Executive assessment
Today's brief leads with Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability. All 15 selected findings retain their own technical scope, action, observed status, and evidence limits.
Panel synthesis: Finding 01 leads because it is a critical authentication bypass on the Cisco Catalyst SD-WAN Controller with exploitation in the wild and no fixed version listed, so network level restriction of ports 22 and 830 is the only stated remedy today. Themes: Actively exploited infrastructure and edge software, some without a stated fix: Finding 01, Finding 02, Finding 08, Finding 10; Authentication and transaction integrity bypass: Finding 01, Finding 10, Finding 09, Finding 06; Large vendor patch batches with no reported exploitation: Finding 03, Finding 04, Finding 14, Finding 15. Patch order: Finding 01 (Critical, exploited in the wild and no fixed version listed, so the stated ACL restriction of ports 22 and 830 to known addresses is the only action available now); Finding 02 (Critical, exploited in the wild and no fixed version listed, so removing /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist and restricting the web tier to trusted networks is the immediate step); Finding 10 (High severity and exploited in the wild, and unlike the two above it has specific fixed ASA and FTD releases listed, so patching is feasible immediately); Finding 06 (Critical and exploited in the wild, with Electrum 4.8.3 listed as the fixed version and transaction verification given as the interim control); Finding 08 (High severity and exploited in the wild, with Linux CNA original commit fixed versions identified and CISA directing discontinuation of use where mitigations are unavailable).
Also today: 7 more vLLM CVEs (CVE-2026-115913, CVE-2026-115915, CVE-2026-115912, CVE-2026-115916, CVE-2026-115918, CVE-2026-115911, CVE-2026-115917) in the same disclosure wave as the vLLM cards of 2026-10-24 and 2026-10-28; none reported exploited; carried as a note rather than a finding.
Also today: 3 more Tornado CVEs (CVE-2026-115927, CVE-2026-116578, CVE-2026-116577) in the same disclosure wave as the Tornado card of 2026-10-23; none reported exploited; carried as a note rather than a finding.
Finding 01 — Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
What changed: A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly.
Technical evidence: CVE-2026-20127; CVSS v3.1 10; weakness CWE-287; technical confidence High.
Why it matters: Reported active exploitation elevates this above routine patching: validate exposure immediately, remediate, and assess for prior compromise.
Observed status: Observed in-the-wild exploitation is confirmed.
Analyst note: For on-premises deployments, restrict ports 22 and 830 with ACLs, security-group rules or firewalls to known controller and other known IP addresses, and permit control-component traffic only from specified hosts or devices. Cisco PSIRT reports limited exploitation of the vulnerability. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk))
Affected: The right column indicates whether a release is affected by the vulnerability that is described in this advisory and the first release that includes the fix for this vulnerability. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk))
Fix: 20.9 20.9.8.2 20.11 20.12.6.1 20.12 20.12.5.3 20.12.6.1 ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk))
Panel assessment: Cisco Catalyst SD-WAN Controller, Manager and Validator need emergency patching because broken peering authentication hands an unauthenticated remote attacker administrative control of the component that governs an entire WAN fabric, and Cisco PSIRT already reports exploitation in the wild. The plausible path is reaching the control plane over port 22 or 830, impersonating a peer, taking admin rights and from there rewriting routing and policy pushed to every managed edge device, which puts controller credentials, configuration stores and traffic steering within reach. (priority: patch now)
Action: Map CVE-2026-20127 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Catalyst%20SD-WAN%20Controller%20Authentication%20Bypass%20Vulnerability%26vs_k=1)
Finding 02 — Oracle EBS: Missing Authentication for Critical Function
What changed: CVE-2026-101767 is an unauthenticated SQL injection that can be exploited for remote code execution.
