Executive assessment
Today's brief leads with PHP: CVE records published. All 15 selected findings retain their own technical scope, action, observed status, and evidence limits.
Panel synthesis: Oracle's CVSS 10.0 flaws headline today (NHS alert), but patch sequencing prioritises Pillow (Finding 06, CRITICAL with PoC, fixed at 13.0.0) and Ghostscript (Finding 10, HIGH with PoC, fixed at 10.08.0) to secure document-processing attack surface first. Themes: Cisco infrastructure bulk updates (four products affected); Document-processing attack surface hazards (PostScript, TIFF, PDF, HID/USB handling); Exploitation evidence aligned with patch availability. Patch order: Finding 06 (CRITICAL with proof-of-concept; fixed at Pillow 13.0.0; TIFF-to-BytesIO processing is high-value target in document workflows); Finding 10 (HIGH with proof-of-concept; fixed at Ghostscript 10.08.0; PostScript and EPS processing must halt for untrusted content until patched); Finding 02 (CVSS 10.0 (maximum severity) with NHS alert; fix status unknown, but immediate controls deployable (restrict untrusted network access, block T3/IIOP to Oracle SOA)); Finding 03 (CRITICAL with multiple vulnerabilities; fixed at Cisco Expressway X15.5.20; X14 and earlier require migration); Finding 05 (CRITICAL with multiple vulnerabilities; fixed at Cisco UC 15SU5; release 14 and earlier require migration).
Finding 01 — PHP: CVE records published
What changed: Follow-up to the 2026-10-21 card. CVE coverage: CVE-2026-109618, CVE-2026-109619. The cited advisories disclose: Use After Free.
Technical evidence: CVE-2026-109618; CVSS v4.0 9.2; weakness CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-109618 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: securityweek.com](https://www.securityweek.com/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws/)
Finding 02 — Multiple vulnerabilities in Oracle
What changed: Oracle advisory CVE-2026-101809 (via NHS England cyber alert CC-4876): Oracle's October 2026 Critical Patch Update contains 1,295 fixes across numerous product families and specifically names five CVSS 10.0 vulnerabilities that can expose critical data or enable takeover of Oracle components. Administrators should map the Oracle product matrices to their estates and prioritize affected internet-facing or high-privilege components.
Technical evidence: CVE-2026-101809; CVSS v3.1 10; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Analyst note: Until patches can be applied, restrict untrusted network access to affected HTTP services and block or tightly limit T3 and IIOP access to Oracle SOA Suite. CISA ADP reports "Exploitation: none" for CVE-2026-9129 only; no sourced exploitation status was found for the four Oracle CVEs. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-101809), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-91216), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-91231), +3 more)
Affected: Supported versions that are affected are 12.2.3-12.2.15; Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0 ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-101809), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-91216), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-91231), +2 more)
Panel assessment: Multiple CVSS 10.0 vulnerabilities allow unauthenticated network access to Oracle Workflow and SOA Suite; these are easily exploitable via HTTP, T3, or IIOP protocols, necessitating immediate patching. Attackers reaching these services can expose critical data or take control of affected Oracle components. Check first whether your environment runs vulnerable versions (Workflow 12.2.3–12.2.15, SOA Suite 12.2.1.4.0 or 14.1.2.0.0) and if any are accessible to untrusted networks. (priority: patch now)
Action: Map CVE-2026-101809 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: digital.nhs.uk](https://digital.nhs.uk/cyber-alerts/2026/cc-4876)
Finding 03 — Multiple vulnerabilities in Cisco Expressway Series
What changed: CVE coverage: CVE-2026-76466, CVE-2026-76490, CVE-2026-76491, CVE-2026-76492, CVE-2026-76493, CVE-2026-76494, CVE-2026-76495, CVE-2026-76496, CVE-2026-76497. The cited advisories disclose: Use of Hard-coded Credentials; Out-of-bounds Write; Reachable Assertion; NULL Pointer Dereference; Code Injection; Incorrect Permission Assignment for Critical Resource; Improper Link Resolution Before File Access.
