Executive assessment
Today's brief leads with ARMORY CASTLE Exploits BeyondTrust. All 15 selected findings retain their own technical scope, action, observed status, and evidence limits.
Panel synthesis: Patch order: Finding 01 (CRITICAL severity with active in-the-wild exploitation by named threat actor ARMORY CASTLE; SaaS already patched 9 October but self-hosted deployments require immediate patch to 24.3.1+); Finding 02 (CRITICAL RCE actively being exploited to backdoor Nextcloud servers; richdocumentscode 26.4.303 is required; removal of the app component is mandatory); Finding 06 (HIGH severity with in-the-wild exploitation of Microsoft Office; clear patch path available to specific LTSC 2021/2024 and Mac builds); Finding 03 (CRITICAL Linux kernel vulnerability affecting VM isolation with POC available; patch versions available across all supported kernel releases).
Finding 01 — ARMORY CASTLE Exploits BeyondTrust
What changed: On October 15, BeyondTrust disclosed a vulnerability, CVE-2026-102764, impacting BeyondTrust Remote Support (formerly Bomgar) appliances. BeyondTrust Remote Support is an enterprise secure remote access solution that enables IT teams to securely access and troubleshoot remote endpoints.
Technical evidence: CVE-2026-102764; CVSS v4.0 9.3; weakness CWE-290; technical confidence Medium.
Why it matters: Reported active exploitation elevates this above routine patching: validate exposure immediately, remediate, and assess for prior compromise.
Observed status: The cited source reports active in-the-wild exploitation; independent corroboration (CISA KEV or grounded vendor data) is not yet available.
Analyst note: Restrict access to the /login and /appliance administrative interfaces by IP or network segment. Apply default-deny outbound filtering from the appliance, allowing only BeyondTrust endpoints and the organisation's own syslog and directory servers. Mandiant reports that ARMORY CASTLE exploited CVE-2026-102764 as a zero-day in late August 2026. ([cloud.google.com](https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/))
Affected: All supported Remote Support versions up to 26.2.3. ([cloud.google.com](https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/))
Fix: Remote Support SaaS was patched for all tenants on 9 October 2026; for self-hosted version 24.3.1 or later, apply the BT26-05-RS patch. ([cloud.google.com](https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/))
Panel assessment: Patch immediately: self-hosted BeyondTrust Remote Support needs BT26-05-RS for v24.3.1+ (SaaS auto-patched 9 October); CVE-2026-102764 (CRITICAL, auth bypass + file upload) was exploited as a zero-day by state-sponsored ARMORY CASTLE before disclosure, leaving unpatched instances exposed to state-actor activity. From the compromised appliance, attackers harvest credentials, hijack remote sessions, and pivot into internal systems the appliance can access. (priority: patch now)
Action: Map CVE-2026-102764 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: exploitation reported by the source, not independently corroborated
[Evidence source: cloud.google.com](https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/)
Finding 02 — Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers
What changed: Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. (Unconfirmed, single-source.)
Technical evidence: CVE-2026-110447; CVSS v4.0 9.2; weakness CWE-78; technical confidence Medium.
Why it matters: Reported active exploitation elevates this above routine patching: validate exposure immediately, remediate, and assess for prior compromise.
Observed status: The cited source reports active in-the-wild exploitation; independent corroboration (CISA KEV or grounded vendor data) is not yet available.
Analyst note: If patching is not possible, remove the Collabora Online - Built-in CODE Server app; disabling it is insufficient. The MITRE CVE record reports exploitation in the wild in September and October 2026. ([github.com](https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-110447))
Affected: richdocumentscode versions earlier than 26.4.303. ([github.com](https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh))
Fix: richdocumentscode 26.4.303. ([github.com](https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh))
Panel assessment: Unpatched Nextcloud servers with richdocumentscode < 26.4.303 face remote code execution via OS command injection (CWE-78, CVSS 9.2); active exploitation is documented in September–October 2026. This provides code execution on the Nextcloud host, reaching stored credentials, file data, and any connected services. If richdocumentscode is installed, upgrade to ≥ 26.4.303 or remove entirely—disabling the app does not mitigate the flaw. (priority: patch now)
Action: Map CVE-2026-110447 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: exploitation reported by the source, not independently corroborated
[Evidence source: bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/)
Finding 03 — Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory
What changed: A researcher demonstrated the leak against Vercel's live cloud sandboxes.