Technical evidence: CVE-2026-101767; CVSS v3.1 9.8; weakness CWE-306, CWE-287; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist and restrict the EBS web tier to trusted networks. Monitor unauthenticated POST requests to this path followed by backend database activity, plus unexpected files in $APPLPTMP or the oracle account spawning /bin/sh via Concurrent Manager. ([horizon3.ai](https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/), [x.com](https://x.com/DefusedCyber/status/2115099999973364147))
Affected: Oracle Application Object Library in Oracle E-Business Suite versions 12.2.3 through 12.2.15 inclusive. ([horizon3.ai](https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/))
Action: Map CVE-2026-101767 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: securityweek.com](https://www.securityweek.com/hackers-start-probing-fresh-oracle-ebs-vulnerability/)
Finding 03 — Chrome and Firefox: updates patch over 200 vulnerabilities
What changed: The Chrome 156 update fixes 52 bugs, while Firefox 159 was rolled out with 167 security patches.
Technical evidence: CVE-2026-118306; CVSS v3.1 9.6; weakness CWE-119; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: For managed Chrome, use URLBlocklist to block all URLs and URLAllowlist to permit only approved sites. For stronger filtering, Google recommends a content-filtering web proxy or extension. CISA's SSVC assessment reports exploitation as none. ([support.google.com](https://support.google.com/chrome/a/answer/7532419?hl=en), [services.nvd.nist.gov](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-118306), [raw.githubusercontent.com](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/118xxx/CVE-2026-118306.json), +2 more)
Affected: Google Chrome versions prior to 156.0.8078.73. ([raw.githubusercontent.com](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/118xxx/CVE-2026-118306.json))
Fix: Chrome 156.0.8078.73/.74 on Windows and Mac, 156.0.8078.73 on Linux; Firefox 159. ([chromereleases.googleblog.com](https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html), [mozilla.org](https://www.mozilla.org/en-US/security/advisories/mfsa2026-118/))
Panel assessment: Google Chrome and Firefox should move to the front of this week's patch queue because browsers touch untrusted content continuously, so a memory buffer flaw with total technical impact gives a wide endpoint blast radius even though CISA records no exploitation and the near term exploit likelihood is low. The plausible route is a malicious or compromised page corrupting memory to run code in the browser process, reaching live session cookies, saved credentials and whatever internal web tooling, admin consoles or pipelines that user can already sign into. Check first that endpoints have actually restarted into Chrome 156.0.8078.73 or later and Firefox 159, since the Chrome rollout lands over days or weeks and URL blocklist and allowlist policies only narrow exposure rather than fix the flaw. (panel view at moderate confidence; priority: this week)
Action: Map CVE-2026-118306 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: securityweek.com](https://www.securityweek.com/chrome-and-firefox-updates-patch-over-200-vulnerabilities/)
Finding 04 — Adobe Campaign Classic: Code Injection
What changed: Adobe has released patches to address multiple critical security flaws in Campaign Classic that, if successfully exploited, could result in arbitrary code execution, security feature bypass, and privilege escalation. CVE-2026-104351 (CVSS 9.9) is a code injection vulnerability that could lead to arbitrary code execution.
Technical evidence: CVE-2026-104351; CVSS v3.1 9.9; weakness CWE-94; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Adobe reports that it is not aware of any in-the-wild exploitation of the issues addressed by this update. ([adobe.com](https://www.adobe.com/trust/security/products/campaign/apsb26-162.html))
Affected: Adobe Campaign Classic v7 7.4.4 build 9402 and earlier. ([adobe.com](https://www.adobe.com/trust/security/products/campaign/apsb26-162.html))
Fix: Adobe Campaign Classic v7 7.4.4 build 9403. ([adobe.com](https://www.adobe.com/trust/security/products/campaign/apsb26-162.html))
Panel assessment: Adobe Campaign Classic deserves near-term patching because code injection reaching arbitrary execution carries very little attacker friction once a working technique circulates, and the absence of reported exploitation is a timing advantage rather than a reason to defer. The plausible path is crafted input processed by the application and executed server side, which puts the service account, stored database and SMTP or API credentials, and the outbound campaign pipeline within reach, and that pipeline is itself an attractive route for trusted phishing at scale. Check the running build against 7.4.4 build 9402 first, since that single answer separates an upgrade to build 9403 from no action at all. (panel view at moderate confidence; priority: this week)
Action: Map CVE-2026-104351 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: thehackernews.com](https://thehackernews.com/2026/10/adobe-fixes-8-critical-campaign-classic.html)
Finding 05 — zip: Improper Input Validation
What changed: GitHub Advisory Database published GHSA-m665-v7pm-7grj for CVE-2026-115905 (zip): Improper Input Validation, CVSS v4.0 10; affected: zip versions up to and including 9.0.4.