Technical evidence: CVE-2026-76466; CVSS v3.1 9.8; weakness CWE-798; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Cisco PSIRT reports no known public announcements or malicious use. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t), [sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcs))
Affected: Cisco Expressway Series X15.5.3 and earlier; X14 and earlier must migrate to a fixed release. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t), [sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcs))
Fix: X15.5.20 is the first fixed release for the X15.5 train; X14 and earlier must migrate to a fixed release. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t), [sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcs))
Panel assessment: CVE-2026-76466 (CVSS 9.8) embeds credentials that enable full system access; combined with RCE vulnerabilities, this allows trivial code execution with no known exploitation barrier. Patch immediately: X14 and earlier, and X15.5.3 and earlier versions are affected and must migrate to X15.5.20 or equivalent. Inventory deployed Expressway versions and verify whether embedded credentials appear in logs or threat intelligence. (priority: patch now)
Action: Map CVE-2026-76466 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Expressway%20Series%20Remote%20Code%20Execution%20Vulnerability%26vs_k=1)
Finding 04 — Multiple vulnerabilities in Snort 3
What changed: CVE coverage: CVE-2026-20011, CVE-2026-20019, CVE-2026-20179, CVE-2026-20197, CVE-2026-76489, CVE-2026-20043, CVE-2026-20236, CVE-2026-20291, CVE-2026-20356, CVE-2026-20218, CVE-2026-76524, CVE-2026-20221, CVE-2026-76445. The cited advisories disclose: Loop with Unreachable Exit Condition; Improper Restriction of Operations within the Bounds of a Memory Buffer; Out-of-bounds Write; Improper Privilege Management; Uncontrolled Resource Consumption; Stack-based Buffer Overflow; Missing Authentication for Critical Function; NULL Pointer Dereference.
Technical evidence: CVE-2026-20043; CVSS v3.1 9; weakness CWE-787; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: For CVE-2026-20218, disable VBA decompression until the device is upgraded; Cisco says this prevents exposure to that vulnerability. Cisco PSIRT reports no public announcements or malicious use across the seven advisories covering these CVEs. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe), [sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-opensrc-snort3-2fXGJPfe), [sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-misc-dos-6mB22qAK), +4 more)
Affected: Open Source Snort 3 release 3.x. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe))
Fix: Snort 3 Release First Fixed Release 3.x 3.12.4.0 ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe), [sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-mime-vulns-bkXjcKkt))
Action: Map CVE-2026-20043 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-mime-vulns-bkXjcKkt?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Multiple%20Cisco%20Products%20Snort%203%20SMTP%20MIME%20Denial%20of%20Service%20Vulnerability%26vs_k=1)
Finding 05 — Multiple vulnerabilities in Cisco Unified Communications
What changed: CVE coverage: CVE-2026-76487, CVE-2026-76473, CVE-2026-76474, CVE-2026-76475, CVE-2026-76476, CVE-2026-76477, CVE-2026-76478, CVE-2026-76479, CVE-2026-76481. The cited advisories disclose: Exposed Dangerous Method or Function; Improper Neutralization of Special Elements in Output; Improper Authentication; Cross-site Scripting; Improper Input Validation; SQL Injection; Improper Access Control; Path Traversal.
Technical evidence: CVE-2026-76473; CVSS v3.1 9.8; weakness CWE-74; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Cisco PSIRT reports no known public announcements or malicious use. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-access-PW9e8Jt2), [sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3))
Affected: Cisco Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME and Unity Connection release 14, and release 15 before 15SU5. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3))
Fix: 15SU5; release 14 must migrate to a fixed release. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-access-PW9e8Jt2), [sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3))
Action: Map CVE-2026-76473 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-access-PW9e8Jt2?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Unified%20Communications%20Manager%20Improper%20Access%20Control%20Vulnerability%26vs_k=1)
Finding 06 — Pillow: Heap-based Buffer Overflow
What changed: GitHub Advisory Database published GHSA-332p-7hrc-92wf for CVE-2026-112393 (Pillow): Heap-based Buffer Overflow, CVSS v4.0 9.2; affected: Pillow versions 2.0.0 through versions before 13.0.0.
