Palo Alto Networks published CVE-2026-0322 on 14 October 2026 (16:00 UTC; 15 Oct 00:00 Perth). A code-injection flaw (CWE-94) in the PAN-OS management interface lets an authenticated attacker with network access run arbitrary code as root on the firewall. It affects PAN-OS on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series); Cloud NGFW and Prisma Access are not affected, and no special configuration is needed to be exposed. Palo Alto rates it HIGH with suggested urgency HIGHEST, Exploit Maturity ATTACKED, and says very limited exploitation has been observed targeting the management interface. The advisory lists three IP addresses tied to the activity and limited exploit attempts: 66[.]42[.]72[.]14, 208[.]83[.]239[.]114 and 149[.]248[.]47[.]234. There is no workaround; Threat Prevention Threat IDs 510046 and 510047 (content 9159-10287 and later) give only limited coverage and need management traffic routed through a data-plane interface with SSL decryption. Risk is highest where the management interface is reachable from the internet. The same 14 Oct bulletin also carries lower-rated PAN-OS, GlobalProtect app, Cortex XSOAR and Checkov fixes, listed separately on the Palo Alto advisory site. Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Palo Alto Networks) Updated (02 Nov 2026): The CISA Known Exploited Vulnerabilities catalog lists CVE-2026-0322 as the Palo Alto Networks PAN-OS Code Injection Vulnerability, added on 14 October 2026 with a 17 October 2026 due date for US federal agencies; CISA lists known ransomware campaign use as unknown. (source: CISA KEV catalog)
Palo Alto Networks — CVE-2026-0322 PAN-OS: Authenticated RCE in the Management Interface (14 Oct 2026)
Siemens ProductCERT published advisory SSA-591731 on 13 October 2026 for eight vulnerabilities (CVE-2026-63350 to CVE-2026-63357) in the web server of SIMATIC S7-1500 devices. Siemens says affected devices do not properly validate or sanitise content in imported trace files (including calculated signals in CSV trace files) before rendering it on the web server's Trace page, so an attacker could social engineer an authorised user who holds the function right 'Read diagnostics' into importing a specially crafted file; successful exploitation could let attacker-controlled JavaScript run in the user's browser session and perform PLC operations through the web server within the scope of that user's authorisation. Siemens rates three of the flaws (CVE-2026-63350, CVE-2026-63353 and CVE-2026-63354) CVSS 3.1 9.6 / CVSS 4.0 9.4 and the other five CVSS 3.1 6.1 / CVSS 4.0 5.3. Siemens lists all versions of the affected products, including S7-1500 CPUs (with related ET 200 CPUs and SIPLUS variants), S7-1500 MFP and ODK CPUs, the S7-1500 Software Controller, ET 200SP Open Controller, SIMATIC Drive Controllers and S7-PLCSIM Advanced, and says 'Currently no fix is available' for each; it says it is preparing fixes and recommends mitigations in the meantime. (source: Siemens ProductCERT SSA-591731) Updated 22 Oct 2026: CISA republished Siemens' advisory as ICSA-26-295-14 (8:00 pm Perth time). (source: CISA)
Siemens ProductCERT — SSA-591731: Multiple Vulnerabilities in SIMATIC S7 PLCs Web Server (13 Oct 2026, V1.0)