Technical evidence: CVE-2026-115905; CVSS v4.0 10; weakness CWE-20, CWE-436; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Until patching, block user-submitted ZIP ingestion or disable ZipStreamReader extraction. If intake must continue, validate that LFH and CDFH filenames match and reject mismatches before extraction. GitHub's advisory reports an automated integration test that reproduces the exploit chain. ([github.com](https://github.com/advisories/GHSA-m665-v7pm-7grj), [github.com](https://github.com/zip-rs/zip2/commit/8068ab480ccf8daa7411424e365fcdbe6d09443e))
Affected: zip versions up to and including 9.0.4. ([github.com](https://github.com/advisories/GHSA-m665-v7pm-7grj))
Fix: zip version 9.0.5. ([github.com](https://github.com/advisories/GHSA-m665-v7pm-7grj))
Panel assessment: Patch the zip crate to 9.0.5 wherever untrusted archives are extracted, because the advisory publishes a reproducible integration test for the full chain and the exposed surface is exactly the unauthenticated intake path of ingestion microservices, SaaS platforms and backend workers. The attack smuggles a crafted archive whose local and central directory filenames disagree, so whatever scanning or path validation inspected the central directory is not what gets written, giving arbitrary file overwrite and from there code execution in the worker, which usually holds queue, storage and registry credentials and feeds downstream pipelines. (priority: patch now)
Action: Map CVE-2026-115905 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-m665-v7pm-7grj)
Finding 06 — Electrum: Improper Verification of Cryptographic Signature
What changed: GitHub Advisory Database published GHSA-6jp4-8v48-cc5v for CVE-2026-117601 (Electrum): Improper Verification of Cryptographic Signature, CVSS v4.0 9.3; affected: Electrum <4.8.3.
Technical evidence: CVE-2026-117601; CVSS v4.0 9.3; weakness CWE-347; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Until upgrading, verify output addresses and amounts are as expected whenever signing any transaction. Connect only to a trusted server, such as one you run. Electrum's GitHub security advisory reports that some servers are performing this attack in the wild. ([github.com](https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v))
Affected: Electrum <4.8.3. ([github.com](https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v))
Fix: Electrum 4.8.3. ([github.com](https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v))
Panel assessment: Electrum below 4.8.3 should be patched now, because malicious servers are already running this attack in the wild and the outcome is irreversible loss of funds rather than a recoverable compromise. A hostile server substitutes a just-broadcast transaction and coaxes the user into signing a fee bump, so the approval that reaches the chain pays attacker-chosen outputs; the reach is wallet value and any treasury or payment workflow that depends on it, not credentials or pipelines. Check first which Electrum versions are deployed and which server each wallet connects to, since connecting only to a trusted or self-run server removes the exposure while upgrades roll out. (priority: patch now)
Action: Map CVE-2026-117601 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-6jp4-8v48-cc5v)
Finding 07 — Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm 'br_table' instruction
What changed: GitHub Advisory Database published GHSA-mghf-wjfp-p5xm for CVE-2026-115893 (Wasmtime): CWE-691, CVSS v3.1 9.9; affected: All Wasmtime/Cranelift versions supporting aarch64 since that support was introduced in 2020, before Wasmtime v1.0.
