Executive assessment
Today's brief leads with Cisco Catalyst SD-WAN Controller: exploitation tied to Volt Typhoon. All 14 selected findings retain their own technical scope, action, observed status, and evidence limits.
Also today: 3 more zip CVEs (CVE-2026-115907, CVE-2026-115906, CVE-2026-115909) in the same disclosure wave as the zip card of 2026-10-29; none reported exploited; carried as a note rather than a finding.
Also today: 3 more Crass CVEs (CVE-2026-61848, CVE-2026-61847, CVE-2026-61846) in the same disclosure wave as the Crass card of 2026-10-21; none reported exploited; carried as a note rather than a finding.
Finding 01 — Cisco Catalyst SD-WAN Controller: exploitation tied to Volt Typhoon
What changed: Follow-up to the 2026-10-29 card. Cisco Talos linked KeyDrift malware on Catalyst SD-WAN controllers to UAT-11473 infrastructure overlapping Volt Typhoon’s Silent Train network. CVE-2026-20127 is a CVSS 10 unauthenticated controller-peering bypass used to obtain administrative control and harvest encryption keys.
Technical evidence: CVE-2026-20127; CVSS v3.1 10; weakness CWE-287; technical confidence High.
Why it matters: Reported active exploitation elevates this above routine patching: validate exposure immediately, remediate, and assess for prior compromise.
Observed status: Observed in-the-wild exploitation is confirmed.
Analyst note: For self-hosted deployments, restrict ports 22 and 830 with ACLs, security-group rules or firewall rules to known controller and other known IP addresses, and allow IP traffic to control components only from specified hosts or devices that require access. Audit /var/log/auth.log for 'Accepted publickey for vmanage-admin' entries from unknown or unauthorised IP addresses. Cisco PSIRT reports limited exploitation of the vulnerability. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk))
Affected: Affected release lines are earlier than 20.9, 20.9, 20.11, 20.12, 20.13, 20.14, 20.15, 20.16 and 20.18, up to each line's first fixed release. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk))
Fix: First fixed releases are 20.9.8.2 for 20.9; 20.12.6.1 for 20.11; 20.12.5.3 or 20.12.6.1 for 20.12; 20.15.4.2 for 20.13 through 20.15. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk))
Panel assessment: Cisco Catalyst SD-WAN controllers sit above the fabric they manage, so an unauthenticated peering bypass that is already being used in the wild turns one reachable controller into administrative control of every site it provisions, which is why patching to the fixed release for your line cannot wait for a normal change window. The plausible path is reaching the controller over its management and peering ports, bypassing authentication entirely, then taking admin rights and harvesting encryption keys, which gives durable access to the control plane and the trust that protects traffic between managed devices rather than a single host. (priority: patch now)
Action: Map CVE-2026-20127 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: blog.talosintelligence.com](https://blog.talosintelligence.com/uat-11473-keydrift/)
Finding 02 — Multiple vulnerabilities in MLflow
What changed: CVE coverage: CVE-2026-71211, CVE-2024-37052, CVE-2026-118628, CVE-2026-118627, CVE-2026-118623, CVE-2026-64849, CVE-2026-118626, CVE-2026-118625, CVE-2026-118624. The cited advisories disclose: AI Gateway Server-Side Request Forgery Information Disclosure Vulnerability; Statsmodels _load_model Deserialization of Untrusted Data Remote Code Execution Vulnerability; get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability; SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability; PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability; Webhook Server-Side Request Forgery Vulnerability; Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability; Tracking Server Missing Authorization Privilege Escalation Vulnerability; Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability.
Technical evidence: CVE-2026-64849; CVSS v3.1 9.3; weakness CWE-918; technical confidence High.
Why it matters: Reported active exploitation elevates this above routine patching: validate exposure immediately, remediate, and assess for prior compromise.
Observed status: Observed in-the-wild exploitation is confirmed.
