CyberStack

Latest cyber news, threats, security, and guidelines. Stack up.

Latest

Vulnerability
Published 2026-11-02 New
Verified 2026-11-03

Textpattern CMS 4.9.2 (2 Nov) fixes nine security issues, including an arbitrary file write through XML-RPC, CSRF in theme import and an admin-rights check on the Users panel; all earlier versions affected

The Textpattern CMS project released Textpattern 4.9.2 on 2 November 2026 as a patch release with security fixes, and says versions before 4.9.2 are affected unless stated. The issues, reported by third-party researchers, are: an authentication issue with concurrent logins and cookies; content sandboxing of preview frames (with a new admin-side Content Security Policy layer); unsanitised 'sort' attributes in the authors and file_download tags; inconsistent sanitising of the 'url_title' attribute; a user-privilege cross-site request forgery mitigated with CSP; cross-site request forgery in the theme import workflow; missing validation of administrative user status on the Users panel; and an arbitrary file write through XML-RPC, which the project links to CVE-2026-5344. The project gives no severity ratings and says it will update the post with CVE assignments. (source: Textpattern)

Product
Textpattern CMS (open-source PHP content management system)
Versions
Affected: Textpattern before 4.9.2 (unless stated); fixed: 4.9.2 (2 Nov 2026). CVE named by the project: CVE-2026-5344 (XML-RPC arbitrary file write).
Exploited in Australia?
unknown
Patch to
Back up site files and the database, then upgrade to Textpattern 4.9.2 using UPGRADE.txt.

Primary: Textpattern — Textpattern 4.9.2 released: security fixes, patches and tweaks (2 Nov 2026) · Vendor: Textpattern CMS project · CVE: CVE-2026-5344

vulnerabilities

Vulnerability
Published 2026-11-02 New
Verified 2026-11-03

Android November 2026 security bulletin (2 Nov): 208 CVEs, 23 rated Critical, including a Framework remote code execution flaw needing no user interaction; patch levels 2026-11-01 and 2026-11-05

Google published the Android Security Bulletin for November 2026 on 2 November 2026. It lists 208 vulnerabilities across two security patch levels: 113 at 2026-11-01 (Android runtime, Framework and System) and 95 at 2026-11-05 (kernel components and Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm components), and says devices on patch level 2026-11-05 or later are protected against all of them. Google says the most severe is a Critical flaw in the Framework component that could lead to remote code execution with no additional execution privileges and no user interaction; that entry is CVE-2026-58868 (Android 14 to 17). Of the 208, 23 are rated Critical: at 2026-11-01, CVE-2026-58868 (Framework, remote code execution) and, in System, CVE-2026-58876 and CVE-2026-58936 (remote code execution), CVE-2026-55275, CVE-2026-55283 and CVE-2026-58984 (privilege escalation) and CVE-2026-58814 and CVE-2026-58882 (denial of service); at 2026-11-05, six upstream Linux kernel flaws in Bluetooth (CVE-2026-53256, CVE-2026-89774), pKVM (CVE-2026-59044, CVE-2026-59045, CVE-2026-59048) and HID (CVE-2026-80604), eight MediaTek modem flaws (CVE-2026-20499, CVE-2026-20519, CVE-2026-20520, CVE-2026-20545 to CVE-2026-20549) and one Qualcomm closed-source flaw (CVE-2026-25285). Google says the most severe kernel-component issue could lead to remote escalation of privilege with no user interaction. Some fixes also ship as Google Play system updates (Media Codecs, MediaProvider, Profiling, Telephonycore and Wi-Fi). The bulletin does not flag any of these as exploited, and Google says AOSP source patches follow within 48 hours of publication. (source: Android Security Bulletin)

Product
Android (AOSP runtime, Framework, System and kernel components; Arm, Imagination, MediaTek, Unisoc and Qualcomm components) on OEM phones and tablets
Versions
Critical at 2026-11-01: CVE-2026-58868 (Framework RCE; Android 14 to 17), CVE-2026-58876, CVE-2026-58936 (System RCE; 14 to 17), CVE-2026-55275, CVE-2026-55283 (System EoP; 16, 16 QPR2, 17), CVE-2026-58984 (System EoP; 15 to 17), CVE-2026-58814, CVE-2026-58882 (System DoS; 14 to 17). Critical at 2026-11-05: kernel CVE-2026-53256, CVE-2026-89774 (Bluetooth), CVE-2026-59044, CVE-2026-59045, CVE-2026-59048 (pKVM), CVE-2026-80604 (HID); MediaTek modem CVE-2026-20499, CVE-2026-20519, CVE-2026-20520, CVE-2026-20545 to CVE-2026-20549; Qualcomm CVE-2026-25285. Fixed at security patch level 2026-11-05 or later.
CVSS
Critical (Android severity rating; the bulletin gives no CVSS scores)
Exploited in Australia?
unknown
Patch to
Move Android phones and tablets to security patch level 2026-11-05 or later as each maker ships it (2026-11-01 covers only the Framework, System and runtime fixes), and keep Google Play system updates current. Use your MDM to find handsets stuck on older patch levels, and plan to retire devices that no longer receive monthly updates.

Primary: Android Security Bulletin — November 2026 (published 2 Nov 2026) · Vendor: Android Open Source Project — November 2026 bulletin, patch levels 2026-11-01 and 2026-11-05 · CVE: CVE-2026-58868, CVE-2026-58876, CVE-2026-58936, CVE-2026-55275, CVE-2026-55283, CVE-2026-58984, CVE-2026-58814, CVE-2026-58882, CVE-2026-53256, CVE-2026-89774, CVE-2026-59044, CVE-2026-59045, CVE-2026-59048, CVE-2026-80604, CVE-2026-20499, CVE-2026-20519, CVE-2026-20520, CVE-2026-20545, CVE-2026-20549, CVE-2026-25285

vulnerabilities

Vulnerability
Published 2026-11-02 New
Verified 2026-11-02

BTCPay Server: attackers stole Bitcoin and Litecoin from hot wallets on servers running 2.4.1 or earlier; project says move to a fresh server with a new wallet