Technical evidence: CVE-2026-115893; CVSS v3.1 9.9; weakness CWE-691; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Analyst note: Block user-controlled Wasm modules containing any br_table instruction with more than approximately 256,000 targets from reaching Cranelift on aarch64. ([github.com](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm))
Affected: All Wasmtime/Cranelift versions supporting aarch64 since that support was introduced in 2020, before Wasmtime v1.0. ([github.com](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm))
Fix: Wasmtime v36.0.19, v48.0.7 and v49.0.4. ([github.com](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm))
Panel assessment: Wasmtime needs immediate patching on any aarch64 host that compiles Wasm it does not fully control, because the defect sits in every release carrying aarch64 support since 2020 and it breaks the sandbox boundary that embedders treat as their only isolation layer. The plausible path is an attacker-submitted module with an enormous br_table that makes Cranelift emit a jump to the wrong target, subverting intended control flow inside the host process and reaching whatever that process holds, such as service credentials, build pipeline secrets or tenant data in a shared runtime. Check first which services accept third party or user supplied Wasm on aarch64 and whether they run v36.0.19, v48.0.7 or v49.0.4, treating the large br_table block as interim cover only. (panel view at moderate confidence; priority: patch now)
Action: Map CVE-2026-115893 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-mghf-wjfp-p5xm)
Finding 08 — Multiple vulnerabilities in Linux Kernel
What changed: CVE coverage: CVE-2026-46300, CVE-2023-53675, CVE-2023-53676, CVE-2023-53680. The cited advisories disclose: Missing Initialization of a Variable Vulnerability — Kernel; the following vulnerability has been resolved: scsi: ses: Fix possible desc_ptr out-of-bounds accesses Sanitize possible desc_ptr out-of-bounds accesses in ses_enclosure_data_process; the following vulnerability has been resolved: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show The function lio_target_nacl_info_show uses sprintf in a loop to print details for every iSCSI connection in a session without checking for the buffer length.
Technical evidence: CVE-2026-46300; CVSS v3.1 7.8; weakness CWE-456; technical confidence High.
Why it matters: Reported active exploitation elevates this above routine patching: validate exposure immediately, remediate, and assess for prior compromise.
Observed status: Observed in-the-wild exploitation is confirmed.
Analyst note: If mitigations are unavailable, CISA directs organisations to discontinue use of the product. CISA reports that CVE-2026-46300 can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP web shells and run commands as root. ([cisa.gov](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-46300), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2023-53675), +2 more)
Affected: versions 3.9; versions 2.6.25; versions 3.1 ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-46300), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2023-53675), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2023-53676), +1 more)
Fix: The Linux CNA records identify the original-commit fixed versions as 7.1 for CVE-2026-46300, 6.3 for CVE-2023-53675, 6.6 for CVE-2023-53676 and 6.3 for CVE-2023-53680. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-46300), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2023-53675), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2023-53676), +1 more)
Panel assessment: Patch the Linux kernel now for CVE-2026-46300: it is confirmed under active exploitation and CISA documents a chain with CVE-2026-109618 and CVE-2026-109619 that implants PHP web shells and runs commands as root, so a web-facing foothold becomes full host control, and CISA's own fallback is to stop using the product where mitigations do not exist. Root on the host means every credential, token, data store and build artefact that host touches is reachable, and any trust it holds towards other systems should be treated as compromised, not merely exposed. (panel view at moderate confidence; priority: patch now)
Action: Map CVE-2026-46300 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: cisa.gov](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?vulnId=CVE-2026-46300)
Finding 09 — Microsoft Authenticator: Improper Authentication
What changed: Microsoft patched an Authenticator vulnerability that could have let malicious apps steal access tokens.
