The Xen Project published eight security advisories on 13 October 2026 (12:00 UTC). The most serious for shared hosting is XSA-517 (CVE-2026-79610): a race in grant-table version changes lets an unprivileged x86 guest that can use grant table v2 and has more than one vCPU possibly escalate to host privileges, leak information or crash the host; every Xen release from 4.0 onward is affected. XSA-516 (CVE-2026-79609) is a page-table isolation (XPTI) flaw that lets a 64-bit PV guest escalate to the host, but only on x86 hosts with RAM above the 5 TiB boundary (3.5 TiB with CONFIG_BIGMEM). XSA-515 (CVE-2026-79608) says a rework of the Zenbleed workaround left it ineffective on AMD Zen 2 CPUs, so code can read data from other contexts on the same core, such as AES-NI key material and memcpy contents; it affects Xen 4.19.4 and later, 4.20.3 and later, 4.21.1 and later and 4.22, and only systems still running pre-Zenbleed (2023) microcode. XSA-519 (CVE-2026-102699 and CVE-2026-102702) lets a malicious guest on Arm crash the hypervisor or corrupt another domain's memory through GNTTABOP_cache_flush, with privilege escalation not ruled out and no mitigation, on Xen 4.5 onward. XSA-521 (CVE-2026-102701) is a missing bounds check in tapdisk, the userspace block backend used by the XAPI toolstack, which a malicious guest can use to overflow the stack and possibly run code as root. The rest are denial-of-service issues: XSA-514 (CVE-2026-79607) crashes C xenstored during a Xenstore live update on Xen 4.22, XSA-518 (CVE-2026-79611) lets HVM or PVH guest userspace crash its own guest on Intel VMX hosts, and XSA-520 (CVE-2026-102700) leaks page references through x86 cache-flush handling on Xen 4.5 to 4.20. The Xen Project does not assign CVSS scores and reports no exploitation. (source: Xen Project security advisories) The CVE record for CVE-2026-102701 is not yet published on cve.org; that item rests on the Xen Project advisory XSA-521.
Xen Project — Security advisories XSA-514 to XSA-521 (13 Oct 2026)
Mozilla released Firefox 158 on 13 October 2026 with advisory MFSA 2026-106, which lists 77 CVEs: 30 rated high, 33 moderate and 14 low. Mozilla now issues a separate CVE for every internally found memory safety bug instead of rolling them into one, which is why the count is large. High-rated issues include a privilege escalation in the Application Update component (CVE-2026-109704), several sandbox escapes in the Networking component (CVE-2026-109705, CVE-2026-109707, CVE-2026-109708), a sandbox escape through uninitialised memory in Graphics (CVE-2026-109712), a sandbox information disclosure and privilege escalation (CVE-2026-109709), and many use-after-free bugs across IndexedDB, DOM, SVG, XML, canvas and media code. Amy Burnett of OpenAI reported ten of the high-rated bugs, mostly JavaScript engine and JIT boundary and miscompilation issues (for example CVE-2026-109715, CVE-2026-109720 and CVE-2026-109722). The advisory does not say any are exploited in the wild. The same day Mozilla published fixes for Firefox ESR 153.5 (MFSA 2026-108), Firefox ESR 115.43 (MFSA 2026-107), Thunderbird 158 (MFSA 2026-109) and Thunderbird 153.5 (MFSA 2026-110). (source: Mozilla security advisories)
Mozilla — MFSA 2026-106 Security Vulnerabilities fixed in Firefox 158 (13 Oct 2026)
Google moved Chrome's desktop Stable channel to 155.0.8059.79/.80 for Windows and Mac and 155.0.8059.79 for Linux on 13 October 2026 (US time), rolling out over the coming days and weeks. The release carries 37 security fixes: seven rated critical, 29 high and one medium. The critical ones are a buffer overflow in the ANGLE graphics layer (CVE-2026-110152, reported by Zhenpeng (Leo) Lin of depthfirst) and use-after-free bugs in Browser (CVE-2026-110149), PDF (CVE-2026-110136), Network (CVE-2026-110161), Core (CVE-2026-110165), SVG (CVE-2026-110148) and Media (CVE-2026-110151). High-rated fixes include a V8 type confusion (CVE-2026-110140), V8 use-after-free bugs (CVE-2026-110168 and CVE-2026-110169, the second reported by Xinyang Ge of Anthropic with help from Claude), a privilege elevation in the installer (CVE-2026-110150), incorrect authorisation in the updater and Mojo, and several Passwords bugs including an information leak (CVE-2026-110146). Many of the bugs were reported by Xinyang Ge. Google's post does not say any of them are being exploited. The Extended Stable channel moved to 152.0.7977.167 for Windows and Mac the same day with 28 of the fixes, including the PDF, Network and SVG critical bugs. Chromium-based browsers such as Microsoft Edge, Brave and Opera take these fixes in their own releases. (source: Chrome Releases blog)
Chrome Releases — Stable Channel Update for Desktop, 155.0.8059.79/.80 (13 Oct 2026)
CISA published ICS advisory ICSA-26-286-02 on 13 October 2026 for the Swann Communications SWIFI-SE2KIC, a product of the Australian-headquartered security camera maker. Firmware 2.0.22 and earlier has three missing-authentication flaws (CWE-306). CVE-2026-107605 lets an attacker on the local network view the live video feed without logging in; CVE-2026-107606 lets them retrieve a snapshot of the live feed; and CVE-2026-107607 lets them open a real-time video stream. CISA scores them 6.2 (CVSS 3.1, Medium) and 5.9 to 6.9 (CVSS 4.0). CISA says the flaws are not exploitable remotely and no public exploitation has been reported. The advisory lists no fixed firmware. Swann's interim advice is to keep the camera behind a secured router and firewall, never expose its RTSP service to the internet through port forwarding, DMZ or a public IP, use strong unique router and account passwords, and install firmware updates when they arrive. Elliott Phillips reported the flaws. CISA lists the products as deployed worldwide in commercial facilities; Swann cameras are also common in Australian homes and small businesses.
Fortinet's FG-IR-26-180, published on 13 October 2026, fixes CVE-2026-106173 in FortiSIEM. Fortinet titles it an arbitrary file write in the gRPC phQueryMaster service and describes a path traversal (CWE-22) that may let an unauthenticated attacker execute unauthorised code or commands with specially crafted packets. It rates the flaw Critical, 9.4 (CVSS 3.1). Only FortiSIEM 7.5.0 is listed as affected; 7.6 is not affected and FortiSIEM Cloud is not affected. The fix is 7.5.1. Fortinet gives a workaround: restricting access to TCP port 27918 prevents the issue. The flaw was found internally by Fortinet's product security team, and the advisory marks it as not known to be exploited. FortiSIEM collects logs and credentials for the systems it monitors and is widely run by managed security providers, and older FortiSIEM bugs have been exploited soon after disclosure, so a SIEM that accepts traffic from untrusted networks is worth treating as urgent. Released in the same Fortinet monthly batch as the critical FortiSandbox flaw CVE-2026-107656 (its own card). UPDATE (20 Oct, Horizon3.ai): Horizon3.ai published a technical analysis and released working exploit code on GitHub. It found the phQueryMaster gRPC service on TCP 27918 listens on all interfaces and does not ask clients for a certificate, so anyone who can reach the port can call it without logging in. Its SendQueryResult handler builds a file path from an attacker-supplied query-id without validation, so '../' sequences pick the directory, and a NUL byte in the query-id cuts off the file name the server would otherwise append, letting an attacker overwrite an existing file in place while keeping its owner and permissions. Horizon3.ai's exploit overwrites /opt/charting/redishb.sh, a Redis health-check script cron runs every 60 seconds, which turns the file write into code execution; a second variant creates a new file with an exact name. Horizon3.ai says no FortiSIEM application log clearly shows the attack. Fortinet's advisory still marks the flaw as not known to be exploited (checked 21 Oct).