Panel assessment: MLflow needs patching now because one of the server-side request forgery flaws is confirmed under active exploitation, and MLflow tracking servers typically sit on internal networks holding artefact store credentials and cloud role access, so a single reachable instance is a pivot into the whole ML estate. The practical path is an unauthenticated request that makes the server fetch an attacker-chosen URL, returning internal service responses or cloud metadata credentials, after which the deserialisation flaws in model loading turn an uploaded or registered artefact into code execution on the host and anything its pipelines touch. (panel view at moderate confidence; priority: patch now)
Action: Map CVE-2026-64849 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: zerodayinitiative.com](http://www.zerodayinitiative.com/advisories/ZDI-26-847/)
Finding 03 — Still active: Linux Kernel: 6 further CVEs in the advisory covered on 2026-10-29
Coverage status: First reported 2026-10-29; ongoing coverage.
What changed: Follow-up to the 2026-10-29 card. CVE coverage: CVE-2026-98432, CVE-2026-98231, CVE-2026-72315, CVE-2026-93826, CVE-2026-80844, CVE-2026-46300. The cited advisories disclose: TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions; XFRM Subsystem Use-After-Free Local Privilege Escalation Vulnerability; CIFS File System Use-After-Free Privilege Escalation Vulnerability; Logitech HIDPP Protocol Use-After-Free Local Privilege Escalation Vulnerability; IPv6 AH Routing Header Integer Underflow Local Privilege Escalation Vulnerability; the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce can attach paged frags from @from to @to.
Technical evidence: CVE-2026-98432; CVSS v3.1 9.8; technical confidence High.
Why it matters: Reported active exploitation elevates this above routine patching: validate exposure immediately, remediate, and assess for prior compromise.
Observed status: The cited source reports active in-the-wild exploitation; independent corroboration (CISA KEV or grounded vendor data) is not yet available.
Analyst note: CISA added CVE-2026-46300 to its Known Exploited Vulnerabilities catalogue on 28 October 2026. ([openwall.com](http://www.openwall.com/lists/oss-security/2026/10/30/1), [cert-portal.siemens.com](https://cert-portal.siemens.com/productcert/html/ssa-082556.html), [cisa.gov](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json), +6 more)
Affected: versions 4.4 ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-98432), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-98231), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-72315), +3 more)
Fix: versions 6.12.113 ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-98432), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-98231), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-72315), +3 more)
Panel assessment: Patch Linux kernel hosts now: CVE-2026-46300 sits in CISA's Known Exploited Vulnerabilities catalogue, and the bundle pairs a remotely reachable TCP defect with four local use after free flaws, so the exposed population spans servers, container hosts and appliances rather than one niche role. The realistic chain is memory corruption in packet handling for remote entry, or any low privilege foothold escalated through XFRM, CIFS, HIDPP or IPv6 handling to root, which exposes host credentials, mounted data and build runner secrets. Check first which running kernels sit below the vendor fixed build for CVE-2026-46300, remembering that containers inherit the host kernel and report nothing of their own. (panel view at moderate confidence; priority: patch now)
Action: Map CVE-2026-98432 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: exploitation reported by the source, not independently corroborated
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-46300)
Finding 04 — Multiple vulnerabilities in Hitachi Energy CoreTec and TRO600 series products
What changed: CVE coverage: CVE-2026-13162, CVE-2026-43284, CVE-2026-10756, CVE-2026-106087. The cited advisories disclose: OS Command Injection; Missing Authentication for Critical Function.