Technical evidence: CVE-2026-80097; CVSS v3.1 8.6; weakness CWE-287; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Enclave reports successfully testing token theft against a signed-in work account. ([enclave.ai](https://enclave.ai/blog/authmask-we-made-microsoft-authenticator-hand-over-tokens), [heise.de](https://www.heise.de/en/news/Microsoft-Authenticator-flaw-let-malicious-apps-steal-access-tokens-11503446.html))
Affected: Microsoft Authenticator for Android versions before 6.2606.4246. ([enclave.ai](https://enclave.ai/blog/authmask-we-made-microsoft-authenticator-hand-over-tokens))
Fix: Microsoft Authenticator for Android 6.2606.4246 or later. ([heise.de](https://www.heise.de/en/news/Microsoft-Authenticator-flaw-let-malicious-apps-steal-access-tokens-11503446.html))
Panel assessment: Microsoft Authenticator for Android should be pushed to 6.2606.4246 or later ahead of routine patching, because working token theft has already been demonstrated against a signed-in work account and the attack needs no user interaction once a malicious app is present. The practical path is a hostile app on the same handset abusing the broker role to obtain delegated access tokens, which reach mailbox, files and calendar directly and sidestep the multifactor prompt the app exists to enforce, so stolen tokens are useful even where passwords are unknown. Check the installed Authenticator build across managed Android devices first and treat any handset below that version with a signed-in corporate account as the priority group. (priority: patch now)
Action: Map CVE-2026-80097 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: heise.de](https://www.heise.de/en/news/Microsoft-Authenticator-flaw-let-malicious-apps-steal-access-tokens-11503446.html)
Finding 10 — Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability
What changed: A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group.
Technical evidence: CVE-2026-76418; CVSS v3.1 8.6; weakness CWE-690; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Temporarily disable secondary authentication on every user-configured tunnel group list and on DefaultWEBVPNGroup. If DefaultWEBVPNGroup does not use secondary authentication, disable the tunnel group list with no tunnel-group-list enable; otherwise remove secondary authentication with no secondary-authentication-server-group. Cisco PSIRT reports active exploitation in October 2026. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75))
Affected: Affected builds precede the first-fixed releases in ASA trains 9.16 and earlier, 9.18, 9.20, 9.22, 9.23 and 9.24, and FTD trains 7.0 and earlier, 7.2, 7.4, 7.6, 7.7, 10.0 and 10.1. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75))
Fix: ASA: 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1. FTD: 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75))
Panel assessment: Cisco Secure Firewall ASA and FTD running Remote Access SSL VPN warrant emergency patching because exploitation is already happening, no credentials are needed, and the device is deliberately exposed to the internet, so the outage hits the remote workforce and anything behind that firewall at once. The attack path is a crafted connection request to a tunnel group with secondary authentication configured, which forces a reload rather than giving access to credentials, pipelines or data, so treat it as repeatable availability loss and as cover for noise during other activity. (priority: patch now)
Action: Map CVE-2026-76418 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Secure%20Firewall%20Adaptive%20Security%20Appliance%20and%20Secure%20Firewall%20Threat%20Defense%20Software%20Remote%20Access%20SSL%20VPN%20Tunnel%20Denial%20of%20Service%20Vulnerability%26vs_k=1)
Finding 11 — Multiple vulnerabilities in Alpine iLX-F511
What changed: CVE coverage: CVE-2026-118610, CVE-2026-118606, CVE-2026-118605, CVE-2026-118602, CVE-2026-118611, CVE-2026-118609, CVE-2026-118607, CVE-2026-118604, CVE-2026-118601, CVE-2026-118608. The cited advisories disclose: Android Auto Service Stack-based Buffer Overflow Remote Code Execution Vulnerability; Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability; prh_sdp_service_search_decode Stack-based Buffer Overflow Remote Code Execution Vulnerability; Fiv.System Exposed Dangerous Method Local Privilege Escalation Vulnerability; Bluetooth OBEX Packet Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability; Android Auto Connection Handler Stack-based Buffer Overflow Remote Code Execution Vulnerability; diagapp Command Injection Vulnerability; Framework Service Stack-based Buffer Overflow Remote Code Execution Vulnerability; SSH Hard-Coded Credentials Remote Code Execution Vulnerability; libanwbtstack.so prh_rfcomm_cc_process_test Out-Of-Bounds Read Information Disclosure Vulnerability.