Technical evidence: CVE-2026-99999; CVSS v3.1 9.3; technical confidence Medium.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Vercel reports that the researcher demonstrated crash and code-execution attacks on KVM and Firecracker machines matching its Sandbox configuration. ([vercel.com](https://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-99999))
Affected: Linux kernel 2.6.27 and later releases before the applicable fixed branch release. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-99999))
Fix: Linux 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57, 7.2.11 and 7.3-rc7. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-99999))
Panel assessment: Patch immediately: publicly available POC (demonstrated on Vercel's infrastructure) enables guest VMs to read host kernel memory through a networking code flaw, breaking the hypervisor security boundary for all vulnerable Linux versions. An attacker with code execution in a guest VM can directly extract host kernel memory, compromising encryption keys, privileged credentials, and data from co-resident VMs. (priority: patch now)
Action: Map CVE-2026-99999 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: thehackernews.com](https://thehackernews.com/2026/10/critical-pwnescape-linux-kernel.html)
Finding 04 — Windows Rich Text Edit Control Remote Code Execution Vulnerability
What changed: Microsoft is announcing the availability of the security updates for Microsoft Office for Mac. Customers running affected Mac software should install the update for their product to be protected from this vulnerability.
Technical evidence: CVE-2026-70096; CVSS v3.1 9.8; weakness CWE-122; technical confidence Medium.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Microsoft reports that the vulnerability was not publicly disclosed, is not exploited, and that exploitation is unlikely. ([api.msrc.microsoft.com](https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-70096), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-70096))
Affected: Microsoft lists affected ranges for Microsoft 365 Apps for Enterprise from 16.0.1; Office LTSC 2021 from 16.0.1; Office LTSC 2024 from 16.0.0; Office 365 for Mac from 1.0.0. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-70096))
Fix: Microsoft lists these excluded upper-bound builds: Office LTSC 2021 16.0.14334.20974; Office LTSC 2024 16.0.17932.21056; Office 365 and Office LTSC for Mac 16.114.26101123. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-70096))
Panel assessment: CVSS 9.8 critical affecting every Windows version from Vista-era Server 2012 through 26H2 and all Office editions—patch this week to eliminate a high-impact RCE surface, though Microsoft reports no current exploitation and rates further exploitation unlikely. Heap-based buffer overflow in Rich Text Edit Control exploitable through RTF document processing (email, Office) to arbitrary code execution and credential/data access. (priority: this week)
Action: Map CVE-2026-70096 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: go.microsoft.com](https://go.microsoft.com/fwlink/p/?linkid=831049)
Finding 05 — Argo CD: Incorrect Authorization
What changed: GitHub Advisory Database published GHSA-fmxq-cgp8-87wp for CVE-2026-77459 (Argo CD): Incorrect Authorization, CVSS v3.1 9.9; affected: versions >= 2.10.0, <= 2.14.21 and >= 3.0.0, < 3.3.15.