BTCPay Server, the open-source self-hosted cryptocurrency payment processor, said on 2 November 2026 that it received reports on 1 November of Bitcoin and Litecoin being stolen from hot wallets on BTCPay Server instances, and that its investigation found the attacks targeted servers running version 2.4.1 (released 23 July 2026) or earlier. The project says the attackers used a different method to exploit the vulnerability fixed in 2.4.2 (released 7 August 2026); it has not named a CVE. Its timeline, converted to Perth time, records a wallet drain at 21:46 on 1 November, the first theft report by email at 04:56 on 2 November, and a warning on X at 06:25 on 2 November asking operators to shut down their servers; it also asked VPS hosting providers, including LunaNode, to take BTCPay Server instances offline as a precaution. BTCPay says it has seen no impact on servers that were already running 2.4.2 or later when it issued that warning, that funds in wallets whose spending keys are held off the server, including hardware wallets, were unaffected, that it has not established when exploitation began, and that activity at the reported destination addresses should not be treated as a confirmed total of losses. (source: BTCPay Server) According to BleepingComputer, on 29 October BTCPay disclosed a critical vulnerability discovered through Anthropic's Frontier OSS scanner, which prompted the release of version 2.4.7 as an emergency security update, and BTCPay says it has no credible reports of hot wallet drains for users running 2.4.7. (source: BleepingComputer) Correction (02 Nov 2026): removed BTCPay Server's posts on X as a source; removed details no other source gives. (source: BTCPay Server; BleepingComputer)

Product
BTCPay Server (self-hosted Bitcoin and cryptocurrency payment processor) with hot wallets
Versions
Affected: BTCPay Server 2.4.1 (23 Jul 2026) and earlier (BTCPay Server, 2 Nov 2026). The exploited vulnerability was fixed in 2.4.2 (7 Aug 2026); latest release 2.4.7 (29 Oct 2026). No CVE named.
Exploited in Australia?
unknown
Patch to
If you ran 2.4.1 or earlier, BTCPay says to move to a fresh server even if you saw no theft and even if you updated after the 1 November warning: sweep remaining hot-wallet funds to a new wallet with a new seed created on a trusted device, take the old server offline and keep its logs, provision a fresh VM with the latest supported BTCPay Server release (do not restore the old server), and from a trusted device revoke and replace hosting, SSH, application, API and Lightning credentials the old server could reach. Everyone else: keep BTCPay Server updated (2.4.7 or later). Report losses to security@btcpayserver.org, never sending seeds, keys or passwords (BTCPay Server).

Primary: BTCPay Server — Security Incident Affecting BTCPay Server 2.4.1 and Earlier (2 Nov 2026) · BleepingComputer (02 Nov 2026)

vulnerabilities

Vulnerability
Published 2026-11-01
Verified 2026-11-01

Apache MINA 3.0 milestone builds (3.0.0 to 3.0.0-M2): unsafe deserialization in JavaNativeMessageDecoder (CVE-2026-118636, CVSS 9.8); Apache says the inactive 3.0 branch will not get a fix and recommends the latest MINA 2.2.x

Apache's CVE record for CVE-2026-118636, published on 1 November 2026 (4:17 am Perth), is marked 'UNSUPPORTED WHEN ASSIGNED'. It says JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain remote code execution. The record lists Apache MINA 3.0.0 through 3.0.0-M2 as affected, describes the severity as critical and gives a CVSS 3.1 base score of 9.8. Apache says that as the 3.0.0 branch is inactive it does not plan to release a version that fixes the issue, and recommends users move to the latest Apache MINA 2.2.x branch; MINA's download page lists Apache MINA 2.2.10 as the stable release (Java 8+). (sources: CVE-2026-118636 record; Apache MINA downloads page)

Product
Apache MINA 3.0 codec module (JavaNativeMessageDecoder)
Versions
Apache MINA 3.0.0 through 3.0.0-M2 (per the CVE record); Apache does not plan a fix for the inactive 3.0.0 branch
CVSS
(CVSS 3.1, Apache CNA)
Exploited in Australia?
unknown
Patch to
Apache recommends moving to the latest Apache MINA 2.2.x branch (MINA's download page lists 2.2.10 as the stable release, as of 1 Nov 2026). Until you have moved, do not put a MINA 3.0 JavaNativeMessageDecoder in front of untrusted peers.

Primary: CVE.org — CVE-2026-118636: Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder (CNA: Apache; published 1 Nov 2026, Perth) · Vendor: Apache MINA — MINA Downloads (2.2 branch) · CVE: CVE-2026-118636

vulnerabilities

Vulnerability
Published 2026-10-30
Verified 2026-10-31

ClickHouse Server CVE-2026-116366 (CVSS 4.0 9.5, Critical): under certain conditions an unauthenticated user with network access can run arbitrary code; fixed in 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable and 26.10.3.7-stable, and ClickHouse Cloud and BYOC already patched

ClickHouse says in its security changelog that an issue discovered in ClickHouse Server could, under certain conditions, allow an unauthenticated user with network access to execute arbitrary code on the server. It lists the fix under 'Fixed in ClickHouse v26.10.3.7, 2026-10-30' and says the fix has been pushed to the open-source versions v26.3.62.3-lts, v26.8.36.3-lts, v26.9.27.3-stable and v26.10.3.7-stable, and that a fix has been applied to all ClickHouse Cloud and BYOC deployments; it credits Elshad Toklayev. ClickHouse, as the CVE Numbering Authority, published CVE-2026-116366 on 30 October 2026 (11:00 UTC; 7:00 pm Perth) under the title 'Unauthenticated RCE vulnerability against ClickHouse Server', classed as CWE-190 (integer overflow or wraparound), with a CVSS 4.0 base score of 9.5 (Critical; network attack vector, high attack complexity, no privileges or user interaction). The CVE record lists open-source ClickHouse 26.3 before 26.3.62.3-lts, 26.8 before 26.8.36.3-lts, 26.9 before 26.9.27.3-stable and 26.10 before 26.10.3.7-stable as affected, and also lists ClickHouse Cloud builds before 25.12.1.1713, 26.2.1.835, 26.4.1.2704, 26.6.1.2439, 26.8.1.597 and 26.10.2.84. Neither ClickHouse's changelog nor the CVE record describes the conditions needed or reports exploitation. (source: ClickHouse security changelog; CVE record)

Product
ClickHouse Server (open-source ClickHouse; ClickHouse Cloud and BYOC)
Versions
Affected (CVE record): ClickHouse 26.3 before 26.3.62.3-lts, 26.8 before 26.8.36.3-lts, 26.9 before 26.9.27.3-stable, 26.10 before 26.10.3.7-stable. Fixed (ClickHouse changelog): v26.3.62.3-lts, v26.8.36.3-lts, v26.9.27.3-stable, v26.10.3.7-stable. ClickHouse Cloud and BYOC: fix applied by ClickHouse.
CVSS
(ClickHouse as CNA, CVSS 4.0; Critical)
Exploited in Australia?
unknown
Patch to
Self-hosted ClickHouse: upgrade to v26.3.62.3-lts, v26.8.36.3-lts, v26.9.27.3-stable or v26.10.3.7-stable (or later on your branch). ClickHouse Cloud and BYOC customers: ClickHouse says the fix is already applied. Until patched, keep ClickHouse ports off the internet and limit network access to trusted clients.