Technical evidence: CVE-2026-13162; CVSS v4.0 7.7; weakness CWE-78; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Analyst note: Minimise network exposure for control-system devices and ensure they are not internet-accessible. Place control-system networks and remote devices behind firewalls and isolate them from business networks. ([cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-26-302-03), [cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-26-302-02), [github.com](https://github.com/V4bel/dirtyfrag))
Affected: CoreTec5 3.4.0 and prior; CoreTec4 3.4.0 and prior; TRO600 9.2.1.6 and prior, plus TRO600 9.1.1.0 and prior for CVE-2026-106087. ([cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-26-302-03), [cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-26-302-02))
Fix: CoreTec5 5.0.0; TRO600 9.2.2.1; CVE-2026-106087 is also fixed in TRO600 9.1.2.0. ([cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-26-302-03), [cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-26-302-02))
Action: Map CVE-2026-13162 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-26-302-03)
Finding 05 — Shopify App: Incorrect Authorization
What changed: GitHub Advisory Database published GHSA-6j52-38f8-qhxr for CVE-2026-63414 (Shopify App): Incorrect Authorization, CVSS v4.0 7.6; affected: shopify_app versions >= 22.1.0 and < 23.0.3.
Technical evidence: CVE-2026-63414; CVSS v4.0 7.6; weakness CWE-863; technical confidence Medium.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Analyst note: Do not use params[:shop] for authorisation, tenant lookup, access-token selection or data scoping. Reject a request with 401 Unauthorized when a sanitised params[:shop] value does not match the authenticated shop. ([github.com](https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxr))
Affected: shopify_app versions >= 22.1.0 and < 23.0.3. ([github.com](https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxr))
Fix: shopify_app version 23.0.3. ([github.com](https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxr))
Panel assessment: Shopify App, the shopify_app gem, needs upgrading to 23.0.3 wherever 22.1.0 up to 23.0.3 runs, because a cross shop authorisation bypass in a multi tenant app breaks the one boundary that keeps merchants apart, so a single affected app leaks across its whole installed base rather than one shop. The likely path is a request carrying a shop parameter for a different tenant that the app then trusts for lookup, access token selection or data scoping, reaching that shop's stored offline access tokens and merchant data rather than infrastructure or build systems. Check the installed gem version first, then grep the codebase for every use of params[:shop] and reject any that does not match the authenticated shop. (priority: this week)
Action: Map CVE-2026-63414 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-6j52-38f8-qhxr)
Finding 06 — PraisonAI: OS Command Injection
What changed: GitHub Advisory Database published GHSA-26mh-57q7-jfvr for CVE-2026-61438 (PraisonAI): OS Command Injection, CVSS v4.0 7; affected: Versions before 4.6.78.
Technical evidence: CVE-2026-61438; CVSS v4.0 7; weakness CWE-78; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Keep PRAISONAI_ALLOW_JOB_WORKFLOWS disabled and do not execute YAML workflow files from untrusted sources. ([raw.githubusercontent.com](https://raw.githubusercontent.com/github/advisory-database/main/advisories/github-reviewed/2026/10/GHSA-26mh-57q7-jfvr/GHSA-26mh-57q7-jfvr.json), [services.nvd.nist.gov](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-61438))
Affected: Versions before 4.6.78. ([services.nvd.nist.gov](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-61438))
Fix: 4.6.78. ([services.nvd.nist.gov](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-61438))
Action: Map CVE-2026-61438 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-26mh-57q7-jfvr)
Finding 07 — decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs
What changed: GitHub Advisory Database published GHSA-qr28-fpjm-wq7f for CVE-2026-118664 (decode-uri-component): Uncontrolled Resource Consumption, CVSS v4.0 8.2; affected: decode-uri-component versions <= 0.5.0.
