CISA added Microsoft SharePoint CVE-2026-65660 (code injection, CWE-94) to its Known Exploited Vulnerabilities catalog on Sep 25, with a federal due date of Monday Sep 28. The flaw lets an authenticated attacker with low-level access run code on on-prem SharePoint Server 2016, 2019, and Subscription Edition with no user interaction. Microsoft patched it in the Aug 11 updates (fixed builds 16.0.5565.1001, 16.0.10417.20198, and 16.0.19725.20522) but originally published it as a spoofing issue (CVSS 6.5, “Exploitation Less Likely”) and later reclassified it as remote code execution (CVSS 8.8). A researcher published full exploit details on Sep 22, including a chain with a separate anonymous-access bug (fixed June 9) that allows pre-authentication code execution on farms with anonymous viewing enabled. The Canadian Cyber Centre (alert AL26-023) reported active exploitation on Sep 24, and Previdian logged exploitation requests against a SharePoint honeypot the same day that drop a webshell at /_layouts/15/sphealth.aspx. Microsoft’s own advisory still does not list the bug as exploited, no attacker has been named, and CISA lists ransomware use as unknown. SharePoint Online is not listed as affected.

WordPress shipped 7.1.2 on Sep 22 to fix core CVE-2026-87902, an unauthenticated path traversal in page-template resolution that affects versions 4.7.0 through 7.1.1, with fixes backported to every branch down to 4.7.37. WordPress rates it Critical (CVSS 4.0 score 9.2; NVD lists 8.1 under CVSS 3.1). It can lead to code execution only under certain conditions: the active theme needs a top-level folder starting with page- (the advisory names Twenty Twelve, Twenty Fourteen, Neve, Hestia, and Sydney), and PHP needs a readable target such as PEAR’s pearcmd.php with register_argc_argv on, which the advisory says includes the official PHP Docker image and default cPanel setups on PHP before 8.5. Patchstack saw the first attack attempt the same day the patch shipped and the first file-write attempts hours later, with traffic up more than tenfold by Sep 23. CISA added the CVE to KEV on Sep 25 (due Sep 28). Previdian expects mass attempts but relatively few actual compromises because of the preconditions and default auto-updates.

Livermore takeaway: if you still run on-prem SharePoint, confirm every farm is at or above the August 2026 fixed build and the June update, turn off anonymous access you don’t need, take SharePoint off direct internet exposure, enable AMSI full request-body scanning, and hunt for sphealth.aspx under /_layouts/15/ and unexpected new web parts. SharePoint 2016 and 2019 reached end of life in July, so put migration on the plan. If you triaged this in August as a medium spoofing bug, re-rank it now. For WordPress, confirm every site, including agency- and marketing-managed ones, is on 7.1.2 or its branch backport rather than assuming auto-update ran. Check themes for page-* folders, and search logs for encoded ../ in pagename or requests mentioning pearcmd. Any unexpected .php file in /tmp or /var/tmp means you should treat the host as compromised, not just scanned.