Primary: ClickHouse — Security changelog (Fixed in ClickHouse v26.10.3.7, 2026-10-30: CVE-2026-116366) · CVE: CVE-2026-116366 · CVE record — CVE-2026-116366: Unauthenticated RCE vulnerability against ClickHouse Server (published 30 Oct 2026 11:00 UTC)

tech cloud

Vulnerability
Published 2026-10-30
Verified 2026-10-31

ServiceNow October 2026 CVE advisory: AI Platform sandbox escape CVE-2026-103093 (CVSS 4.0 9.4, Critical) lets an authenticated admin run code on the host OS; plaintext password exposure and domain separation bypass also fixed

ServiceNow published CVE records on 29 October 2026 (UTC) for three ServiceNow AI Platform issues, each pointing to its knowledge base article KB3228994, titled 'October 2026 CVE Advisory Notification'. ServiceNow says CVE-2026-103093 (CVSS 4.0 9.4, Critical), 'Sandbox Escape via Table Rotation', could enable an authenticated user with the admin role to bypass Rhino sandbox restrictions and execute arbitrary code on the underlying host operating system. CVE-2026-103094 (CVSS 4.0 7.1, High) could cause a user's plaintext password to be persisted in a system table, exposing it to a user not otherwise entitled to view it. CVE-2026-6877 (CVSS 4.0 5.3, Medium) is a domain separation bypass in the SR – CSM – Task Plan Templates Store application that could let a user with a specific role create records in domains they cannot access. ServiceNow says it deployed an update to hosted instances, provided the update to partners and self-hosted customers, and is not currently aware of malicious exploitation. The knowledge base article itself did not render for the desk; details here are from ServiceNow's CVE records. (source: ServiceNow CVE records via cve.org)

Product
ServiceNow AI Platform (CVE-2026-103093, CVE-2026-103094); SR – CSM – Task Plan Templates Store application (CVE-2026-6877)
Versions
Per ServiceNow's CVE records (as of 31 Oct), affected versions are earlier than: CVE-2026-103093 — Yokohama Patch 13 Hot Fix 4a, Zurich Patch 10 Hot Fix 3b, Zurich Patch 12, Zurich Patch 13, Australia Patch 5; CVE-2026-103094 — Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 13 Hot Fix 4a, Zurich Patch 10 Hot Fix 3a, Zurich Patch 11 Hot Fix 1, Zurich Patch 11m (m-branch), Zurich Patch 12, Zurich Patch 13, Australia Patch 2 Hot Fix 3b, Australia Patch 4 Hot Fix 1, Australia Patch 4m (m-branch), Australia Patch 5; CVE-2026-6877 — SR - CSM - Task Plan Templates v3.0. Hosted instances: updated by ServiceNow.
CVSS
(CVSS 4.0, ServiceNow CNA) for CVE-2026-103093; 7.1 for CVE-2026-103094; 5.3 for CVE-2026-6877
Exploited in Australia?
unknown
Patch to
Hosted customers: confirm your instance has received ServiceNow's update. Self-hosted customers and partners: apply the update ServiceNow provided under KB3228994, moving to the patch or hot fix level named in the CVE records for your family (Xanadu, Yokohama, Zurich or Australia). Until patched, review who holds the admin role, and check system tables for stored plaintext credentials and rotate any found.

Primary: CVE-2026-103093 record (ServiceNow CNA) — Sandbox Escape via Table Rotation in ServiceNow AI Platform (published 29 Oct 2026 UTC) · Vendor: ServiceNow — KB3228994 [Security Advisory] October 2026 CVE Advisory Notification · CVE: CVE-2026-103093, CVE-2026-103094, CVE-2026-6877 · CVE-2026-103094 record (ServiceNow CNA) — Cleartext Storage of OAuth Credentials in ServiceNow AI Platform

vulnerabilities cloud ai

Vulnerability
Published 2026-10-29 New
Verified 2026-11-02

Synology warns attackers are exploiting a DSM vulnerability patched in December 2024 to encrypt data on NAS devices running outdated DSM; update DSM now (Synology-SA-24:20)

Synology said in a notice dated 29 October 2026 that it has identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DiskStation Manager (DSM), in attacks that aim to encrypt data and extort ransom. Synology strongly urges all users running vulnerable versions to update DSM immediately, recommends enabling automatic updates, and refers customers to its advisory Synology-SA-24:20. That advisory, rated Critical by Synology (published 5 Nov 2024, last updated 28 Mar 2025), covers three flaws: CVE-2024-10441 (remote code execution in the system plugin daemon, CVSS 9.8), CVE-2024-50629 (limited file read, 5.3) and CVE-2024-10445 (limited file write, 4.3). Synology has not said which of the three is being exploited. (source: Synology) According to BleepingComputer, the attacks deploy C3RB3R ransomware, Shadowserver tracks more than 380,000 internet-exposed Synology NAS devices, and users are advised to block internet access to the DSM management web interface.

Product
Synology DiskStation Manager (DSM) on Synology NAS devices
Versions
Fixed releases per Synology-SA-24:20 (as of 02 Nov 2026): DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7 and 6.2.4-25556-8 or above; earlier builds of each branch are affected. The CVE descriptions also list Synology BeeStation OS (BSM) before 1.1-65374. Synology has not said which SA-24:20 flaw is exploited.
CVSS
Synology-SA-24:20 rated Critical by Synology; CVE-2024-10441 9.8 Critical (CVSS 3.1, Synology)
Exploited in Australia?
unknown
Patch to
Update DSM immediately to the latest release for your branch, at least DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7 or 6.2.4-25556-8 per Synology-SA-24:20, and enable automatic updates (Synology). BleepingComputer also advises blocking internet access to the DSM management web interface.