Technical evidence: CVE-2026-112393; CVSS v4.0 9.2; weakness CWE-122; technical confidence Medium.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Until patched, save TIFF output only to file paths or targets with real file descriptors, not BytesIO or other targets without a usable fileno(). The CISA Coordinator reports proof-of-concept exploitation. ([api.osv.dev](https://api.osv.dev/v1/vulns/GHSA-332p-7hrc-92wf), [services.nvd.nist.gov](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-112393))
Affected: Pillow versions 2.0.0 through versions before 13.0.0. ([services.nvd.nist.gov](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-112393))
Fix: Pillow 13.0.0. ([services.nvd.nist.gov](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-112393))
Action: Map CVE-2026-112393 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-332p-7hrc-92wf)
Finding 07 — Multiple vulnerabilities in Unbound
What changed: It was discovered that Unbound incorrectly handled certain TCP connections. A remote attacker could possibly use this issue to cause Unbound to consume resources, leading to a denial of service.
Technical evidence: CVE-2026-81634; CVSS v3.1 7.5; weakness CWE-122; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Analyst note: If patching is delayed, disable aggressive-nsec, DNSCrypt and downstream DoQ listeners, set dns-error-reporting: no, and disable so-reuseport. Set val-clean-additional: no to stop DNSSEC validation of Additional-section RRsets. ([nlnetlabs.nl](https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-44690.txt), [nlnetlabs.nl](https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-40691.txt), [nlnetlabs.nl](https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-32665.txt), +5 more)
Affected: Unbound 1.9.0 up to and including version 1.25.1; Unbound 1.7.0 up to and including version 1.25.1; Unbound 1.22.0 up to and including version 1.25.1; Unbound 1.23.0 up to and including version 1.25.1 ([nlnetlabs.nl](https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-80225.txt), [nlnetlabs.nl](https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81634.txt), [nlnetlabs.nl](https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-85501.txt), +5 more)
Fix: NLnet Labs released Unbound 1.25.2 and 1.26.1 with patches. ([nlnetlabs.nl](https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50252.txt), [nlnetlabs.nl](https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-80225.txt))
Action: Map CVE-2026-81634 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: ubuntu.com](https://ubuntu.com/security/notices/USN-8946-1)
Finding 08 — Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unicast Packets Denial of Service Vulnerability
What changed: A vulnerability in the IPv4 packet processing functionality of Cisco IOS XR Software that affects Cisco ASR 9000 and 9900 Series Aggregation Services Routers as well as Cisco ASR 9902 and 9903 Compact High-Performance Routers could allow an unauthenticated, remote attacker to cause network processor (NP) errors, resulting in a line card reset or shutdown and a denial of service (DoS) condition.
Technical evidence: CVE-2026-76505; CVSS v3.1 7.5; weakness CWE-20; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Filter UDP traffic destined to infrastructure address space on UDP destination port 1701. Configure an ingress iACL on edge or external interfaces to drop UDP/1701 destined for local router addresses. Cisco PSIRT reports that it is not aware of any public announcements or malicious use of the vulnerability. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asr9k-tUyxcyXN))
Affected: Cisco IOS XR Software release trains 7.8 and earlier, 7.9, 7.10, 7.11, 24.1, 24.2, 24.3 and 24.4. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asr9k-tUyxcyXN))
Fix: 7.9.2 with SMU asr9k-x64-7.9.2.CSCwn39554; 7.9.21 with SMU asr9k-x64-7.9.21.CSCwn39554; 7.10.2 with SMU asr9k-x64-7.10.2.CSCwn39554; 7.11.2 with SMU asr9k-x64-7.11.2.CSCwn39554. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asr9k-tUyxcyXN))
Panel assessment: HIGH blast radius on core routers (line card reset cascades traffic loss) but no exploitation reported; patch this week with immediate UDP/1701 ingress filtering. Unauthenticated remote attack via malformed IPv4 packets to UDP/1701 on infrastructure space; affects only availability (no credential/data theft), but anyone with network path can attempt it. (priority: this week)
Action: Map CVE-2026-76505 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asr9k-tUyxcyXN?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20IOS%20XR%20Software%20for%20ASR%209000%20Series%20Routers%20IPv4%20Unicast%20Packets%20Denial%20of%20Service%20Vulnerability%26vs_k=1)
Finding 09 — Multiple vulnerabilities in ApostropheCMS sanitize-html
What changed: ApostropheCMS sanitize-html carries 12 CVEs across 2 advisories: Uncontrolled Recursion; Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export; Exposure of Sensitive Information via predictable export filenames; POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user; GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users; Stored XSS via Unescaped Widget Style Attribute Serialization; Missing Authentication in cleanExport Route; Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API; Color field validation bypass allows stored XSS via HTML appended after rgb /hsl prefix; Import API bypasses publication roles for protected content; Archive duplicate continuation lets contributors overwrite published content; Import archives can exhaust server storage and deny service. CVE coverage: CVE-2026-113711, CVE-2026-112953, CVE-2026-112952, CVE-2026-112957, CVE-2026-112958, CVE-2026-113648, CVE-2026-112954, CVE-2026-112951, CVE-2026-113649, CVE-2026-112956, CVE-2026-112955, CVE-2026-113650.