Technical evidence: CVE-2026-77459; CVSS v3.1 9.9; weakness CWE-863; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Restrict write access to Git repositories backing Applications in restrictive AppProjects, and limit who can delete Applications. Tighten the application-controller's Kubernetes access so hooks cannot reach sensitive namespaces or APIs. CISA's SSVC assessment reports exploitation as 'none'. ([github.com](https://github.com/argoproj/argo-cd/security/advisories/GHSA-fmxq-cgp8-87wp), [services.nvd.nist.gov](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-77459))
Affected: versions >= 2.10.0, <= 2.14.21 and >= 3.0.0, < 3.3.15 ([services.nvd.nist.gov](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-77459))
Fix: v3.3.15, v3.4.10, v3.5.4 and v3.6.0-rc2. ([github.com](https://github.com/argoproj/argo-cd/security/advisories/GHSA-fmxq-cgp8-87wp))
Action: Map CVE-2026-77459 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-fmxq-cgp8-87wp)
Finding 06 — Multiple vulnerabilities in Microsoft Office
What changed: CVE coverage: CVE-2026-102849, CVE-2017-0281, CVE-2017-0261, CVE-2017-0262, CVE-2016-0010, CVE-2016-0055, CVE-2016-3313, CVE-2016-3357, CVE-2018-0851, CVE-2018-0852, CVE-2026-102858, CVE-2026-105599, CVE-2026-105715, CVE-2026-108433, CVE-2026-108434, CVE-2026-108435, CVE-2026-108436, CVE-2026-108438, CVE-2026-108453, CVE-2026-108454, CVE-2026-108455, CVE-2016-7276. The cited advisories disclose: Access Remote Code Execution Vulnerability; 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 2010 SP2,Office Web Apps 2013 SP1, Project Server 2013 SP1, SharePoint Enterprise Server 2016, SharePoint Foundation 2013 SP1, Sharepoint Server 2010 SP2, Word 2016, and Skype for Business 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability"; 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office 2016, Excel for Mac 2011, PowerPoint for Mac 2011, Word for Mac 2011, Excel 2016 for Mac, PowerPoint 2016 for Mac, Word 2016 for Mac, and Word Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."; 2007 SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."; 2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016, Word 2016 for Mac, and Word Viewer allow remote attackers to execute arbitrary code via a crafted file, aka "Microsoft Office Memory Corruption Vulnerability."; 2007 SP2, Microsoft Office Word Viewer, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1 and RT SP1, Microsoft Office 2016, and Microsoft Office 2016 Click-to-Run allow a remote code execution vulnerability, due to how Office handles objects in memory, aka "Microsoft Office Memory Corruption Vulnerability".
Technical evidence: CVE-2026-102849; CVSS v3.1 8.8; weakness CWE-122; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: For the EPS-based CVE-2017-0261/0262 path, block EPS files and Office documents containing EPS at email and web gateways. Keep Office EPS insertion disabled and remove registry changes that re-enable it. Microsoft reported limited targeted attacks exploiting CVE-2017-0261 when the fix was published. ([support.microsoft.com](https://support.microsoft.com/en-us/topic/support-for-eps-images-has-been-turned-off-in-office-a069d664-4bcf-415e-a1b5-cbb0c334a840), [api.msrc.microsoft.com](https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2017-0261), [api.msrc.microsoft.com](https://api.msrc.microsoft.com/sug/v2.0/en-US/affectedProduct?$filter=cveNumber%20eq%20%27CVE-2026-105599%27))
Affected: For CVE-2026-105599, Microsoft lists Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Office LTSC 2021 and 2024 (32-bit and 64-bit), Office 365 for Mac, and Office LTSC for Mac 2021 and 2024. ([api.msrc.microsoft.com](https://api.msrc.microsoft.com/sug/v2.0/en-US/affectedProduct?$filter=cveNumber%20eq%20%27CVE-2026-105599%27))
Fix: For CVE-2026-105599, Microsoft lists fixed builds 16.0.14334.20974 for Office LTSC 2021, 16.0.17932.21056 for Office LTSC 2024, and 16.114.26101123 for the Mac editions. ([api.msrc.microsoft.com](https://api.msrc.microsoft.com/sug/v2.0/en-US/affectedProduct?$filter=cveNumber%20eq%20%27CVE-2026-105599%27))
Panel assessment: CVE-2017-0261 and CVE-2017-0262 are actively exploited (CISA KEV, 100th percentile EPSS) in Office 2007–2016 and Office Online Server 2013/2016; if present in your environment, these warrant immediate patching. Malicious EPS-embedded Office documents execute code with user privileges, exposing credentials, files, and networked systems accessible to that user. (priority: patch now)
Action: Map CVE-2026-102849 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: msrc.microsoft.com](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102849)
Finding 07 — FortiMail: SQL Injection
What changed: CVE-2025-57739 is a CVSS 7.7 SQL injection flaw in FortiMail webmail that may let an authenticated attacker execute unauthorized code or commands through crafted HTTP requests.