Primary: Synology — Synology urges users to update DSM following ransomware attacks on outdated DSM versions (29 Oct 2026) · Vendor: Synology — Synology-SA-24:20 DSM (PWN2OWN 2024) (published 5 Nov 2024, last updated 28 Mar 2025) · CVE: CVE-2024-10441, CVE-2024-50629, CVE-2024-10445 · BleepingComputer (02 Nov 2026)

vulnerabilities

Vulnerability
Published 2026-10-29
Updated 2026-11-03
Verified 2026-11-03

Android 'SMS of Death': one malformed WAP Push text crashes the phone process and drops calls, including emergency calls, with no user action; Google's November 2026 bulletin lists it as Critical CVE-2026-58882, fixed at patch level 2026-11-01 for Android 14 to 17; Android 12 and 13 get no fix, and a public proof-of-concept is out

Researcher Mark B (GitHub: MarkBlah) published a write-up on 29 October 2026 at smsofdeath.com of 'SMS of Death', a zero-click remote denial-of-service flaw in Android's telephony framework (WapPushOverSms, frameworks/opt/telephony). The researcher says WapPushOverSms.decodeWapPdu() reads a WAP Push header length, casts it to a signed 32-bit integer with no range check and uses it as an array size, so an eight-byte message (01 06 88 80 80 80 00 BE) sent as a data SMS to port 2948 throws an uncaught NegativeArraySizeException that kills com.android.phone. Per the researcher, the message never appears in the inbox, active calls drop (including emergency calls), each message causes 1-2 seconds without service, carrier redelivery re-crashes the phone, about 20 messages can make a device unusable for an extended period, and the queued message can crash the phone on every boot; on an Android 12 test device this produced a reboot into recovery roughly every 90 seconds. The researcher says the crash was reproduced from Android 12 up to Android 16 on Pixel and Samsung Galaxy devices, that it was reported to Google on 5 May 2026, and that Google's fix (commit 735d967, 'Fix remote DoS in decodeWapPdu', authored 15 June 2026) catches the exception and deletes the triggering message; it shipped in the October 2026 Android security release for Android 14 through 17, so Android 12 and 13 devices do not receive it. A recovery method over ADB (deleting the queued rows from content://sms/raw), credited to @sakisdog, is on the site. The researcher has published a working proof-of-concept app and source on GitHub. BleepingComputer reported on 31 October (11:35 pm Perth) that the flaw is tracked as CVE-2026-58882 and is not listed in Google's October 2026 Android security bulletin; the bulletin, read by this desk, does not list CVE-2026-58882. (sources: smsofdeath.com; GitHub MarkBlah/smsofdeath; BleepingComputer) UPDATE (3 Nov 2026, Perth; Android Security Bulletin): Google's Android Security Bulletin for November 2026, published 2 November, lists CVE-2026-58882 (Android bug A-517376969) as a Critical denial-of-service flaw in the System component, with updated AOSP versions Android 14, 15, 16, 16 QPR2 and 17, fixed at security patch level 2026-11-01; the bulletin does not flag it as exploited. The researcher had said the fix shipped in the October 2026 release; Google's bulletin places it at the November 2026-11-01 patch level. (source: Android Security Bulletin)

Product
Android telephony framework (WapPushOverSms / com.android.phone)
Versions
Google (November 2026 bulletin): CVE-2026-58882, Critical DoS, updated AOSP versions 14, 15, 16, 16 QPR2 and 17, fixed at patch level 2026-11-01. Researcher: reproduced on Android 12 to 16; fix shipped in the October 2026 security update for Android 14 to 17; Android 12 and 13 receive no fix
CVSS
n/a
Exploited in Australia?
unknown
Patch to
Install security patch level 2026-11-01 or later (the level at which Google's November 2026 bulletin lists CVE-2026-58882) on Android 14 to 17 devices; updates come through the phone maker and carrier and may need a restart. Android 12 and 13 phones get no fix, so plan to replace them.

Primary: smsofdeath.com — SMS of Death: zero-click Android telephony DoS (researcher write-up, disclosed 29 Oct 2026) · Vendor: GitHub — MarkBlah/smsofdeath (proof-of-concept app and source) · CVE: CVE-2026-58882 · BleepingComputer — New Android SMS of Death exploit can remotely crash unpatched phones (31 Oct 2026, 11:35 pm Perth) · Android Security Bulletin — November 2026 (published 2 Nov 2026)

vulnerabilities

Vulnerability
Published 2026-10-29
Verified 2026-10-30

Chrome 156.0.8078.79/.80 (29 Oct): 21 security fixes including a Critical memory-corruption bug in MediaStream (CVE-2026-76024); no exploitation noted

Google's Chrome Releases blog says the Stable and Extended Stable channels were updated on 29 October 2026 to 156.0.8078.79/.80 for Windows and Mac and 156.0.8078.79 for Linux, rolling out over the coming days and weeks, with 21 security fixes: one Critical, 19 High and one Medium. The Critical bug is CVE-2026-76024, memory corruption in MediaStream, reported by Xinyang Ge on 21 October. High-rated fixes include use-after-free and memory-corruption bugs in FileSystem, Autofill, CacheStorage, Network, Input, Frames, Skia, V8, GarbageCollection, Dawn, Quota, DOM, Editing and Blink; Google is credited with 12 of the 21 bugs. Google does not say any of the flaws is exploited and does not publish CVSS scores; bug details stay restricted until most users have updated. Chrome 156.0.8078.79 for Android, released the same day, contains the same security fixes as the desktop release unless otherwise noted. This follows the 156.0.8078.73/.74 update of 27 October, which is a separate card. (source: Chrome Releases)

Product
Google Chrome desktop (Windows, Mac, Linux; Stable and Extended Stable) and Chrome for Android
Versions
Fixed: Chrome 156.0.8078.79/.80 (Windows, Mac), 156.0.8078.79 (Linux, Android). Earlier builds are affected.
CVSS
not published by Google; one flaw rated Critical by Chrome
Exploited in Australia?
unknown
Patch to
Update Chrome to 156.0.8078.79 or later and relaunch the browser (Android: 156.0.8078.79 from Google Play). Managed fleets: confirm the update has applied and users have restarted, and watch for matching Edge, Brave, Opera and Electron releases built on Chromium 156.

