Check Point and WordPress Zero-Days Under Active Exploitation

Check Point and WordPress Zero-Days Under Active Exploitation

•

Episode description

Check Point and WordPress Zero-Days Under Active Exploitation

On 22 September 2026, CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalogue, confirming active exploitation in the wild. Two affect Check Point firewall management infrastructure (CVE-2026-93616 and CVE-2026-85102), allowing unauthenticated remote code execution. The third, CVE-2026-87902, is a critical path traversal flaw in WordPress core affecting approximately 43% of all websites globally. For UK small businesses, the primary risk lies not in direct exploitation but in unverified patching by managed service providers, web developers, and hosting agencies. This episode provides specific guidance on verifying patch status with third-party providers, checking WordPress version numbers, and establishing documented response processes for CISA KEV additions. The common thread across all three disclosures is infrastructure typically assumed to be someone else’s responsibility to maintain, creating a verification gap that attackers are actively exploiting. Businesses are advised to contact their MSPs immediately with specific CVE numbers, audit their technology supply chain for patching accountability, and review cyber insurance terms regarding timely vulnerability remediation.

Chapters

  • Introduction Corrine opens by asking when listeners last verified specific CVE patches with their MSP. CISA has confirmed active exploitation of vulnerabilities in Check Point firewall management systems and WordPress core, both with patches available and documented exploitation in the wild.
  • Check Point Management Server Zero-Day CVE-2026-93616 and CVE-2026-85102 were added to CISA’s KEV catalogue on 22 September 2026. Both affect Check Point infrastructure and allow unauthenticated remote code execution. UK small businesses typically rely on MSPs to patch these systems, creating a verification gap. Corrine provides specific questions to ask providers and explains why vague responses indicate service quality issues.
  • Call to Action Listeners are encouraged to follow the show, leave ratings and reviews, and share the episode with other small business operators who may believe today’s threats do not apply to them.
  • WordPress Core Critical Flaw CVE-2026-87902 is a path traversal vulnerability in WordPress core itself, not a plugin or theme. It affects approximately 43% of all websites and allows unauthenticated remote code execution on certain server configurations. Many UK small business websites run on loose maintenance arrangements with no recent admin access. Corrine explains how to check version numbers and why core vulnerabilities have categorically different urgency than plugin flaws.
  • The Pattern Behind This Week’s Disclosures CISA also added CVE-2026-93952 affecting Arista VeloCloud SD-WAN infrastructure on the same day. All three confirmed exploitation campaigns target infrastructure businesses typically assume is someone else’s responsibility to maintain. This verification gap is where attackers are operating. The NCSC considers supply chain security a board-level concern, and trust is not a substitute for verification.
  • Closing Remarks Corrine summarises practical takeaways: contact MSPs with specific CVE numbers, check WordPress version numbers immediately, and audit technology infrastructure for patching accountability. Listeners are reminded to review cyber insurance terms regarding timely vulnerability remediation, as many policies define windows for patching known critical vulnerabilities.

Links