CISA Adds Four Exploited Vulnerabilities to KEV Catalog

Defenders should prioritize patching vulnerabilities in Palo Alto Networks, Cisco, and Ahsay due to their inclusion in the KEV Catalog. Additionally, address the BeyondTrust Remote Support vulnerability exploited by ARMORY CASTLE. Focus on securing systems against credential theft and unauthorized file uploads.

Threat level high

Today in 60 seconds

Critical·KEV·CVSS 10.0·7 outlets CISA Adds Four Exploited Vulnerabilities to KEV Catalog Four vulnerabilities across Palo Alto Networks, Cisco, and Ahsay were added to the KEV Catalog due to active exploitation. Do this today Prioritize remediation for CVE-2026-0322, CVE-2026-76519, CVE-2026-105133, and CVE-2026-105134.
High·CVSS 9.3 ARMORY CASTLE Exploits BeyondTrust Remote Support via CVE-2026-102764 ARMORY CASTLE exploited a BeyondTrust vulnerability to achieve arbitrary file upload, privilege escalation, and credential theft. Do this today Apply security patches provided by BeyondTrust to remediate CVE-2026-102764.
High·4 outlets Legal Aid Agency: Breach Stole Records Dating to 1978 Attackers breached the Legal Aid Agency, stealing sensitive records spanning from 1978 to the present.

Actively Exploited 4

CISA Adds Four Exploited Vulnerabilities to KEV Catalog Critical·KEV·CVSS 10.0·7 outlets·CISADay 2NewRead Four vulnerabilities across Palo Alto Networks, Cisco, and Ahsay were added to the KEV Catalog due to active exploitation.
CISA added four vulnerabilities to the Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. The affected vulnerabilities include CVE-2026-0322 (Palo Alto Networks PAN-OS Code Injection), CVE-2026-76519 (Cisco Secure Email Gateway Relative Path Traversal), CVE-2026-105133 (Ahsay AhsayCBS Improper Authentication), and CVE-2026-105134 (Ahsay AhsayCBS Command Injection).

Why it matters. These vulnerabilities represent active attack vectors that pose significant risk to exposed assets. Organizations should prioritize remediation for KEV listed CVEs to reduce immediate risk exposure.

Do this today Prioritize remediation for CVE-2026-0322, CVE-2026-76519, CVE-2026-105133, and CVE-2026-105134.

Affected
Palo Alto Networks PAN-OS, Cisco Secure Email Gateway, Ahsay AhsayCBS

CVE
CVE-2026-0316, CVE-2026-0317, CVE-2026-0319, +4 more
1. Thu 15 OctCISA Adds Four Exploited Vulnerabilities to KEV Catalog
2. TodayCISA Adds Four Exploited Vulnerabilities to KEV Catalog
Read on CISA Post on X LinkedIn

Also covered by Palo Alto Networks PSIRT
```
{"coverage":1,"evidence":1,"freshness":0.358,"importance":1,"novelty":0.6,"quality":0.95,"total":0.891}
```
A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days Critical·KEV·CVSS 8.8·EPSS 26%·13 outlets·CISADay 3NewRead Active in-the-wild exploitation of a vulnerability chain allows unauthenticated RCE in Ivanti Connect Secure VPN devices.
Active in-the-wild exploitation of a vulnerability chain allows unauthenticated RCE in Ivanti Connect Secure VPN devices.

CVE
CVE-2026-102866, CVE-2026-104935, CVE-2026-21510, +2 more
1. Wed 14 OctIvanti Connect Secure: Active Exploitation of Two Zero-Days Added to CISA KEV
2. Thu 15 OctA Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days
3. TodayA Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days
Read on CISA Post on X LinkedIn

Also covered by Volexity, BleepingComputer
```
{"coverage":1,"evidence":1,"freshness":0.184,"importance":1,"novelty":0.6,"quality":0.95,"total":0.873}
```
Cisco Patches Multiple Vulnerabilities in Secure Email Gateway Critical·Exploited·6 outlets·Cisco PSIRTDay 2NewRead Cisco released hardening updates for Secure Email Gateway addressing multiple vulnerabilities, including two actively exploited flaws.
Cisco released software hardening updates for Secure Email Gateway and Secure Email and Web Manager following an internal security review. These updates address multiple vulnerabilities, two of which are known to be actively exploited. The flaws include SQL Injection and Arbitrary File Write capabilities.

Why it matters. Unauthenticated, remote attackers could execute commands with root privileges or write arbitrary files to the operating system. No workarounds are available for these vulnerabilities.

Do this today Upgrade Cisco Secure Email Gateway to 15.5.5-014 or 16.0, or Cisco Secure Email and Web Manager to 15.5.5-006 or 16.0.