Primary: Chrome Releases — Stable Channel Update for Desktop, Chrome 156.0.8078.79/.80 (29 Oct 2026) · Vendor: Chrome Releases — Chrome for Android Update, 156.0.8078.79 (29 Oct 2026) · CVE: CVE-2026-76024

vulnerabilities

Vulnerability
Published 2026-10-29
Verified 2026-10-30

Veeam Management Pack for Microsoft System Center 13.1 (KB4961, 29 Oct) fixes three remote code execution flaws, one Critical and unauthenticated (CVE-2023-22793, CVSS 4.0 9.3); no fix for version 9.x

Veeam published KB4961, 'Vulnerabilities Resolved in Veeam Management Pack for Microsoft System Center 13.1', on 29 October 2026. It lists three vulnerabilities, all fixed starting in Veeam Management Pack for Microsoft System Center 13.1 (build 13.1.0.334). CVE-2023-22793 (Critical, CVSS v4.0 9.3) is "A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center." CVE-2026-107238 (High, 8.7) allows "an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account" on servers running the Collector service, and CVE-2026-107239 (High, 8.8) allows "a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE)" on servers running the Collector service. Affected: Veeam Management Pack for Microsoft System Center 9.1 and all earlier version 9 builds, including the Veeam Backup & Replication 13 compatibility patch. Veeam says: "A fix will not be provided for version 9.x. Customers running version 9.x should upgrade to 13.1.0.334." Veeam lists all three as discovered during internal testing; KB4961 does not mention exploitation. (source: Veeam KB4961)

Product
Veeam Management Pack for Microsoft System Center (Virtualization Extensions service; Collector service)
Versions
Affected: 9.1 and all earlier version 9 builds, including the Veeam Backup & Replication 13 compatibility patch. Fixed: 13.1 (build 13.1.0.334). No fix for 9.x.
CVSS
(CVSS v4.0, Critical, Veeam) for CVE-2023-22793; 8.7 and 8.8 (High) for CVE-2026-107238 and CVE-2026-107239
Exploited in Australia?
unknown
Patch to
Upgrade Veeam Management Pack for Microsoft System Center to 13.1 (build 13.1.0.334). Veeam will not fix version 9.x, so 9.x users must move to 13.1. Until then, limit network access to the servers running the Virtualization Extensions and Collector services, and review membership of the Veeam Virtualization Extensions Users group.

Primary: Veeam — KB4961: Vulnerabilities Resolved in Veeam Management Pack for Microsoft System Center 13.1 (published 29 Oct 2026) · CVE: CVE-2023-22793, CVE-2026-107238, CVE-2026-107239 · CVE record — CVE-2026-107238 (CNA: HackerOne) · CVE record — CVE-2026-107239 (CNA: HackerOne)

vulnerabilities

Vulnerability
Published 2026-10-29
Updated 2026-10-30
Verified 2026-10-30

Cisco ASA and FTD: exploited denial-of-service flaw CVE-2026-76418 (CVSS 8.6) lets an unauthenticated remote attacker reload firewalls through the SSL remote access VPN when secondary authentication is configured; fixed releases out, no workarounds

Cisco published security advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 on 28 October 2026 at 19:15 GMT (29 October 03:15 Perth) for CVE-2026-76418, a vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software that, Cisco says, could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service. Cisco says the flaw is due to logic errors when secondary authentication is configured on a tunnel group and can be exploited by sending a crafted request when connecting to the SSL remote access VPN; it notes that a successful VPN login is not required to reach the affected processing path. Devices are affected if they run a vulnerable ASA or FTD release, the SSL remote access VPN login service is reachable, and secondary authentication is configured in the tunnel group scope (including the default tunnel group, DefaultWEBVPNGroup). Cisco rates the advisory High (CVSS 3.1 base 8.6) and says: "In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability." Cisco says there are no workarounds, only a mitigation, and strongly recommends upgrading to a fixed release. Cisco credits Eric Fernald, who found the flaw while resolving a Cisco TAC support case. (source: Cisco) According to BleepingComputer, Cisco did not provide indicators of compromise or say who is exploiting the flaw. (source: BleepingComputer) UPDATE (30 Oct 2026, Perth; CISA): CISA added CVE-2026-76418 ("Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability") to its Known Exploited Vulnerabilities catalog on 29 October 2026 based on evidence of active exploitation, with a remediation due date of 1 November 2026 for US federal civilian agencies. Cisco's advisory was still at version 1.0 when re-read on 30 October (Perth), with the same first fixed releases. (source: CISA; Cisco)

Product
Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense (FTD) Software with SSL remote access VPN enabled and secondary authentication configured on a tunnel group
Versions
First fixed releases (Cisco advisory, as of 29 Oct): ASA 9.16 and earlier → 9.16.4.104; 9.18 → 9.18.4.96; 9.20 → 9.20.4.50; 9.22 → 9.22.3.200; 9.23 → 9.23.1.48; 9.24 → 9.24.1.27 / 9.24.10.1. FTD 7.0 and earlier → 7.0.11; 7.2 → 7.2.13; 7.4 → 7.4.9; 7.6 → 7.6.7; 7.7 → 7.7.14; 10.0 → 10.0.3; 10.1 → 10.1.1.
CVSS
(Cisco, CVSS 3.1; High)
Exploited in Australia?
unknown
Patch to
Upgrade to the first fixed ASA or FTD release in Cisco's table. Cisco lists no workarounds; as a temporary mitigation it says to disable secondary authentication on any user-configured tunnel group list or on DefaultWEBVPNGroup: if DefaultWEBVPNGroup does not use secondary authentication, enter no tunnel-group-list enable in WebVPN configuration mode; if it does, remove it with no secondary-authentication-server-group (Cisco notes this lowers the security posture of remote access VPN). On FTD, review the deployed remote access VPN policy and running configuration in Secure FMC or FDM.

Primary: Cisco Security Advisory — Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability (cisco-sa-asaftd-tunnel-dos-s6mgkb75; first published 28 Oct 2026 19:15 GMT) · CVE: CVE-2026-76418 · BleepingComputer — New Cisco firewall zero-day exploited to crash SSL VPN devices · CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog (29 Oct 2026)

vulnerabilities network

Vulnerability
Published 2026-10-28 New
Verified 2026-10-24

Linux Kernel (CVE-2026-46300)

Linux Kernel Missing Initialization of a Variable Vulnerability. Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.

Product
Linux Kernel
Exploited in Australia?
unknown

Primary: NVD · Vendor: CISA KEV · CVE: CVE-2026-46300, CVE-2026-109618, CVE-2026-109619

vulnerabilities

Vulnerability
Published 2026-10-28 New
Updated 2026-11-02
Verified 2026-11-02

IBM Langflow OSS bulletin (28 Oct): unauthenticated authentication bypass CVE-2026-93680 and code injection CVE-2026-110186 (CVSS 9.8) in Langflow 1.0.0 to 1.12.8; upgrade to 1.13.0