Technical evidence: CVE-2025-57739; CVSS v3.1 7.7; weakness CWE-89; technical confidence Medium.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Fortinet reports no known exploitation. ([fortiguard.fortinet.com](https://fortiguard.fortinet.com/psirt/FG-IR-26-184))
Affected: FortiMail 7.6.0 through 7.6.3, 7.4.0 through 7.4.5, and 7.2.0 through 7.2.8. ([fortiguard.fortinet.com](https://fortiguard.fortinet.com/psirt/FG-IR-26-184))
Fix: FortiMail 7.6.4 or above, 7.4.6 or above, and 7.2.9 or above. ([fortiguard.fortinet.com](https://fortiguard.fortinet.com/psirt/FG-IR-26-184))
Action: Map CVE-2025-57739 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: fortiguard.fortinet.com](https://fortiguard.fortinet.com/psirt/cvrf/FG-IR-26-184)
Finding 08 — Multiple vulnerabilities in Microsoft Excel
What changed: CVE coverage: CVE-2016-0035, CVE-2026-105718. The cited advisories disclose: 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."; Remote Code Execution Vulnerability.
Technical evidence: CVE-2016-0035; CVSS v3.1 7.8; weakness CWE-119; technical confidence Medium.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: For CVE-2016-0035, restrict interaction with Excel to trusted files. Microsoft reports both CVE-2016-0035 and CVE-2026-105718 as not exploited. ([zerodayinitiative.com](https://www.zerodayinitiative.com/advisories/ZDI-15-639/), [api.msrc.microsoft.com](https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2016-Jan), [api.msrc.microsoft.com](https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Oct), +1 more)
Affected: For CVE-2026-105718: Microsoft 365 Apps for Enterprise from 16.0.1; Office LTSC 2021 from 16.0.1 to before 16.0.14334.20974; Office LTSC 2024 from 16.0.0 to before 16.0.17932.21056. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-105718))
Fix: For CVE-2026-105718, Microsoft lists fixed builds 16.114.26101123 for Office 365/LTSC for Mac, 16.0.14334.20974 for Office LTSC 2021, 16.0.17932.21056 for Office LTSC 2024. ([api.msrc.microsoft.com](https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Oct))
Action: Map CVE-2016-0035 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2016-0035)
Finding 09 — SonicWall Secure Mobile Access unzip Directory Traversal Remote Code Execution Vulnerability
What changed: This vulnerability allows remote attackers to execute arbitrary code on affected installations of SonicWall Secure Mobile Access. Authentication is required to exploit this vulnerability.
Technical evidence: CVE-2026-102257; CVSS v3.1 7.2; weakness CWE-22; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: SonicWall reports there is currently no evidence that any vulnerabilities addressed in this release are being exploited in the wild. ([psirt.global.sonicwall.com](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017))
Affected: SMA1000 models 6210, 7210 and 8200v running 12.4.3-03526 (platform-hotfix) and older, or 12.5.0-02952 (platform-hotfix) and older. ([psirt.global.sonicwall.com](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017))
Fix: SMA1000 models 6210, 7210 and 8200v running 12.4.3-03670 (platform-hotfix) and higher, or 12.5.0-03082 (platform-hotfix) and higher. ([psirt.global.sonicwall.com](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017))
Action: Map CVE-2026-102257 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: zerodayinitiative.com](http://www.zerodayinitiative.com/advisories/ZDI-26-770/)
Finding 10 — OpenNext Cloudflare: Improper Handling of URL Encoding (Hex Encoding)
What changed: GitHub Advisory Database published GHSA-2vc4-c4r6-p6v6 for CVE-2026-100409 (OpenNext Cloudflare): Improper Handling of URL Encoding (Hex Encoding), CVSS v3.1 7.5; affected: @opennextjs/cloudflare versions >= 0.3.0 and < 1.20.2.
