-2026-65660), published on August 11, 2026, was added to the CISA KEV list on September 25, 2026, indicating active exploitation. Both vulnerabilities affect multiple versions of security gateways, including R81, R80, R77, and R75. Security professionals are urged to update their systems immediately to mitigate these risks. The attack vectors involve exploiting weaknesses in web server enforcement and Windows SMB protocols. Logs will indicate violations related to these attacks. The situation is critical, with active exploitation confirmed for SharePoint.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-08-11

CVE-2026-65660 published

Microsoft SharePoint vulnerability disclosed, allowing remote code execution.

Advisories.Checkpoint

2026-08-26

CVE-2026-54569 published

SENAITE vulnerability disclosed, enabling remote code execution on affected systems.

Advisories.Checkpoint

2026-09-25

CVE-2026-65660 added to CISA KEV

CISA confirmed active exploitation of the Microsoft SharePoint vulnerability.

Advisories.Checkpoint

2026-09-25

First public PoC for CVE-2026-65660

Proof-of-concept code for the SharePoint vulnerability released, increasing risk of exploitation.

Advisories.Checkpoint

More articles in this cluster (4)

Threat Graph

7 entities, 10 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Zero-day Exploit
T1190 - Exploit Public-Facing Application
T1203 - Exploitation for Client Execution

Vulnerability (2)

CVE-2026-54569
CVE-2026-65660

Affected Platform (2)

Microsoft SharePoint
Windows

Relationships

CVE-2026-54569 targets Microsoft SharePoint
CVE-2026-54569 targets Windows
CVE-2026-65660 targets Microsoft SharePoint
CVE-2026-65660 targets Windows
Zero-day Exploit targets Microsoft SharePoint
Zero-day Exploit targets Windows
T1190 - Exploit Public-Facing Application targets Microsoft SharePoint
T1190 - Exploit Public-Facing Application targets Windows
T1203 - Exploitation for Client Execution targets Microsoft SharePoint
T1203 - Exploitation for Client Execution targets Windows

Following this threat?

Track CVE-2026-54569 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Zero-Day Vulnerability in F5 BIG-IP APM Exploited for Remote Code Execution F5 Networks has reported a critical vulnerability in its BIG-IP Access Policy Manager (APM), tracked as CVE-2026-94127, which is being actively exploited in the wild. The flaw allows unauthenticated attackers to execute remote code on systems configured with both an APM access policy and an OAuth profile. This…

Massive Network of AI Proxy Servers Used for Malicious Activities Uncovered Security researchers from Team Cymru have identified over 10,000 proxy servers in China facilitating malicious AI activities. These servers, termed 'transfer stations,' are primarily used to bypass geographic restrictions and conduct model distillation attacks against frontier AI models. The infrastructure allows…