Technical evidence: CVE-2026-118664; CVSS v4.0 8.2; weakness CWE-400, CWE-407; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Reject malformed percent-encoded input before it reaches decodeUriComponent(), especially trailing invalid sequences such as %zz. Disable request-body decoding through this package, including query-string.parse(), until patched. GitHub's reviewed advisory publishes proof-of-concept code that it says takes about 20 seconds. ([raw.githubusercontent.com](https://raw.githubusercontent.com/github/advisory-database/main/advisories/github-reviewed/2026/10/GHSA-qr28-fpjm-wq7f/GHSA-qr28-fpjm-wq7f.json))
Affected: decode-uri-component versions <= 0.5.0. ([raw.githubusercontent.com](https://raw.githubusercontent.com/github/advisory-database/main/advisories/github-reviewed/2026/10/GHSA-qr28-fpjm-wq7f/GHSA-qr28-fpjm-wq7f.json))
Fix: decode-uri-component 0.5.1. ([raw.githubusercontent.com](https://raw.githubusercontent.com/github/advisory-database/main/advisories/github-reviewed/2026/10/GHSA-qr28-fpjm-wq7f/GHSA-qr28-fpjm-wq7f.json))
Panel assessment: Patch decode-uri-component to 0.5.1 promptly, because a single small malformed request costs the attacker nothing while a published proof of concept shows roughly 20 seconds of blocked processing, and the package is almost always pulled in transitively beneath query string parsing rather than chosen deliberately. The path is availability only, with unauthenticated input reaching a decoder on request bodies or query strings and starving the event loop, so expect outages and failed health checks rather than exposure of credentials, pipelines or data. Check the resolved lockfile for decode-uri-component at or below 0.5.0 anywhere in the tree, including behind query-string, and confirm whether that code path handles externally supplied input. (priority: patch now)
Action: Map CVE-2026-118664 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-qr28-fpjm-wq7f)
Finding 08 — zip2: Path Traversal
What changed: CVE-2026-115908 allows files to be written outside the intended extraction directory because ZipArchive::extract validates symlink targets lexically.
Technical evidence: CVE-2026-115908; CVSS v3.1 7.4; weakness CWE-22, CWE-59, CWE-61; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Block untrusted ZIP archives from reaching ZipArchive::extract or ZipArchive::extract_unwrapped_root_dir. If extraction is unavoidable, restrict the process to a disposable filesystem with minimal write access. The zip-rs GitHub security advisory reports a working PoC that writes outside the destination. ([github.com](https://github.com/zip-rs/zip2/security/advisories/GHSA-hjqx-j4rw-g7xv))
Affected: Affected versions: 7.2.0 and later ([github.com](https://github.com/zip-rs/zip2/security/advisories/GHSA-hjqx-j4rw-g7xv))
Fix: zip (Rust) version 9.0.0. ([github.com](https://github.com/zip-rs/zip2/security/advisories/GHSA-hjqx-j4rw-g7xv))
Panel assessment: Upgrade the Rust zip crate to 9.0.0 wherever untrusted archives are extracted, because a published proof of concept turns a routine decompression into an arbitrary file write with the extracting process's own privileges, and the crate is a transitive dependency that often sits in unglamorous ingestion paths nobody reviews. The practical path is an uploaded or fetched archive carrying a two-stage absolute-path symlink, which lets the attacker land content wherever that process can write, so overwritten configuration, credential files, cron or startup entries and CI artefacts become the real target rather than the extraction directory itself. (priority: patch now)
Action: Map CVE-2026-115908 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-hjqx-j4rw-g7xv)
Finding 09 — cert-manager: Incorrect Authorization
What changed: GitHub Advisory Database published GHSA-8rvj-mm4h-c258 for CVE-2026-62290 (cert-manager): Incorrect Authorization, CVSS v3.1 7.3.
Technical evidence: CVE-2026-62290; CVSS v3.1 7.3; weakness CWE-863; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Remove Challenge and Order creation permissions from aggregate edit; add admission validation or CEL rules that prevent direct user control over sensitive solver fields. ([raw.githubusercontent.com](https://raw.githubusercontent.com/github/advisory-database/main/advisories/github-reviewed/2026/10/GHSA-8rvj-mm4h-c258/GHSA-8rvj-mm4h-c258.json))
Fix: Versions 1.19.6 and 1.20.3. ([raw.githubusercontent.com](https://raw.githubusercontent.com/github/advisory-database/main/advisories/github-reviewed/2026/10/GHSA-8rvj-mm4h-c258/GHSA-8rvj-mm4h-c258.json))
Action: Map CVE-2026-62290 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-8rvj-mm4h-c258)
Finding 10 — Multiple vulnerabilities in Keycloak
What changed: Keycloak carries 5 CVEs across 5 advisories: Attacker can re-enable and take over disabled clients via registration; Authorization Bypass Through User-Controlled Key; Cross-site Scripting; Authorization bypass via incorrect uri comparison; Path Traversal. CVE coverage: CVE-2026-9705, CVE-2026-9799, CVE-2026-9086, CVE-2026-9800, CVE-2026-9083.