Affected
Cisco Secure Email Gateway, Cisco Secure Email and Web Manager
1. Thu 15 OctCisco Patches Hardening Updates for Secure Email Gateway and Web Manager
2. TodayCisco Patches Multiple Vulnerabilities in Secure Email Gateway
Read on Cisco PSIRT Post on X LinkedIn

Also covered by BleepingComputer, SecurityWeek
```
{"coverage":1,"evidence":0.9,"freshness":0.4,"importance":1,"novelty":0.6,"quality":0.95,"total":0.87}
```
SonicWall SMA1000: Exploitation of Max Severity SSRF Flaw Critical·Exploited·CVSS 10.0·7 outlets·BleepingComputerDay 4NewRead Attackers are exploiting an unauthenticated SSRF flaw in SonicWall SMA1000 appliances.
Exploitation attempts targeting CVE-2026-102255 have been detected against SonicWall SMA1000 appliances. This flaw affects the Appliance WorkPlace interface, allowing unauthorized operations via a crafted OPTIONS request. The vulnerability was patched prior to detection of exploitation.

Why it matters. Unauthenticated exploitation of this SSRF flaw could allow remote attackers to perform unauthorized operations on the appliance.

Do this today Patch SonicWall SMA1000 appliances for CVE-2026-102255.

Affected
SonicWall SMA1000 6210, 7210, and 8200v

CVE
CVE-2026-102255, CVE-2026-102256, CVE-2026-102257, +1 more
1. Sat 10 OctSonicWall SMA1000: Max Severity SSRF Flaw (CVE-2026-102255)
2. Tue 13 OctSonicWall SMA1000: Unauthenticated SSRF Flaw (CVE-2026-102255) Exploited
3. Wed 14 OctSonicWall SMA1000: Unauthenticated SSRF Flaw Exploited
4. TodaySonicWall SMA1000: Exploitation of Max Severity SSRF Flaw
Read on BleepingComputer Post on X LinkedIn

Also covered by SecurityWeek, Zero Day Initiative
```
{"coverage":1,"evidence":0.9,"freshness":0.004,"importance":1,"novelty":0.6,"quality":0.95,"total":0.83}
```

Vulnerabilities & Patches 4

ARMORY CASTLE Exploits BeyondTrust Remote Support via CVE-2026-102764 High·CVSS 9.3·Google Threat IntelligenceNewRead ARMORY CASTLE exploited a BeyondTrust vulnerability to achieve arbitrary file upload, privilege escalation, and credential theft.
ARMORY CASTLE exploited CVE-2026-102764 in BeyondTrust Remote Support to achieve arbitrary file upload. The actor then established persistence by creating a webshell and escalating privileges to root via SUID bit manipulation. The actor also dumped credentials using the proprietary bt-secrets binary.

Why it matters. Successful exploitation allows attackers to gain root-level control, access stored credentials, and maintain persistent access to the appliance.

Do this today Apply security patches provided by BeyondTrust to remediate CVE-2026-102764.

Affected
BeyondTrust Remote Support appliances

CVE
CVE-2026-102764

Read on Google Threat Intelligence Post on X LinkedIn
```
{"coverage":0.387,"evidence":0.7,"freshness":0.737,"importance":0.75,"novelty":1,"quality":0.95,"total":0.727}
```
Langflow: Critical Authenticated RCE Flaw (CVE-2026-105740) High·CVSS 9.9·The Hacker NewsNewRead Threat actors are exploiting a critical, authenticated RCE vulnerability in the Langflow AI platform.
Threat actors are exploiting CVE-2026-105740, a critical security flaw in the open-source Langflow platform. This vulnerability allows for an authenticated Remote Code Execution (RCE).

Why it matters. Successful exploitation grants an attacker code execution capability within the application environment.

Do this today Review Langflow deployments for evidence of exploitation attempts.

Affected
Langflow

CVE
CVE-2026-105740

Read on The Hacker News Post on X LinkedIn
```
{"coverage":0.387,"evidence":0.7,"freshness":0.609,"importance":0.75,"novelty":1,"quality":0.8,"total":0.699}
```
CISA Malcolm: Multiple Vulnerabilities Affect Critical Infrastructure High·CVSS 8.1·CISANewRead CISA issued advisories for multiple vulnerabilities in CISA Malcolm affecting critical infrastructure sectors.
Multiple vulnerabilities were identified in CISA Malcolm, including authentication bypass, SSRF, and CSRF flaws. One vulnerability involves nginx failing to issue a redirect for non-exact-lowercase path segments.

Why it matters. The vulnerabilities affect critical infrastructure sectors, including Energy, IT, and Water and Wastewater Systems.

Do this today Apply vendor patches for CVE-2026-107333 through CVE-2026-107362.

Affected
Malcolm <=v26.07.1, Malcolm <=v26.08.0

CVE
CVE-2026-107333, CVE-2026-107334, CVE-2026-107335, +4 more

Read on CISA Post on X LinkedIn
```
{"coverage":0.387,"evidence":0.4,"freshness":0.697,"importance":0.75,"novelty":1,"quality":0.95,"total":0.648}
```
QNAP TS-453E: Syslog Format String RCE via log_message High·CVSS 9.8·Zero Day InitiativeNewRead Network-adjacent attackers can achieve unauthenticated RCE on QNAP TS-453E devices via syslog message formatting flaws.
A format string vulnerability exists in the handling of the log_message parameter within syslog on QNAP TS-453E. Improper validation of user-supplied strings allows an attacker to execute arbitrary code in the context of the TFTP server.