IBM, the CVE numbering authority for Langflow OSS, published a security bulletin on 28 October 2026 (updated 29 October) saying Langflow OSS 1.0.0 through 1.12.8 is affected by vulnerabilities that could allow a remote attacker to bypass authentication controls, execute arbitrary code, expose API credentials, or disclose information through vulnerable dependencies. IBM lists an incomplete remediation of an auto-login security control, agentic code execution via a third-party library, operator-injected API key exposure reachable without intended authorization, and unauthenticated remote code execution exploitable through model context protocol (MCP) tool enumeration. The Langflow entries are CVE-2026-93680 (improper authentication, 9.8), CVE-2026-110186 (code injection, 9.8), CVE-2026-110193 (a low-privileged authenticated user can make the Agentic Assistant generate or submit component code that runs operating system commands on the server, 8.8) and CVE-2026-110192 (insufficiently protected credentials, 6.5); the bulletin also lists three Hono framework flaws (CVE-2026-84363, CVE-2026-84364, CVE-2026-84365; 5.3 to 6.5, fixed in Hono 4.13.5) among the open-source dependencies included in the product. IBM lists no workarounds or mitigations. This is a separate fix from IBM's 2 October Langflow bulletin already on Cyberstack (fixed in 1.12.3), so 1.12.x installs up to 1.12.8 are affected. (source: IBM) Correction (02 Nov 2026): removed The Hacker News as a source; the card now rests on IBM's 28 Oct bulletin and the CVE records carrying CISA's 30 Oct assessment. (source: IBM; CVE records)

Product
Langflow OSS (IBM; open-source AI agent and workflow builder)
Versions
Affected: Langflow OSS 1.0.0 - 1.12.8 (IBM bulletin and CVE records). Fixed: 1.13.0 (IBM, as of 02 Nov 2026).
CVSS
Critical (CVE-2026-93680 and CVE-2026-110186, CVSS 3.1, IBM); CVE-2026-110193 8.8; CVE-2026-110192 6.5
Exploited in Australia?
unknown
Patch to
Upgrade Langflow OSS 1.0.0 - 1.12.8 to 1.13.0 (IBM): review the 1.13.0 release notes, then pip install --upgrade "langflow==1.13.0" for the Python package, or use the langflowai/langflow:1.13.0 Docker image and restart while preserving persistent data. IBM lists no workarounds.

Primary: IBM — Security Bulletin: Langflow OSS is affected by multiple vulnerabilities (28 Oct 2026, updated 29 Oct 2026) · Vendor: CVE-2026-93680 — IBM Langflow OSS improper authentication (CVE record, IBM as CNA; CISA assessment dated 30 Oct 2026) · CVE: CVE-2026-93680, CVE-2026-110186, CVE-2026-110193, CVE-2026-110192, CVE-2026-84363, CVE-2026-84364, CVE-2026-84365 · CVE-2026-110186 — IBM Langflow OSS code injection (CVE record, IBM as CNA; CISA assessment dated 30 Oct 2026)

tech ai

Vulnerability
Published 2026-10-28
Updated 2026-11-02
Verified 2026-11-02

Canonical LXD and MicroCloud CVE-2026-112816 (CVSS 4.0 10.0): attacker who can reach the HTTPS API can authenticate as any trusted client using only its public certificate — update the lxd and microcloud snaps

Canonical said in a security advisory dated 28 October 2026 that a critical vulnerability affecting LXD and MicroCloud, referred to it by the Incus project, allows an attacker able to reach the LXD HTTPS API to authenticate as any trusted TLS client for which the attacker has the public certificate. Canonical says the mutual TLS authentication logic compared all certificates sent by the client against the trust store, although only the leaf certificate proves ownership of the signing key, so an attacker could place a trusted client's public certificate as an intermediate certificate in the chain. In MicroCloud, Canonical says an attacker can intercept the public TLS certificate of a joining cluster member and then authenticate as that member, and that depending on the privilege of the impersonated user the attacker may gain root access to the host machine. Canonical urges all LXD and MicroCloud users to update immediately and says the LXD point releases are in progressive roll-out from candidate to stable. (source: Canonical) The CVE record, published by Canonical as CNA, lists affected LXD versions 4.0.14, 5.0.10, 5.21.8 and 6.9 before 4.0.15, 5.0.11, 5.21.9 and 6.10.1, rates the flaw CVSS 4.0 10.0 (Critical), and carries a CISA assessment dated 30 October 2026 of exploitation: none. (source: CVE record) Correction (02 Nov 2026): removed The Hacker News as a source. (source: Ubuntu Discourse; CVE record)

Product
Canonical LXD and MicroCloud (HTTPS API, mutual TLS authentication)
Versions
Affected (CVE record): LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1. Fixed snaps (Canonical, as of 02 Nov 2026): lxd 6.10.1 (6/stable), 5.21.9 (5.21/stable), 5.0.11 (5.0/stable), 4.0.15 (4.0/stable); microcloud 3.4.1 (3/stable), 2.1.5 (2/stable), each released 29 Oct 2026.
CVSS
Critical (CVSS 4.0, CVE record)
Exploited in Australia?
unknown
Patch to
Run sudo snap refresh lxd and sudo snap refresh microcloud to reach lxd 6.10.1, 5.21.9, 5.0.11 or 4.0.15 and microcloud 3.4.1 or 2.1.5 in your channel (Canonical). Canonical says the LXD point releases are rolling out progressively from candidate to stable, so check the installed version after refreshing.

Primary: Ubuntu Discourse — Security advisory: Critical vulnerability found in Canonical LXD and MicroCloud (28 Oct 2026) · Vendor: CVE-2026-112816 — Improper certificate validation in the HTTPS listener in LXD (CVE record, Canonical as CNA) · CVE: CVE-2026-112816

vulnerabilities cloud

Vulnerability
Published 2026-10-28
Updated 2026-11-02
Verified 2026-11-02

Drupal Commerce Core CVE-2026-118539 (SA-CONTRIB-2026-254, rated Highly critical by Drupal): access bypass that may financially impact the vendor is being actively exploited; upgrade to Commerce Core 3.3.13 or 8.x-2.41 and audit orders

The Drupal Security Team published advisory SA-CONTRIB-2026-254 on 28 October 2026 for Commerce Core, the Drupal module for selling goods and services through a shopping cart and checkout form or through decoupled applications via APIs. Drupal says the module "doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor", tracked as CVE-2026-118539, and that "this vulnerability is being actively exploited in the wild." It rates the advisory Highly critical (Drupal risk score 21/25) and lists affected versions as <2.41 and >=3.0.0 <3.3.13. Drupal says sites on 3.x should upgrade to Commerce Core 3.3.13, sites on earlier versions to Commerce Core 8.x-2.41, and that sites should audit their orders for inconsistencies. It credits Dan Puccetti, Marcus Johansson and Robert Snyder with reporting the flaw. (source: Drupal) UPDATE (31 Oct 2026): The CVE record for CVE-2026-118539, with Drupal as CNA, was published on 30 October (11:09 am Perth). It describes a missing authorization vulnerability in Commerce Core that allows forceful browsing, affecting versions before 2.41 and from 3.0.0 before 3.3.13. Drupal gives no CVSS score in the record; CISA's ADP enrichment, added at 11:56 am Perth on 31 October, scores it CVSS 3.1 6.5 (Medium) and lists exploitation as 'none' as of 30 October, while Drupal's advisory says the flaw is being actively exploited. CVE-2026-118539 was not in CISA's KEV catalog as of its 30 October release (version 2026.10.30). (source: CVE-2026-118539 record (cve.org)) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Drupal; CVE record)