Adobe released security bulletin APSB26-144 for ColdFusion on 13 October 2026, its October Patch Tuesday, with 31 CVE records published the same day by Adobe as the CVE numbering authority. Three are scored 10.0 (CVSS 3.1: network, low complexity, no privileges, no user interaction, scope changed): CVE-2026-105899, an unrestricted upload of a dangerous file type that Adobe says could lead to arbitrary code execution; CVE-2026-106624, a code-injection flaw leading to arbitrary code execution; and CVE-2026-106622, a server-side request forgery (SSRF) flaw that could lead to privilege escalation. Two more, CVE-2026-105903 (code injection) and CVE-2026-106612 (incorrect authorisation), are scored 9.9 and need only a low-privileged account. Others in the bulletin include CVE-2026-106621 (9.1, code injection without authentication), CVE-2026-106619 (9.0, input validation, high attack complexity), CVE-2026-106620 (9.6, authorisation bypass giving write access), CVE-2026-75994 (9.6, code execution from the administrative network zone), CVE-2026-90530 (9.3, path traversal in the RDS developer feature), and a long list of 7.1 to 8.8 authorisation, SSRF, XXE and denial-of-service bugs. Adobe's CVE records list ColdFusion 2025 up to 2025.0.13 and ColdFusion 2023 up to 2023.0.25 as affected, fixed in 2025.0.14 and 2023.0.26. The record for CVE-2026-90530 notes that RDS is a development feature that the Production Secure Profile disables automatically. We found no reports of exploitation, and none of these CVEs is in CISA's Known Exploited Vulnerabilities catalog as of 20 October, but internet-facing ColdFusion servers have been exploited quickly after past bulletins, so treat this as urgent. Details come from Adobe's CVE records; Adobe's bulletin page refused our fetch. (sources: Adobe APSB26-144; Adobe CVE records)
Adobe — APSB26-144 Security updates available for Adobe ColdFusion (13 Oct 2026)
Adobe's security bulletin APSB26-153, published on 13 October 2026, fixes CVE-2026-103849, a template-engine injection in Adobe Commerce and Magento Open Source that lets an unauthenticated attacker run arbitrary PHP on the store server. E-commerce security firm Sansec, which named the flaw BlockStrap (reported to Adobe by researcher vozec), said on 15 October that it reproduced four separate routes to code execution within 24 hours of the patch, although it had not yet seen attacks on live stores. BlockStrap is a second-pass directive injection: September's StyleSmuggler hotfix (CVE-2026-75650, VULN-39341) signs trusted template directives, but attacker-controlled data in a child email template can still be signed and re-scanned at the root level, where a smuggled {{block}} directive runs. Adobe's fix replaces that generic re-scan with registered placeholders. Adobe rated the bulletin priority 2 (patch within 30 days) because it reserves priority 1 for flaws it knows are exploited; Sansec disputes that, noting StyleSmuggler went from hotfix to mass exploitation in three days. A plain Composer install still pulls the vulnerable base version, so stores need the 2026-oct release or Adobe's isolated patch, and the October patch does not include the StyleSmuggler hotfix, which must stay installed separately. Public October patches cover Magento Open Source 2.4.7-p10, 2.4.8-p5 and 2.4.9; patches for 2.4.4 to 2.4.6 need an Adobe Commerce licence, so Open Source stores on 2.4.6 or older must upgrade. Mage-OS 3.6.0 (14 October) includes the fix. (sources: Adobe APSB26-153; Sansec; BleepingComputer) Updated 15 Oct 2026 (Sansec): Sansec's report is dated 15 October 2026; details credited to Sansec on this card come from that report. Updated 16 Oct 2026 (BleepingComputer): BleepingComputer's report is dated 16 October 2026; details credited to BleepingComputer on this card come from that report.