Technical evidence: CVE-2026-9086; CVSS v3.1 7.3; weakness CWE-79; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-9086 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: github.com](https://github.com/advisories/GHSA-v3f7-2p4r-mwfw)
Finding 11 — Siemens Mendix SAML Module: Authentication Bypass by Capture-replay
What changed: Mendix SAML module contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access by replaying a valid SAML assertion in IdP-initiated authentication flows. Siemens has released new versions for the affected products and recommends to update to the latest versions.
Technical evidence: CVE-2026-89209; CVSS v3.1 6.8; weakness CWE-294; technical confidence High.
Why it matters: The Medium priority requires exposure validation and scheduled remediation through normal change control.
Observed status: Observed in-the-wild exploitation status is unknown.
Analyst note: Disable IdP-initiated SSO. ([cert-portal.siemens.com](https://cert-portal.siemens.com/productcert/html/ssa-137528.html))
Affected: Mendix SAML for Mendix 9: all versions before V3.6.29; for Mendix 10 and 11: all versions before V4.2.4. ([cert-portal.siemens.com](https://cert-portal.siemens.com/productcert/html/ssa-137528.html))
Fix: Mendix 9-compatible module: V3.6.29 or later; Mendix 10- and 11-compatible modules: V4.2.4 or later. ([cert-portal.siemens.com](https://cert-portal.siemens.com/productcert/html/ssa-137528.html))
Panel assessment: Siemens Mendix SAML module deserves a scheduled fix this week rather than an emergency change, because replaying a captured assertion needs no credentials and no reported exploitation exists, yet it yields authenticated access to a low code application that often fronts business data and integrations. The practical path is an attacker obtaining a valid assertion from an identity provider initiated flow, through logs, proxies or a shared browser, and replaying it to impersonate that user, so the reach is whatever that account sees, including connected data sources and any onward API tokens the app holds. Check first whether identity provider initiated SSO is enabled at all, since disabling it removes the exposed flow immediately and makes the module upgrade a routine change. (panel view at moderate confidence; priority: this week)
Action: Map CVE-2026-89209 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-26-302-01)
Finding 12 — Vite: server.fs.deny bypassed with queries
What changed: GitHub Advisory Database published GHSA-8g5g-mxqh-grgj for CVE-2026-118662 (Vite): CWE-180, CWE-284, CVSS v4.0 6.9; affected: Vite versions >= 6.4.4 and < 6.4.5.
Technical evidence: CVE-2026-118662; CVSS v4.0 6.9; weakness CWE-180, CWE-284; technical confidence High.
Why it matters: The Medium priority requires exposure validation and scheduled remediation through normal change control.
Observed status: Observed in-the-wild exploitation status is unknown.
Analyst note: Do not expose the Vite development server to the network, and keep sensitive files outside directories listed in server.fs.allow. ([github.com](https://github.com/vitejs/vite/security/advisories/GHSA-8g5g-mxqh-grgj), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-118662))
Affected: Vite versions >= 6.4.4 and < 6.4.5. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-118662))
Fix: Vite 6.4.5. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-118662))
Panel assessment: Vite 6.4.4 deserves patching to 6.4.5 this week rather than immediately, because the risk only materialises where the development server is deliberately bound to the network and sensitive files sit inside the allowed directories, and no exploitation is recorded; the narrow affected band also means most estates will either be unaffected or trivially upgraded. The likely path is a crafted query string that slips past the deny list's filename matching, letting anyone who can reach the port read environment files, configuration or source within the allowed roots, which is how a development convenience becomes a credential and pipeline problem. (panel view at moderate confidence; priority: this week)
Action: Map CVE-2026-118662 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-8g5g-mxqh-grgj)
Finding 13 — authd: Improper Authentication
What changed: Ali Mashally discovered that authd did not properly validate user identities when matching accounts from identity providers. An attacker could possibly use this issue to gain access to another user's local account and files, resulting in unauthorized access to sensitive information.