Fortinet PSIRT FG-IR-26-180 — FortiSIEM arbitrary file write in gRPC phQueryMaster (13 Oct 2026)
Fortinet published FG-IR-26-185 on 13 October 2026 for CVE-2026-107656, a critical authentication bypass using an alternate path or channel (CWE-288) in the FortiSandbox web management GUI. A remote, unauthenticated attacker can send crafted HTTP requests to get past authentication, and Fortinet lists the impact as executing unauthorised code or commands. It rates the flaw 9.6 (CVSS 3.1). FortiSandbox 5.0.0 to 5.0.6 and 4.4.0 to 4.4.9 are affected, as are FortiSandbox PaaS 5.0.0 to 5.0.6 and every PaaS 4.4 release; the 5.2 branch is not affected. Fortinet's product security team found it internally, and Jason McFadyen of TrendAI Research also reported it. The advisory marks it as not known to be exploited. It was part of Fortinet's 13 October monthly PSIRT release, which also fixed a separate critical FortiSIEM flaw (CVE-2026-106173, its own card) and lower-rated FortiSandbox, FortiOS, FortiManager, FortiAnalyzer and FortiMail issues. FortiSandbox sits in the mail and web inspection path and holds samples of suspicious files, so an exposed admin interface is a high-value target. (source: Cyber Security News)
Fortinet PSIRT FG-IR-26-185 — FortiSandbox improper access control and session management in the web management interface (13 Oct 2026)
Microsoft's October 2026 security updates, released on 13 October 2026, fix one actively exploited zero-day and two publicly disclosed flaws. CVE-2026-96951 is a Windows Shell security feature bypass (command injection) that lets an unauthenticated attacker get around Mark of the Web protections over a network once a user opens a crafted file or link; Microsoft rates it Important, CVSS 8.8, and marks it 'Exploitation Detected'. It has not said who reported it or how it was used. CVE-2026-108398 is a .NET Framework untrusted search path flaw (CVSS 8.8) that lets a local, authenticated attacker register a crafted .NET assembly for loading by a protected process and bypass Windows Defender Application Control (WDAC); it was publicly disclosed and found by James Forshaw of Google Project Zero, but is not marked exploited. CVE-2026-92707 is a publicly disclosed MessagePack-CSharp denial of service (CVSS 5.3). BleepingComputer counts a record 1,411 flaws fixed on Patch Tuesday itself, 70 of them Critical (57 remote code execution), not counting 348 cloud and other fixes released earlier in the month. Critical remote code execution bugs rated CVSS 9.8 by Microsoft include Windows DHCP Server (CVE-2026-96934), Windows Message Queuing (CVE-2026-100202), Microsoft QUIC (CVE-2026-100219, CVE-2026-105016), Windows Text Shaping (CVE-2026-97814) and several Outlook bugs, all rated 'Exploitation Less Likely'. October is also the last update for Windows 11 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016. UPDATE 15 October: the WA Government's Cyber Security Unit (WASOC) issued advisory 20261015001 for CVE-2026-96951, saying Microsoft is aware of exploitation and CISA has added it to its Known Exploited Vulnerabilities catalogue. WASOC has had no reports of exploitation on WA Government networks and recommends applying Microsoft's fix within expected timeframes. UPDATE 16 October: Microsoft added a known issue to the KB5127648 release notes for Windows 11 24H2, 25H2 and 26H2: after the update, some devices cannot turn Smart App Control back on in the Windows Security app if it was off, and the option may be greyed out. Devices that already have Smart App Control on are not affected and stay protected. Microsoft gives a registry workaround and two Feature Preview Group Policies for managed devices, and says a fix will come in an upcoming release. Separately, on 13 October MSRC published a blog proposing 'risk cohorts': provisional groups of CVEs that need the same check of a customer's environment (for example, 64 RDP client, gateway and server CVEs share the question of which roles are deployed and exposed; an Office cohort of 119 CVEs includes 23 rated Critical and 17 needing no user interaction). MSRC says these are not a new classification or prioritisation framework, do not change its update guidance, and do not appear in the Security Update Guide for now. UPDATE 16–17 October: Microsoft's NTLMv1 guidance (KB5066470) and message-centre post MC1508562 say the October 2026 update changes a default by design: on Windows 11 24H2, 25H2 and 26H2 and Windows Server 2025 devices without Credential Guard, if the BlockNtlmv1SSO registry value has never been set, Windows now uses Enforce mode instead of Audit mode and blocks NTLMv1-derived single sign-on credentials. Microsoft says this is a planned change, not a known issue, but it can break Wi-Fi, Ethernet and VPN connections that use MS-CHAPv2 (for example PEAP-MSCHAPv2) on domain-joined devices; The Register (16 Oct) reported it, and at least one university says Windows clients lost access to its MS-CHAPv2 wireless network. The temporary workaround is to set HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0\BlockNtlmv1SSO (REG_DWORD) to 0, which allows the requests and logs warning Event ID 4024; blocked attempts log Event ID 4025. Microsoft says Audit mode should only be a scoped, temporary exception. UPDATE 16–19 October: Microsoft's Windows release health dashboard (issue opened 16 Oct, status Mitigated) and the Exchange Team blog (16 Oct) say the October 2026 Windows Server updates can make on-premises Exchange Server 2016, 2019 and Subscription Edition unstable: users may be unable to sign in to Outlook on the web (OWA), mail sent from Outlook can stay in the Outbox, mail queues grow, mailbox replication can fail and some DAG members cannot reach quorum. OWA may show 'MapiExceptionMdbOffline ... (hr=0x80004005, ec=1142)' with Event ID 1006. The cause is a new default limit on Endpoint Mapper memory (512 simultaneous Endpoint Lookup calls), which busy Exchange servers can exceed. The affected updates are KB5126646 (Server 2025), KB5126655 (Server 2022), KB5126651 (Server 2019) and KB5126868 (Server 2016). Microsoft says this is not caused by the October Exchange security updates, impact depends on server load and some servers may never see it, and customers should not uninstall the Windows updates. Its temporary workaround is to set HKLM\SOFTWARE\Microsoft\Rpc\EpmapSavedContextCap (REG_DWORD) to 65536, reboot, and raise it if the problem returns; a further mitigation is available through Microsoft Support for business, and a fix is under investigation. BleepingComputer reported it on 19 October.