Technical evidence: CVE-2026-118610; CVSS v3.1 8.8; weakness CWE-121; technical confidence Medium.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Analyst note: Restrict interaction with Alpine iLX-F511 devices. ([zerodayinitiative.com](https://www.zerodayinitiative.com/advisories/ZDI-26-828/), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-118610), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-118606), +8 more)
Affected: Alpine iLX-F511 version 7.0.000. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-118610), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-118606), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-118605), +7 more)
Panel assessment: Alpine iLX-F511 at version 7.0.000 carries ten flaws with no fix named in the record, so the only stated mitigation is restricting interaction, which leaves any deployed unit exposed indefinitely rather than temporarily. The practical path is a nearby attacker sending crafted Bluetooth OBEX or Android Auto traffic to overflow the parsing code and run code on the head unit, with exposed dangerous methods then raising privileges locally; what that reaches is the paired phone relationship and whatever contact, call and location data the unit holds, not enterprise systems on the evidence here. If these units are in fleet vehicles or pool cars, first confirm the firmware version and whether Bluetooth pairing and Android Auto can be disabled centrally rather than left to drivers. (panel view at moderate confidence; priority: this week)
Action: Map CVE-2026-118610 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: zerodayinitiative.com](http://www.zerodayinitiative.com/advisories/ZDI-26-828/)
Finding 12 — Ultralytics: Path Traversal (zero-day)
What changed: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
Technical evidence: CVE-2026-118619; CVSS v3.1 8.8; weakness CWE-22; technical confidence Medium.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Analyst note: Restrict interaction with the product. ([zerodayinitiative.com](https://www.zerodayinitiative.com/advisories/ZDI-26-818/), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-118619))
Affected: Ultralytics 8.4.103. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-118619))
Panel assessment: Ultralytics has no fixed version listed and the advisory's only stated mitigation is restricting interaction with the product, so treat this as containment work rather than patching, and prioritise it wherever the library sits in automated or shared machine learning workflows. The flaw is reached through the Google Drive download path, so a crafted dataset or weights link that a user opens can write files outside the intended directory and gain code execution with whatever the process holds, which on a training or inference host commonly means API tokens, model artefacts and pipeline credentials. First establish whether any Ultralytics instance fetches datasets or weights from Google Drive or other externally supplied URLs, and gate or disable that path until a fix exists. (panel view at moderate confidence; priority: patch now)
Action: Map CVE-2026-118619 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: zerodayinitiative.com](http://www.zerodayinitiative.com/advisories/ZDI-26-818/)
Finding 13 — vLLM DeepSeek-OCR image processing vulnerable to denial of service
What changed: GitHub Advisory Database published GHSA-gq5q-89c7-vhvx for CVE-2026-115914 (vLLM DeepSeek-OCR image processing): Reachable Assertion, CVSS v3.1 6.5; affected: vLLM versions >= 0.11.1 and < 0.32.0.
Technical evidence: CVE-2026-115914; CVSS v3.1 6.5; weakness CWE-617; technical confidence Medium.
Why it matters: The Medium priority requires exposure validation and scheduled remediation through normal change control.