Adobe — APSB26-153 security update for Adobe Commerce and Magento Open Source (13 Oct 2026)
SolusVM published advisory CVE-2026-105474 (updated 13 October 2026) for a server-side template injection in SolusVM 2, the virtual-server control panel used by many hosting providers. An authenticated user can execute arbitrary code on the server with elevated privileges, which SolusVM says can lead to full compromise of the management node and affect other customers hosted on the same node. Rapid7 records CVSS 4.0 base score 9.4 (Critical) for the issue and describes remote authenticated users reaching root. Affected: all SolusVM 2 builds through 2.0.0-44576. Patched version listed by SolusVM: 2.0.0-44739. The advisory tells operators to update to 2.0.0-44739 or later once that build is available. Credited to Georgii Shutiaev. No in-the-wild exploitation is stated in the vendor note or the Rapid7 entry this pass. (sources: SolusVM support advisory; CVE record)
SolusVM — CVE-2026-105474 Server-Side Template Injection in SolusVM 2 (updated 13 Oct 2026)
CISA published ICS advisory ICSA-26-286-01 on 13 October 2026 for Inductive Automation's Ignition, the SCADA/HMI and industrial application platform. CVE-2026-92817 (CWE-266, incorrect privilege assignment) is in the Perspective module, which does not properly validate session privileges when it decides whether a user has Designer-level access. An authenticated user with access to a Vision project can present their valid Vision session identifier and be granted Designer privileges, then use them to execute arbitrary code in the context of the Ignition Gateway process. Affected: Ignition 8.1.0 through 8.1.54 and 8.3.0 through 8.3.8. CISA scores it CVSS v3.1 8.8 and CVSS v4.0 8.7 and lists Critical Manufacturing, Energy and Information Technology as the sectors where Ignition is deployed. Per CISA, Inductive Automation released version 8.3.9 in August 2025 and version 8.1.55 in September 2026 to fix the issue, and recommends updating to the newest version available. The flaw was reported to Inductive Automation by Tim Hemingway. CISA says no known public exploitation specifically targeting this vulnerability has been reported to it. Because the Gateway runs the plant-facing projects, code execution there can reach connected OT systems, so treat Vision project access as a privileged right until patched. (sources: CISA ICSA-26-286-01; Inductive Automation Trust Center bulletin; CVE record)
CISA — ICSA-26-286-01: Inductive Automation Ignition Software (13 Oct 2026)
Adobe published security bulletin APSB26-152 for Adobe Experience Manager (AEM), with CVE records released on 13 October 2026, its October Patch Tuesday. CVE-2026-48382 and CVE-2026-48383 are incorrect-authorisation flaws (CWE-863) that Adobe says could result in arbitrary code execution, potentially giving the attacker elevated access or control over a victim's account or session. Adobe scores both 10.0 (CVSS 3.1: network, low complexity, no privileges, no user interaction, scope changed). Affected releases are AEM as a Cloud Service up to 2026.9.28187, AEM 6.5 LTS up to SP3, and AEM 6.5 up to 6.5.25. Fixes are AEM as a Cloud Service 2026.9.28386 and a hotfix for GRANITE-72352 on 6.5 LTS SP1 to SP3 and on AEM 6.5.20 to 6.5.25. Details come from Adobe's own CVE records. No exploitation has been reported. This is separate from the September AEM Forms bulletin (APSB26-151) on Cyberstack. Adobe also released ColdFusion bulletin APSB26-144 the same day, with 31 CVEs including three CVSS 10.0 flaws that need no login; it has its own card: /n/adobe-coldfusion-apsb26-144-cvss10-105899-20261013.
Adobe — APSB26-152 Security update available for Adobe Experience Manager (Oct 2026)
Security researcher wunderwussi (Embrace The Red) published on 13 October 2026 that Microsoft patched CVE-2026-103572, an Important-severity remote code execution issue in the shared Microsoft.VisualStudio.Copilot.Core.dll used by GitHub Copilot in Visual Studio (including Visual Studio 2026 and older Visual Studio 2022 trains) and SQL Server Management Studio. A path-validation check that was meant to block writes to sensitive Copilot settings and MCP configuration files could be bypassed by appending a trailing ASCII period to the filename: Win32 APIs strip the final dot, so a write to settings.json. or .mcp.json. lands on the protected file. That lets the agent escape containment and run arbitrary commands; the report also shows a third party can drive the same outcome through indirect prompt injection. Microsoft classified the issue as Important RCE and shipped the fix with the 13 October updates. Operators who enable Copilot inside Visual Studio or SSMS should apply the October Visual Studio / SSMS Copilot updates promptly and treat untrusted repo content as able to steer agent file writes until patched. Correction (02 Nov 2026): removed talkback.sh as a source. (source: Embrace The Red; Microsoft)
Embrace The Red — Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572, 13 Oct 2026)
Rockwell Automation published security advisory SD1801 on 13 October 2026 for the 1732E ArmorBlock I/O, an on-machine EtherNet/IP distributed I/O module with a built-in configuration web server. CVE-2026-12655 (CWE-294, authentication bypass by capture-replay) lets an unauthenticated attacker change the device's web server password without valid credentials, which can mean admin account takeover or unauthorised configuration changes. CVE-2026-12656 is a denial-of-service issue: network storm traffic can interrupt communication, fault the device and affect open TCP and UDP ports, and a power cycle is needed to recover. Rockwell lists both as corrected with no workaround and not on the CISA KEV list; the advisory's overall severity is High. No exploitation is reported.