Technical evidence: CVE-2026-113711; CVSS v3.1 7.5; weakness CWE-400, CWE-770; technical confidence Medium.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-113711 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: github.com](https://github.com/advisories/GHSA-86wm-68pq-5jwq)
Finding 10 — Multiple vulnerabilities in Ghostscript
What changed: Rick de Jager discovered that Ghostscript incorrectly handled memory under certain circumstances when processing PostScript documents. If a user or automated system were tricked into processing a specially crafted document, an attacker could possibly use this issue to bypass the sandbox and execute arbitrary code.
Technical evidence: CVE-2026-101258; CVSS v3.1 7.8; weakness CWE-787; technical confidence Medium.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Suspend Ghostscript processing of attacker-controlled content, including PostScript/EPS and document-conversion workflows, until patched. Red Hat reports no mitigation meeting its standards is currently available. V12 Security publishes a command-execution PoC, while the VulDB CNA reports that the CVE-2026-103226 exploit is publicly available. ([access.redhat.com](https://access.redhat.com/security/cve/CVE-2026-101258), [raw.githubusercontent.com](https://raw.githubusercontent.com/v12-security/pocs/main/ghostscript/README.md), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-103226), +1 more)
Affected: CVE-2026-101258 is confirmed on RHEL 10 with Ghostscript 10.02.1; CVE-2026-103226 affects Artifex Ghostscript through 10.07.0. ([access.redhat.com](https://access.redhat.com/security/cve/CVE-2026-101258), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-103226))
Fix: Ghostscript 10.08.0 addresses both CVEs. ([security-tracker.debian.org](https://security-tracker.debian.org/tracker/CVE-2026-101258), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-103226))
Panel assessment: Public exploitation code exists for both CVEs with no mitigation available; code execution is confirmed with sandbox bypass, making this an immediate patch priority for any organisation running Ghostscript. An attacker exploits Ghostscript processing of specially crafted PostScript or EPS content to execute arbitrary code in the process context. (priority: patch now)
Action: Map CVE-2026-101258 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: ubuntu.com](https://ubuntu.com/security/notices/USN-8949-1)
Finding 11 — poppler: Stack-based Buffer Overflow
What changed: It was discovered that poppler incorrectly handled the password length limit when decrypting certain encrypted PDF files. An attacker could possibly use this issue to cause a denial of service.
Technical evidence: CVE-2026-107705; CVSS v4.0 8.3; weakness CWE-121; technical confidence Medium.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Reject AESV3/R6 encrypted PDFs and prevent passwords longer than 127 bytes from reaching Poppler-backed applications until patched. CISA reports exploitation as none. ([vulncheck.com](https://www.vulncheck.com/advisories/poppler-0.42.0-through-26.10.0-stack-buffer-overflow-via-decrypt-revision6hash), [services.nvd.nist.gov](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-107705), [ubuntu.com](https://ubuntu.com/security/notices/USN-8950-1.json))
Affected: Poppler 0.42.0 through 26.10.0. ([vulncheck.com](https://www.vulncheck.com/advisories/poppler-0.42.0-through-26.10.0-stack-buffer-overflow-via-decrypt-revision6hash))
Fix: Ubuntu updates are 22.02.0-2ubuntu0.15 (Jammy), 24.02.0-1ubuntu9.11 (Noble), 26.01.0-2ubuntu0.3 (Resolute), and 26.07.0-2ubuntu1.1 (Stonking). ([ubuntu.com](https://ubuntu.com/security/notices/USN-8950-1.json))
Action: Map CVE-2026-107705 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: ubuntu.com](https://ubuntu.com/security/notices/USN-8950-1)
Finding 12 — Multiple vulnerabilities in virtualenv
What changed: virtualenv carries 5 CVEs across 3 advisories: OS Command Injection; Builtin creation follows linked environment directories; Deletion recovery can change a symlink target's mode; Generated POSIX console launchers interpret destination paths as shell syntax. CVE coverage: CVE-2026-113716, CVE-2026-113724, CVE-2026-113722, CVE-2026-113726, CVE-2026-113725.