Technical evidence: CVE-2026-100409; CVSS v3.1 7.5; weakness CWE-177, CWE-180; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Disable cache interception by removing enableCacheInterception: true. Enforce authorisation inside protected route handlers rather than relying exclusively on middleware, or reject encoded paths for protected routes at a trusted proxy. CISA's SSVC assessment reports no exploitation. ([api.github.com](https://api.github.com/advisories/GHSA-2vc4-c4r6-p6v6), [services.nvd.nist.gov](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-100409))
Affected: @opennextjs/cloudflare versions >= 0.3.0 and < 1.20.2. ([api.github.com](https://api.github.com/advisories/GHSA-2vc4-c4r6-p6v6))
Fix: @opennextjs/cloudflare 1.20.2 or later. ([api.github.com](https://api.github.com/advisories/GHSA-2vc4-c4r6-p6v6))
Action: Map CVE-2026-100409 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-2vc4-c4r6-p6v6)
Finding 11 — Multiple vulnerabilities in Adobe Photoshop
What changed: CVE coverage: CVE-2026-95636, CVE-2026-83661. The cited advisories disclose: DCM Pixel Data Parsing Integer Overflow Remote Code Execution Vulnerability; AdobePDFL PDF JPEG Parsing Integer Overflow Remote Code Execution Vulnerability.
Technical evidence: CVE-2026-95636; CVSS v3.1 7.8; weakness CWE-190; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Until patched, prevent Photoshop from opening untrusted DICOM images and PDFs containing JPEG images. ([zerodayinitiative.com](https://www.zerodayinitiative.com/advisories/ZDI-26-778/), [zerodayinitiative.com](https://www.zerodayinitiative.com/advisories/ZDI-26-777/), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-95636), +1 more)
Affected: For both CVEs: Photoshop 27.10 and earlier, and Photoshop 26.11.7 and earlier. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-95636), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-83661))
Fix: For both CVEs: Photoshop 27.11 and Photoshop 26.11.8. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-95636), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-83661))
Action: Map CVE-2026-95636 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: zerodayinitiative.com](http://www.zerodayinitiative.com/advisories/ZDI-26-778/)
Finding 12 — Multiple vulnerabilities in Nginx UI
What changed: Nginx UI carries 11 CVEs across 9 advisories: Improper Authentication; Improper Input Validation; Authentication Bypass Using an Alternate Path or Channel; Improper Authorization; Missing Authorization; Insufficient Session Expiration; Path Traversal; nginx_config_add Bypasses Directive Validation — Authenticated RCE; nginx_config_add skips config directive validation: authenticated nginx directive injection; configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context. CVE coverage: CVE-2026-84318, CVE-2026-84317, CVE-2026-84319, CVE-2026-84313, CVE-2026-84316, CVE-2026-84360, CVE-2026-84314, CVE-2026-84315, CVE-2026-84312, CVE-2026-84321, CVE-2026-84320.
Technical evidence: CVE-2026-84360; CVSS v3.1 8.1; weakness CWE-288; technical confidence Medium.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: CISA ADP Vulnrichment reports proof-of-concept exploitation. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-84315))
Affected: For 1 of 9 advisories: Versions prior to 2.4.1 ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-84315))
Fix: For 1 of 9 advisories: Version 2.4.1 ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-84315))
Action: Map CVE-2026-84360 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-vc32-4gwf-77xp)
Finding 13 — Microsoft Patch Tuesday, October 2026: 34 CVEs across 16 advisories
What changed: Microsoft's October 2026 security update fixes 34 CVEs across 16 advisories (31 high, 3 medium CVEs). Products with the most fixes: Microsoft Office Word (18); ASP.NET Core (1); Microsoft Office (1); Microsoft Office Excel (1); Microsoft Office Outlook (1).