Microsoft Security Response Center — October 2026 Security Updates release notes (13 Oct 2026)
SAP's 13 October 2026 Security Patch Day lists 16 new security notes and 4 GitHub security advisories, led by CVE-2026-89111 (GHSA-4mv3-jxxm-9cx2), rated Critical 10.0. SAP says the Cloud SDK for Python, its official toolkit for Python apps and AI agents on SAP Business Technology Platform (BTP), has an OAuth2 server-side request forgery flaw affecting multi-tenant BTP applications: an attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to a server they control and capture the application's client credentials. Versions before 0.45.2 are affected. The same patch day also rates as Critical CVE-2026-89110 (9.9, broken access control in NetWeaver Visual Composer VC70RUNTIME 7.50), CVE-2026-89107 (9.9, code injection in S/4HANA Manage Substitution/Validation Rules, S4CORE 105 to 109) and CVE-2026-89108 (9.1, missing authorisation in Manufacturing Integration and Intelligence Configuration Service). SAP has not marked any of these as exploited.
SAP Security Patch Day — October 2026 (13 Oct 2026)
Ivanti disclosed CVE-2026-104935 in Ivanti Connect Secure (ICS) on 13 October 2026 and said it is aware of limited exploitation in the wild, urging customers on affected versions to act immediately, upgrade to the fixed release and run the Integrity Checker Tool regularly. The CVE record describes an authentication bypass by spoofing that lets a remote unauthenticated attacker execute arbitrary commands; ICS 22.7R2.14 and earlier are not affected. Volexity, which found and reported the issue, says a previously unknown actor it tracks as UTA0576 exploited a fully patched 22.8R2.4 appliance from 3 October 2026. The chain abused a request-routing bypass in the public welcome.cgi page (an X-DSCGI-PATH header pointing at an internal script), a race in the wu.cgi upload handler to run a briefly written Perl script, and a separate privilege escalation in the dsinvoked broker's trust of DSCache data to reach root. Ivanti tracks the bypass and RCE together as CVE-2026-104935; BleepingComputer reports the privilege escalation is still being fixed. The actor deployed no web shell, re-exploited the device for each command, tampered with debug and audit logs and evaded the Integrity Checker. Post-exploitation targeted Active Directory: LDAP service credentials stored on the appliance, LAPS passwords, BitLocker recovery keys, Kerberoasting and password spraying. Defused reports first exploitation signs from 1 October, and Shadowserver tracks more than 5,500 internet-exposed ICS instances. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on 13 October, with a 16 October patch deadline for US federal agencies, and issued an alert saying it is aware of actors using the flaw for credential theft and data exfiltration. CISA warns the Integrity Checker may miss exploitation because commands run in memory, so confirming compromise needs network and memory forensics, and it says Connect Secure 22.8 reaches end of life on 31 January 2027. Rapid7 reports Ivanti had found part of the issue internally and fixed it in 25.1.3.0 in July, and exploitation came while backports to other branches were still under way; iTnews lists 25.1.1.2 among the fixed builds. Volexity assesses with medium confidence that UTA0576 used large language models to build its tooling. Previdian reports that its honeypot sensors logged 217 exploitation attempts against CVE-2026-104935 from 97 unique attacker IPs in 17 countries between 14 October and 2 November 2026; it notes these observations do not show that the targets were vulnerable or that the attempts succeeded. (source: Previdian) UPDATE (23 Oct 2026): the privilege escalation now has its own CVE record, CVE-2026-111357 (published 15 October, updated 16 October): Ivanti Connect Secure 22.8R2.4 mishandles how the dsinvoked broker trusts DSCache configuration data, leading to root, 'as exploited in the wild in October 2026'. The record scores it CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) and lists no fixed version as of its 30 October update. Volexity's 13 October post says Ivanti is working on a fix that will be included in