Product
Drupal Commerce Core module (machine name: commerce)
Versions
Affected (Drupal, as of 30 Oct): <2.41 || >=3.0.0 <3.3.13. Fixed: Commerce Core 3.3.13 (3.x) and Commerce Core 8.x-2.41 (earlier versions).
CVSS
no CVSS from Drupal; CISA's ADP enrichment in the CVE record (31 Oct) scores it CVSS 3.1 6.5 (Medium; AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Drupal rates it Highly critical, risk score 21/25 (AC:None/A:None/CI:Some/II:Some/E:Exploit/TD:All), which is not a CVSS score
Exploited in Australia?
unknown
Patch to
Upgrade to Commerce Core 3.3.13 if you run 3.x, or Commerce Core 8.x-2.41 if you run an earlier version, as Drupal's advisory states. Because Drupal says the flaw is being actively exploited, audit your orders for inconsistencies, as the advisory advises.

Primary: Drupal.org — Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254 (28 Oct 2026) · Vendor: Drupal Security Team — SA-CONTRIB-2026-254 · CVE: CVE-2026-118539 · CVE Program — CVE-2026-118539 record (CNA: Drupal; published 30 Oct 2026; CISA-ADP CVSS 3.1 6.5 added 31 Oct)

vulnerabilities

Vulnerability
Published 2026-10-28
Updated 2026-11-02
Verified 2026-11-02

WordPress 7.1.4 security release (28 Oct): fixes an upgrade-process weakness that can lead to remote code execution, multiple stored XSS bugs and an unauthenticated changeset disclosure

WordPress.org released WordPress 7.1.4 on 28 October 2026 as a security release and recommends that sites update immediately; sites with automatic background updates will update automatically. The release post credits reporters for: a weakness in the WordPress upgrade process that can lead to remote code execution during the upgrade window (Umut Bayram); several stored cross-site scripting (XSS) bugs, including in specially crafted block markup, the Interactivity API, Customizer selective refresh, the Categories, Playlist, image and comments-pagination blocks, Privacy Data Removal Requests and specially crafted user logins (the last two reported by Anthropic); a stored denial-of-service issue in the Interactivity API; unpublished Customizer changesets that unauthenticated users can discover; and Notes that privileged users can read without access to edit the attached post. The release also updates the bundled root certificates because of the eMudhra revocation. WordPress says the security fixes are being backported to all branches eligible for security fixes (currently back to 4.7) and will ship as they become ready, and that WordPress 7.2 Beta 3 contains all applicable fixes. The post does not give CVE numbers or severity scores and does not say any of the flaws is being exploited. (source: WordPress.org) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: WordPress.org)

Product
WordPress core
Versions
Fixed: WordPress 7.1.4 (and 7.2 Beta 3). Backports to older branches back to 4.7 in progress, per WordPress.
CVSS
not published by WordPress
Exploited in Australia?
unknown
Patch to
Update to WordPress 7.1.4 now from Dashboard > Updates, or confirm automatic background updates have applied it. Sites on older branches should take the backported release for their branch when it ships, or move to 7.1.4. Restrict who can create accounts and edit content until updated, since several fixes concern stored XSS.

Primary: WordPress.org News — WordPress 7.1.4 (28 Oct 2026)

vulnerabilities

Vulnerability
Published 2026-10-28
Verified 2026-10-29

Sophos UTM (all versions; end-of-life): pre-auth path traversal lets a remote attacker run commands as root when the email proxy is used with scanning enabled (CVE-2026-118633, Sophos: Critical); the patch must be installed manually

Sophos published an advisory on 28 October 2026, rated Critical, for CVE-2026-118633, a path traversal vulnerability in Sophos UTM reported through its bug bounty program by external researcher Sam Pizzey. Sophos says the fix prevents an unauthenticated remote adversary from executing arbitrary commands with root privileges after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos says all versions of Sophos UTM are affected, that UTM is end-of-life and the patch must be installed manually, and that urgent customer action is required: customers still using Email Protection features on UTM should apply the patch as soon as possible. Sophos lists no workaround and recommends upgrading to a supported version of Sophos Firewall. Sophos's CVE record scores the flaw 9.2 (CVSS 4.0, Critical) and 8.1 (CVSS 3.1, High) and lists SG UTM versions up to and including 9.724 as affected. The advisory does not mention exploitation. (source: Sophos)

Product
Sophos UTM (SG UTM), email proxy with scanning enabled
Versions
Affected (Sophos, as of 29 Oct): Sophos UTM, all versions (CVE record: SG UTM up to and including 9.724). Fix: a manually installed patch (Sophos KBA-000049692); Sophos also advises upgrading to a supported version of Sophos Firewall.
CVSS
(CVSS 4.0, Sophos CNA; Critical); 8.1 (CVSS 3.1, Sophos CNA; High)
Exploited in Australia?
unknown
Patch to
Install the manual UTM patch following Sophos's instructions in KBA-000049692 (https://support.sophos.com/support/s/article/KBA-000049692?language=en_US), as soon as possible if you still use UTM Email Protection; UTM is end-of-life, so plan the move to a supported version of Sophos Firewall, which is the remediation Sophos lists.