Schneider Electric published security notification SEVD-2026-286-01 on 13 October 2026 for its Pro-face STW6000 and Harmony STW6 basic web HMI panels (Harmony ST6 / Pro-face ST6000 range). CVE-2026-96434 is CWE-1104 (use of unmaintained third-party components): Schneider says failure to apply the listed mitigations may allow various attack scenarios from third-party component obsolescence, including unauthorised control of the device and operational failures, when a user visits malicious web pages for browsing. CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); CVSS 4.0 base is 8.6. All versions of both products are listed as known affected. The advisory does not publish a fixed firmware build for this CVE; remediations are mitigations — run the HMI only in a protected environment, minimise network exposure and keep panels off the internet, plus Schneider's standard ICS hygiene guidance. A second same-day notice, SEVD-2026-286-02, covers SAGE RTU CVE-2026-102250 (CVSS 7.2, privileges required high) with a firmware fix in C3414-500-S02L0. No exploitation is stated. (source: Schneider Electric SEVD-2026-286-01 CSAF/JSON) The CVE record for CVE-2026-96434 is not yet published on cve.org; this card rests on Schneider Electric's advisory SEVD-2026-286-01.
Schneider Electric — Security notifications (SEVD-2026-286-01, 13 Oct 2026)
Ivanti disclosed CVE-2026-106042 on 13 October 2026 in Ivanti Xtraction: an external control of file name or path (CWE-73) that lets a remote authenticated attacker redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials the application transmits. OpenCVE and reporting rate it Critical 9.9 (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The Canadian Centre for Cyber Security advisory AV26-1035 lists Ivanti Xtraction 2026.2.1 and prior as affected; public CVE enrichment marks 2026.4 as unaffected. Ivanti's October security update points customers to the Xtraction multiple-CVE advisory and says it is not aware of exploitation for these product fixes. EPMM connector credentials are high value for mobile-device management integrations, so treat this as a credential-exposure priority alongside rotating any EPMM secrets after upgrade. Separate from the Connect Secure zero-day chain. (sources: Ivanti Xtraction multiple-CVE advisory; OpenCVE)
Ivanti — Security Advisory Ivanti Xtraction (Multiple CVEs) October 2026
Ivanti's 13 October 2026 security update discloses CVE-2026-109412 in Ivanti Neurons Patch for Intune, a cloud service that publishes patches into Microsoft Intune. The CVE record describes an exposed dangerous endpoint (CWE-749) that lets a remote authenticated attacker leak sensitive authentication information. Ivanti rates it Critical 9.9 (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Environments using versions prior to the 16 September 2026 server-side fix are listed as affected; Ivanti states the cloud service was fixed for all environments on that date, so no customer software update is required. Out of caution Ivanti recommends rotating the Microsoft Entra ID app-registration client secret used for Intune publication. Ivanti says it is not aware of exploitation. This is separate from the Connect Secure zero-day (CVE-2026-104935) disclosed the same day. (sources: Ivanti Neurons Patch for Intune security advisory; Canadian Centre for Cyber Security AV26-1035; CVE record)
Ivanti — Security Advisory Ivanti Neurons Patch for Intune October 2026 (CVE-2026-109412)