a future release 'in the coming weeks'. CVE-2026-111357 was not in CISA's KEV catalog as of the 29 October catalog release (version 2026.10.29). (source: CVE-2026-111357 record (cve.org); Volexity) UPDATE (30 Oct 2026): Volexity added a note to its 13 October post saying that on 29 October 2026 Ivanti published a patch for the privilege escalation, tracked as CVE-2026-111357. (source: Volexity) The Stack reported on 29 October that Ivanti disclosed and fixed CVE-2026-111357 and a second flaw exploited in the chain, CVE-2026-118527; The Stack describes CVE-2026-111357 as a CVSS 8.8 privilege escalation bug and CVE-2026-118527 as a CVSS 4.3 bug that lets an authenticated attacker upload files with attacker-controlled content to disk. According to the advisory table The Stack reproduces, CVE-2026-111357 and CVE-2026-118527 affect ICS 25.1.1.2 and prior and 22.8R2.5 and prior and are resolved in 25.1.1.3 and 22.8R2.6. (source: The Stack) Ivanti's own advisory page did not load for the desk this pass. The CVE-2026-111357 record (last updated 30 October) still scores it CVSS 3.1 7.0 and lists no fixed version. UPDATE (31 Oct 2026): CISA added CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities catalog on 30 October 2026 (catalog version 2026.10.30), with US federal agency due dates of 2 November and 13 November respectively. CISA's catalog describes CVE-2026-111357 as a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate privileges, and CVE-2026-118527 as a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk, each of which can be chained with CVE-2026-104935. (source: CISA KEV catalog) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Previdian)
Ivanti — October 2026 Security Update (13 Oct 2026; links the Connect Secure CVE-2026-104935 advisory)
Bloom Security disclosed 'SlugFest' on 13 October 2026, a takeover path in npm Trusted Publishing, the OpenID Connect (OIDC) feature that lets a GitHub Actions workflow swap a short-lived identity token for an npm publishing credential instead of storing a long-lived token. Until a binding completed its first successful publish, npm recorded the trusted repository only by its human-readable owner/repo name (the 'slug'), not by GitHub's permanent repository and owner IDs. If the maintainer then renamed, transferred or deleted that repository, or the owner account was renamed or deleted, anyone could create a repository at the freed name, add a workflow file with the expected filename, and receive a valid publish credential for a package they did not own. No stolen token or account access is needed, and a release pushed this way carries a valid Sigstore provenance attestation, naming the attacker's repository. Bloom's scan found more than 1,500 vulnerable packages with over 10 million total downloads and more than a million a month. It is not publishing the list. It ran the attack end to end only against packages and repositories it controlled, and says it is unknown whether anyone abused the flaw in the wild. Bloom says npm's GitLab trusted publishing integration had the same weakness. Bloom reported the issue through GitHub's HackerOne programme on 6 June; GitHub validated it on 9 June, and Bloom says follow-ups after 8 July went unanswered until it found the fix when it checked again before publishing. GitHub's changelog of 2 October 2026 says unvalidated npm trusted publishing configurations now expire 48 hours after creation and can no longer authorise publishing, and that npm now rejects trusted publishing tokens from GitHub Actions issue_comment events, alongside the existing pull_request_target block. GitHub told Help Net Security it shipped fixes after validating the bug bounty report; its statement does not say whether older bindings were re-bound to permanent IDs. Bloom's broader point is that AI coding agents now pull in about 70 packages a month on a typical endpoint (close to 350 on developer machines), usually without review, so a hijacked package can spread without fooling a human. (sources: Bloom Security; GitHub changelog; Help Net Security)
Bloom Security — SlugFest: millions of AI agents download exposed npm packages (13 Oct 2026)