Primary: Sophos — Resolved Pre-Auth RCE Vulnerability in Sophos UTM (CVE-2026-118633) (sophos-sa-20261028-utm-rce, 28 Oct 2026) · Vendor: Sophos Security Advisory sophos-sa-20261028-utm-rce · CVE: CVE-2026-118633 · CVE record — CVE-2026-118633

vulnerabilities network

Vulnerability
Published 2026-10-28
Updated 2026-10-29
Verified 2026-10-29

Cisco Talos: UAT-11473 exploited Catalyst SD-WAN flaw CVE-2026-20127 (CVSS 10.0) to install 'KeyDrift' malware built to collect keying material; Cisco's advisory now points to the research

Cisco's security advisory for CVE-2026-20127 (cisco-sa-sdwan-rpa-EHchtZk; first published 25 February 2026; version 2.1, last updated 28 October 21:54 GMT, which is 29 October 05:54 Perth) says a vulnerability in the peering authentication of Cisco Catalyst SD-WAN Controller, Manager and Validator could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges; it says the Cisco PSIRT is aware of limited exploitation, lists no workarounds and now refers customers to a Talos post. (source: Cisco) Cisco Talos said on 28 October 2026 that it has identified UAT-11473, which it describes as a highly sophisticated advanced persistent threat actor, exploiting CVE-2026-20127, an authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller instances, to gain unauthorized access and then install a custom malware framework it tracks as KeyDrift. Talos describes its post as an analysis of historical UAT-11473 activity and does not give dates for the intrusions. According to Talos, KeyDrift's primary component, PolyFlame, is a memory-resident module deployed through modified runit service paths and injected into legitimate vdaemon processes, where it can act as a TinyShell-style backdoor or as an intermediate command-and-control relay; another component, LittleFilch, hooks SSL_read inside vdaemon, extracts keying material for a list of predefined edge nodes (which Talos assesses as OMP-distributed AES-256 IPsec data-plane key material) and stages it RSA-encrypted in /var/tmp/vdaemon.bin for exfiltration. Talos says observed targeting spans space and satellite services, defense and aerospace technology, and policy research, and assesses with high confidence that UAT-11473's operating infrastructure overlaps considerably with Volt Typhoon's 'Silent Train' covert access network (see the Silent Train card). Talos published Snort rules 67387 through 67416 (Snort 2) and 7:44 through 7:73 (Snort 3) for the KeyDrift artifacts; SIDs 65938 and 65958 already cover the CVE itself. (source: Cisco Talos) CISA has listed CVE-2026-20127 in its Known Exploited Vulnerabilities catalog since 25 February 2026. (source: CISA KEV)

Product
Cisco Catalyst SD-WAN Controller (formerly vSmart), Manager (formerly vManage) and Validator (formerly vBond)
Versions
First fixed releases (Cisco advisory, as of 29 Oct): earlier than 20.9 → migrate to a fixed release; 20.9 → 20.9.8.2; 20.11 → 20.12.6.1; 20.12 → 20.12.5.3 / 20.12.6.1; 20.13, 20.14 and 20.15 → 20.15.4.2; 20.16 and 20.18 → 20.18.2.1. Cisco says releases earlier than 20.9 and the 20.11, 20.13, 20.14 and 20.16 releases have reached End of Software Maintenance.
CVSS
(Cisco, CVSS 3.1; Critical)
Exploited in Australia?
unknown
Patch to
Upgrade to the first fixed release in Cisco's table (no workarounds). Talos recommends applying Cisco's patches, following Cisco's Catalyst SD-WAN hardening guide and monitoring for post-compromise activity; if you find signs of unauthorized activity, activate incident response and open a Cisco TAC request. File locations Talos names for KeyDrift include a modified sshd run script under etc/sv/sshd/, a fake service under /etc/sv/aaamgr/, libdssl.so, libcommon.so, /tmp/system-vdaemon, /var/tmp/vdaemon.bin and /var/tmp/vdaemon.conf.

Primary: Cisco Security Advisory — Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability (cisco-sa-sdwan-rpa-EHchtZk; first published 25 Feb 2026, v2.1 updated 28 Oct 2026 GMT) · CVE: CVE-2026-20127 · Cisco Talos — Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN (28 Oct 2026) · CISA — Known Exploited Vulnerabilities Catalog (CVE-2026-20127, added 25 Feb 2026)

vulnerabilities network

Vulnerability
Published 2026-10-28
Updated 2026-10-29
Verified 2026-10-29

VMware ESX CVE-2026-41709 (Broadcom: Low, CVSS 2.7) insufficient logging lets a malicious admin act without being logged — In CISA KEV since 28 Oct

CISA added CVE-2026-41709, a Broadcom VMware ESX insufficient logging vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog on 28 October 2026 based on evidence of active exploitation; the KEV entry gives US federal agencies a due date of 11 November and lists known ransomware campaign use as 'Unknown'. Broadcom's advisory VMSA-2026-0006 (issued 29 July 2026, updated 19 August) says VMware ESX contains an insufficient logging vulnerability that a malicious administrator could exploit to perform certain operations without them being logged; Broadcom rates it Low severity with a maximum CVSSv3 base score of 2.7 and credits Ian Barton of CrowdStrike for reporting it. Broadcom lists no workaround. The same advisory also covers the critical vCenter flaws CVE-2026-59309 and CVE-2026-59310 (see the CVE-2026-59310 card). CISA's alert does not say who exploited the flaw or how. UPDATE (29 Oct 2026, Perth; CrowdStrike): In a blog post dated 28 October on its 2026 Legal Threat Landscape Report, CrowdStrike says the China-nexus adversary it tracks as WARP PANDA deployed several forms of malware in victims' VMware vCenter environments in multiple intrusions at US-based entities, including targets in the legal sector, and that in several of these cases, and as late as early 2026, it exploited CVE-2026-41709, which CrowdStrike calls an ESXi command logging bypass vulnerability, as a zero-day. CISA's KEV entry does not name an actor. (source: CrowdStrike)

Product
Broadcom VMware ESX (also in VMware Cloud Foundation, vSphere Foundation and Telco Cloud Platform)
Versions
Fixed (Broadcom VMSA-2026-0006 response matrix, as of 29 Oct): ESX 9.1.x.x → ESXi-9.1.0.0-25370933; ESX 9.0.x.x → ESXi-9.0.2.0100-25595025; ESX 8.0 → ESXi80U3j-25429389; VMware Cloud Foundation 5.x → 5.2.4 (Async Patching Guide KB88287); VMware Telco Cloud Platform 5.0.x, 5.1.x → KB449886.
CVSS
(Broadcom, CVSSv3; Low)
Exploited in Australia?
unknown
Patch to
Update ESX to the fixed builds in Broadcom's VMSA-2026-0006 response matrix (ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389; VCF 5.2.4); no workaround. Because the flaw lets an administrator act without being logged, restrict and review ESX administrator access.

Primary: Broadcom — VMSA-2026-0006: VMware ESX, vCenter, Workstation, and Fusion updates address multiple vulnerabilities (CVE-2026-59309, CVE-2026-59310, CVE-2026-47876, CVE-2026-41703, CVE-2026-41709) · Vendor: Broadcom Security Advisory 38017 (VMSA-2026-0006) · CVE: CVE-2026-41709, CVE-2026-59309, CVE-2026-59310 · CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog (28 Oct 2026) · CrowdStrike — CrowdStrike 2026 Legal Threat Landscape Report: eCrime Leads Attacks, China Activity Intensifies (28 Oct 2026)

vulnerabilities cloud