Technical evidence: CVE-2026-113716; CVSS v3.1 4.5; weakness CWE-59; technical confidence Medium.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-113716 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: github.com](https://github.com/advisories/GHSA-cw65-gx24-rc82)
Finding 13 — Cisco Secure Client: Secure Firewall Posture Module Privilege Escalation
What changed: A vulnerability in the interprocess communication (IPC) channel of the Secure Firewall Posture module in Cisco Secure Client could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient validation of user-supplied input.
Technical evidence: CVE-2026-76462; CVSS v3.1 5.5; weakness CWE-20; technical confidence High.
Why it matters: The Medium priority requires exposure validation and scheduled remediation through normal change control.
Analyst note: Cisco PSIRT reports that it is not aware of any public announcements or malicious use. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sec-client-priv-esc-muF8eZdm))
Affected: Cisco Secure Client releases earlier than 5.1.20.333. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sec-client-priv-esc-muF8eZdm))
Fix: Cisco Secure Client 5.1.20.333. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sec-client-priv-esc-muF8eZdm))
Action: Map CVE-2026-76462 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sec-client-priv-esc-muF8eZdm?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Secure%20Client%20Secure%20Firewall%20Posture%20Module%20Privilege%20Escalation%20Vulnerability%26vs_k=1)
Finding 14 — Electron: Origin Validation Error
What changed: GitHub Advisory Database published GHSA-fw47-9c62-h3vw for CVE-2026-113800 (Electron): Origin Validation Error, CVSS v3.1 5.4; affected: Electron >= 45.0.0-alpha.1 and < 45.0.0-alpha.5; >= 44.0.0-alpha.1 and < 44.3.0; >= 43.0.0-alpha.1 and < 43.7.0; and < 42.11.3.
Technical evidence: CVE-2026-113800; CVSS v3.1 5.4; weakness CWE-346; technical confidence Medium.
Why it matters: The Medium priority requires exposure validation and scheduled remediation through normal change control.
Observed status: Observed in-the-wild exploitation status is unknown.
Analyst note: Do not add allow="hid" or allow="usb" to untrusted iframes; alternatively, make the decision in the select-hid-device or select-usb-device handler using details.frame. ([github.com](https://github.com/electron/electron/security/advisories/GHSA-fw47-9c62-h3vw))
Affected: Electron >= 45.0.0-alpha.1 and < 45.0.0-alpha.5; >= 44.0.0-alpha.1 and < 44.3.0; >= 43.0.0-alpha.1 and < 43.7.0; and < 42.11.3. ([github.com](https://github.com/electron/electron/security/advisories/GHSA-fw47-9c62-h3vw))
Fix: Electron 45.0.0-alpha.5, 44.3.0, 43.7.0, and 42.11.3. ([github.com](https://github.com/electron/electron/security/advisories/GHSA-fw47-9c62-h3vw))
Action: Map CVE-2026-113800 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-fw47-9c62-h3vw)
Finding 15 — LiteLLM supply chain attack hoovers up passwords and secrets
What changed: The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep, Socket, StepSecurity, and Upwind. The compromise affects LiteLLM 1.107.0, distributed through PyPI wheels and Docker images.
Why it matters: The cited reporting affects widely deployed technology, so exposure validation and source verification need explicit ownership.
Observed status: The cited source reports an active supply-chain compromise; exposure depends on use of the affected packages rather than exploitation of a single vulnerability.
Action: Review the cited source, validate exposure of the affected technology in owned environments, apply available vendor guidance, and retain evidence of the exposure decision.
Evidence limits: grounded severity unavailable
fixed version or patch state unknown
[Evidence source: theregister.com](https://www.theregister.com/security/2026/10/21/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets/5304548)