EmbedThis published GitHub security advisory GHSA-5m75-xq69-c3c5 for its GoAhead embedded web server on 12 October 2026, rated Critical, saying the OpenSSL TLS backend loads a configured certificate revocation list (CRL) into the OpenSSL certificate store but never enables CRL checking, so "revoked client certificates are silently accepted" (CVE-2026-115881). EmbedThis says exploitation requires the OpenSSL backend (the project's preferred and default TLS backend), mutual TLS with a CA bundle, issuer checking and a CRL all configured, and an attacker holding a client certificate signed by a trusted CA that is listed as revoked, such as a stolen or decommissioned device certificate; the default GoAhead build does not enable mutual TLS or load a CRL, and Mbed TLS builds are not vulnerable. Affected versions are 3.4.5 through 6.1.0 and the fix is 6.1.1. EmbedThis published two related advisories the same day: GHSA-r392-vqwx-3r4g (CVE-2026-115884, rated High), where builds linked against LibreSSL's legacy X.509 verifier (LibreSSL 3.2.x or 3.3.2 to 3.3.6) that require client certificates without issuer checking accept an over-depth self-signed chain, and GHSA-fmvx-2xfx-2gq4 (rated Moderate), where Mbed TLS builds send a 1-byte Diffie-Hellman modulus on TLS 1.2 DHE-RSA handshakes, letting a passive observer decrypt sessions with clients that accept it. Sébastien Féry of FoxIO, who reported the flaws, published a write-up on 26 October rating them CVSS 9.1, 7.4 and 5.9, saying GoAhead 6.1.1 was released on 2 August 2026 and that reproduction code (proof of concept) is available; FoxIO says GoAhead is used in hundreds of millions of devices. Neither EmbedThis nor FoxIO says the flaws are exploited in the wild. (sources: EmbedThis advisories; FoxIO)
EmbedThis (GitHub advisory GHSA-5m75-xq69-c3c5) — OpenSSL CRL loaded but not enforced in GoAhead sslOpen() (src/openssl.c): revoked client certificates are silently accepted (CWE-299, CWE-295) (12 Oct 2026)
Advantech published a security advisory on 12 October 2026 for the ADAM-3600 EdgeLink, a remote terminal unit (RTU) used for industrial data acquisition and remote monitoring. It fixes 30 vulnerabilities, CVE-2026-43829 to CVE-2026-43858, found by Simone Bossi and Raffaele Bova of Nozomi Networks and coordinated with the Cyber Security Agency of Singapore (CSA), which issued alert AL-2026-149 on 20 October; Canada's Cyber Centre flagged the advisory the same day (AV26-1065). Every firmware version before EdgeLink 2.8.5.0 is affected. The most serious are rated critical under CVSS 4.0: CVE-2026-43836 (9.3) lets an attacker forge a packet to run arbitrary commands with maximum privileges, and CVE-2026-43844 (9.3) bypasses authentication in the device's proprietary protocol; CVE-2026-43845 (9.2) bypasses authentication through the password-reset mechanism; and stack buffer overflows in the log-message function (CVE-2026-43831, unauthenticated), the login function (CVE-2026-43838) and, when the SafeEnhancement feature is enabled, password and cookie parsing (CVE-2026-43829 and CVE-2026-43832, unauthenticated) can give code execution (all 9.2). Other fixes cover command injection while a firmware file is verified (CVE-2026-43830) and upload of a forged firmware image that could permanently compromise the device (CVE-2026-43835), unlimited brute-forcing of the administrator password over the proprietary protocol even with SafeEnhancement on (CVE-2026-43847), authenticated root-level command injection, arbitrary file read and file write, recovery of administrator credentials from an encrypted EdgeLink project file (CVE-2026-43854), and several unauthenticated crashes of the logging and licence-manager services. Advantech says EdgeLink 2.8.5.0 fixes all 30 and adds asymmetric digital signatures for firmware upgrades. Neither Advantech nor CSA reports exploitation. (sources: Advantech advisory; CSA AL-2026-149) Updated 20 Oct 2026 (Cyber Security Agency of Singapore): Cyber Security Agency of Singapore's report is dated 20 October 2026; details credited to Cyber Security Agency of Singapore on this card come from that report.
Advantech — Security advisory: Vulnerabilities identified in ADAM-3600 (v1.0, 12 Oct 2026; PDF)