Technical evidence: CVE-2026-102631; CVSS v4.0 5.9; weakness CWE-287; technical confidence High.
Why it matters: The Medium priority requires exposure validation and scheduled remediation through normal change control.
Analyst note: Lock or delete the previous user's local authd account when the corresponding IdP account is removed. CISA Coordinator reports exploitation as 'none'. ([ubuntu.com](https://ubuntu.com/security/CVE-2026-102631), [services.nvd.nist.gov](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-102631))
Affected: authd before 0.7.1 ([ubuntu.com](https://ubuntu.com/security/CVE-2026-102631))
Fix: Ubuntu 26.10 (Stonking): authd 0.7.1 ([ubuntu.com](https://ubuntu.com/security/CVE-2026-102631))
Panel assessment: Authd before 0.7.1 matters where identity lifecycle is sloppy rather than where exposure is broad, so schedule the upgrade this week on managed Linux desktops and shared or multi-user hosts, and sooner wherever contractor or staff turnover is high, because nothing suggests active or automatable abuse. The realistic path is an identity collision rather than a remote exploit: a current or new identity provider account is matched to a stale local account left behind by a departed user, handing over that account's home directory, locally cached tokens, SSH keys and any files it could already read. (priority: this week)
Action: Map CVE-2026-102631 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: ubuntu.com](https://ubuntu.com/security/notices/USN-8957-1)
Finding 14 — Parse Server: Unrestricted Upload of File with Dangerous Type
What changed: GitHub Advisory Database published GHSA-r899-h629-j84r for CVE-2026-61448 (Parse Server): Unrestricted Upload of File with Dangerous Type, CVSS v4.0 2.1; affected: Parse Server versions 9.0.0 to before 9.10.0-alpha.2, and versions up to and including 8.6.83.
Technical evidence: CVE-2026-61448; CVSS v4.0 2.1; weakness CWE-434; technical confidence High.
Why it matters: The cited reporting affects widely deployed technology, so exposure validation and source verification need explicit ownership.
Observed status: Observed in-the-wild exploitation status is unknown.
Analyst note: Configure fileUpload.fileExtensions as a strict allowlist containing only required extensions. Serve uploads from a separate domain and configure the storage or CDN layer to send X-Content-Type-Options: nosniff. ([raw.githubusercontent.com](https://raw.githubusercontent.com/github/advisory-database/main/advisories/github-reviewed/2026/10/GHSA-r899-h629-j84r/GHSA-r899-h629-j84r.json), [services.nvd.nist.gov](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-61448))
Affected: Parse Server versions 9.0.0 to before 9.10.0-alpha.2, and versions up to and including 8.6.83. ([services.nvd.nist.gov](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-61448))
Panel assessment: Parse Server treats this as a routine patch item because exploitation is unreported and the attacker needs upload rights already, but the fix is cheap and the risk concentrates entirely in deployments that accept user files. The practical path is an upload whose malformed Content-Type slips past the extension blocklist, then renders as script in the application origin when someone views it, reaching session cookies, tokens and any same origin data or admin action the viewer holds. Check first whether uploads are served from the application's own origin, because same origin serving without a strict fileUpload.fileExtensions allowlist and nosniff is what turns a blocked extension into working stored script. (panel view at moderate confidence; priority: routine)
Action: Map CVE-2026-61448 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: github.com](https://github.com/advisories/GHSA-r899-h629-j84r)