Technical evidence: CVE-2026-108426; CVSS v3.1 8.8; weakness CWE-122; technical confidence Medium.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-108426 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: msrc.microsoft.com](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108426)
Finding 14 — Multiple vulnerabilities in Fortinet FortiSandbox
What changed: CVE coverage: CVE-2026-107656, CVE-2026-106170. The cited advisories disclose: login_user_profile Hard-Coded Credentials Authentication Bypass Vulnerability; Admin Profile Improper Handling of Exceptional Conditions Denial-of-Service Vulnerability.
Technical evidence: CVE-2026-106170; CVSS v3.1 4.8; weakness CWE-248; technical confidence Medium.
Why it matters: The Medium priority requires exposure validation and scheduled remediation through normal change control.
Analyst note: Fortinet reports that neither vulnerability is known to have been exploited. ([fortiguard.fortinet.com](https://fortiguard.fortinet.com/psirt/FG-IR-26-185), [fortiguard.fortinet.com](https://fortiguard.fortinet.com/psirt/FG-IR-26-176))
Affected: CVE-2026-107656: FortiSandbox 5.0.0 through 5.0.6 and 4.4.0 through 4.4.9; FortiSandbox PaaS 5.0.0 through 5.0.6 and all 4.4 versions. CVE-2026-106170: FortiSandbox 5.2.0 through 5.2.1. ([fortiguard.fortinet.com](https://fortiguard.fortinet.com/psirt/FG-IR-26-185), [fortiguard.fortinet.com](https://fortiguard.fortinet.com/psirt/FG-IR-26-176))
Fix: Upgrade to 5.0.7 or above; Upgrade to 4.4.10 or above; Migrate to a fixed release; Upgrade to 5.2.2 or above ([fortiguard.fortinet.com](https://fortiguard.fortinet.com/psirt/FG-IR-26-185), [fortiguard.fortinet.com](https://fortiguard.fortinet.com/psirt/FG-IR-26-176))
Action: Map CVE-2026-106170 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: zerodayinitiative.com](http://www.zerodayinitiative.com/advisories/ZDI-26-771/)
Finding 15 — Talos Linux: Support bundle does not redact registry credentials
What changed: GitHub Advisory Database published GHSA-7cxh-94cf-mfp6 for CVE-2026-77564 (Talos Linux): Cleartext Storage of Sensitive Information, CVSS v3.1 3.3; affected: Talos v1.13.0 is the affected version identified in the advisory's tested environment.
Technical evidence: CVE-2026-77564; CVSS v3.1 3.3; weakness CWE-312; technical confidence Medium.
Why it matters: The cited reporting affects widely deployed technology, so exposure validation and source verification need explicit ownership.
Analyst note: Keep unencrypted support bundles local and do not attach them to public issues. Treat registry credentials exposed in previously shared bundles as compromised and revoke them. The Sidero Labs advisory provides a proof of concept using talosctl support on a cluster with a RegistryAuthConfig resource. ([docs.siderolabs.com](https://docs.siderolabs.com/talos/v1.14/troubleshooting/support-bundle), [docs.github.com](https://docs.github.com/en/code-security/secret-scanning/working-with-secret-scanning-and-push-protection/remediating-a-leaked-secret), [github.com](https://github.com/advisories/GHSA-7cxh-94cf-mfp6), +2 more)
Affected: Talos v1.13.0 is the affected version identified in the advisory's tested environment. ([github.com](https://github.com/advisories/GHSA-7cxh-94cf-mfp6))
Fix: Talos v1.12.9 and v1.13.3 include the relevant redaction fixes. ([github.com](https://github.com/siderolabs/talos/releases/tag/v1.12.9), [github.com](https://github.com/siderolabs/talos/releases/tag/v1.13.3))
Action: Map CVE-2026-77564 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-7cxh-94cf-mfp6)