Analyst note: If patching is not possible, block untrusted access to OpenAI-compatible API endpoints serving DeepSeek-OCR, DeepSeek-OCR-2 or Unlimited-OCR. ([api.osv.dev](https://api.osv.dev/v1/vulns/GHSA-gq5q-89c7-vhvx), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-115914))
Affected: vLLM versions >= 0.11.1 and < 0.32.0. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-115914))
Fix: vLLM version 0.32.0. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-115914))
Panel assessment: vLLM serving DeepSeek-OCR, DeepSeek-OCR-2 or Unlimited-OCR should be moved to 0.32.0 ahead of routine queues, because the crash is deterministic rather than probabilistic and a single request from any client that can reach the endpoint takes the whole serving process down, which matters more than the modest score suggests when one instance backs many downstream consumers. The path is a crafted image request to the OpenAI-compatible API triggering a reachable assertion, so the loss is availability of the inference tier and anything queued behind it, with nothing in the record pointing to credential or data exposure. (priority: this week)
Action: Map CVE-2026-115914 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-gq5q-89c7-vhvx)
Finding 14 — Apple Safari jsToWasm IC Entrypoint Type Confusion Remote Code Execution Vulnerability
What changed: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple Safari. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
Why it matters: The cited reporting affects widely deployed technology, so exposure validation and source verification need explicit ownership.
Observed status: Observed in-the-wild exploitation status is unknown.
Affected: NVD affected ranges: Safari <27.2; iOS and iPadOS <26.7.2 and <27.2; macOS <27.2; visionOS <27.2. ([services.nvd.nist.gov](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-86974))
Fix: Safari 27.2; iOS 26.7.2 and iPadOS 26.7.2; iOS 27.2 and iPadOS 27.2; macOS Golden Gate 27.2; visionOS 27.2. ([services.nvd.nist.gov](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-86974))
Panel assessment: Apple Safari and the WebKit engine shipped inside iOS, iPadOS, macOS and visionOS should be moved to the fixed releases within the normal weekly cycle, because no exploitation has been observed and predicted attack activity is low, but the browser is internet facing by design and the affected ranges cover the whole Apple estate including the older iOS 26 branch that many managed fleets sit on. The realistic path is a user led one, a phishing link or a malicious document opened in the browser, giving an attacker code execution as the logged in user and therefore access to browser sessions, saved tokens, local files and any internal application the device can already reach without further authentication. (panel view at moderate confidence; priority: this week)
Action: Review the cited source, validate exposure of the affected technology in owned environments, apply available vendor guidance, and retain evidence of the exposure decision.
Evidence limits: grounded severity unavailable
[Evidence source: zerodayinitiative.com](http://www.zerodayinitiative.com/advisories/ZDI-26-830/)
Finding 15 — Apple macOS CoreText GDEF LigCaretList Out-Of-Bounds Read Information Disclosure Vulnerability
What changed: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Apple macOS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
Why it matters: The cited reporting affects widely deployed technology, so exposure validation and source verification need explicit ownership.
Observed status: Observed in-the-wild exploitation status is unknown.
Affected: macOS versions before 15.8.2, 26.7.2 or 27.2. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-112656))
Fix: macOS Golden Gate 27.2, macOS Sequoia 15.8.2 and macOS Tahoe 26.7.2. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-112656))
Panel assessment: Apple macOS fits routine patching here, because the CoreText GDEF LigCaretList flaw leaks memory rather than granting execution, it needs a user to open attacker supplied content, and there is no evidence of exploitation in the wild. The realistic path is a crafted font embedded in a web page or document that triggers an out of bounds read during text layout and returns fragments of process memory, which is most useful as an address leak feeding a later exploit chain rather than as direct access to credentials, pipelines or stored data. First confirm which managed Macs sit below Sequoia 15.8.2, Tahoe 26.7.2 or Golden Gate 27.2, since fleets pinned to older builds for compatibility are the ones that will quietly stay exposed. (panel view at moderate confidence; priority: routine)
Action: Review the cited source, validate exposure of the affected technology in owned environments, apply available vendor guidance, and retain evidence of the exposure decision.
Evidence limits: grounded severity unavailable
[Evidence source: zerodayinitiative.com](http://www.zerodayinitiative.com/advisories/ZDI-26-831/)