Why it matters. Exploitation does not require authentication and allows code execution from a network-adjacent position.

Do this today Ensure QTS is updated to version 5.2.8.3350 build 20251216 or later.

Affected
QNAP TS-453E

CVE
CVE-2018-10388, CVE-2018-10389

Read on Zero Day Initiative Post on X LinkedIn
```
{"coverage":0.387,"evidence":0.7,"freshness":0.574,"importance":0.5,"novelty":1,"quality":0.9,"total":0.63}
```

Worth watching

Malware analysis Did AI Really Reverse Engineer Every Adobe App? Low Level · 14 Oct
Walkthrough Google just paid a $90,000 bounty for this vulnerability NahamSec · 13 Oct
Walkthrough HackTheBox - DevHub IppSec · 10 Oct
Tool demo Mind Games: How to Hack a Human Being Black Hills Information Security · 14 Oct

Malware & Ransomware 4

Discover-Tech Used for Zero-Click Spyware Delivery via Online Ads High·The RecordNewRead Spyware is reportedly infecting devices globally through targeted online advertisements using the AdFection technique.
Researchers documented that Discover-Tech used targeted digital ads to infect devices, including those at Al Jazeera. The platform allows for zero-click attacks, automatically infecting devices when an ad is displayed.

Why it matters. This method bypasses traditional security measures by embedding spyware delivery into the digital advertising supply chain. Compromised networks include those of government agencies and international organizations.

Read on The Record Post on X LinkedIn

Also covered by GBHackers
```
{"coverage":0.613,"evidence":0,"freshness":0.754,"importance":0.75,"novelty":1,"quality":0.95,"total":0.587}
```
AI-Powered Espionage Campaign Targets Government Linux Infrastructure High·Unit 42NewRead An AI-powered espionage campaign targeted government Linux systems using custom malware and web shells.
The campaign utilized AI-generated payloads, including scripts with conversational annotations, to target government and state-affiliated Linux infrastructure. Attackers deployed various web shells and maintained persistence by modifying PHP configuration files.

Why it matters. Defenders should assume advanced, AI-assisted threat activity is possible, requiring deep inspection for code artifacts and persistence mechanisms.

Do this today Hunt for suspicious PHP files in /usr/lib/php/ and check auto_prepend_file settings in /etc/php/ and /opt/plesk/php/

Affected
Government Linux infrastructure

Read on Unit 42 Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.92,"importance":0.75,"novelty":1,"quality":0.95,"total":0.57}
```
Microsoft Seizes Phishing Platforms Used by Chinese Cybercriminals High·6 outlets·The RecordDay 2NewRead Microsoft, with law enforcement partners, seized domains powering three major phishing platforms used by Chinese cybercriminals.
Microsoft obtained a U.S. court order to seize and redirect domains underlying YAM Store, CoGUI, and Iron Man. These platforms were used to send malicious messages impersonating over 75,000 organizations globally. The platforms were used to steal credentials and personal information.

Why it matters. The disruption removes a significant infrastructure vector used by cybercriminals to conduct large-scale phishing campaigns targeting various sectors.
1. Thu 15 OctMicrosoft Seizes Phishing Platforms Used by Chinese Cybercriminals
2. TodayMicrosoft Seizes Phishing Platforms Used by Chinese Cybercriminals
Read on The Record Post on X LinkedIn

Also covered by SecurityWeek, CyberScoop
```
{"coverage":1,"evidence":0,"freshness":0.368,"importance":0.75,"novelty":0.6,"quality":0.95,"total":0.567}
```
Targeted Ads Used to Deliver 0-Click Exploits for Mercenary Malware High·Ars TechnicaNewRead Targeted advertising mechanisms were used to deliver zero-click exploits for installing mercenary spyware.
Targeted ads were observed delivering zero-click exploits. These exploits were used to facilitate the installation of mercenary spyware.

Why it matters. This indicates a sophisticated threat vector utilizing advertising platforms for initial access and malware deployment.

Read on Ars Technica Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.884,"importance":0.75,"novelty":1,"quality":0.9,"total":0.561}
```

Threat Actors & Campaigns 1

Cyberattack Targets Danfoss Refrigeration Controllers in French Supermarkets High·9 outlets·The RecordDay 4NewRead Attackers remotely triggered defrost cycles on refrigeration units at French supermarkets using Danfoss controllers.
A cyberattack disrupted refrigeration at hundreds of French supermarkets by remotely triggering the defrost function on units. The attack reportedly targeted older versions of Danfoss refrigeration controllers.

Why it matters. This demonstrates the potential for physical infrastructure disruption through industrial control system compromise. Defenders must assess exposure of OT assets to the internet.

Affected
Danfoss refrigeration controllers
1. Tue 13 OctDanfoss Refrigeration Controllers Targeted in French Supermarket Cyberattack
2. Wed 14 OctDanfoss Refrigeration Controllers Targeted in Supermarket Cyberattack
3. Thu 15 OctCyberattack Targets Danfoss Refrigeration Controllers in French Supermarkets
4. TodayCyberattack Targets Danfoss Refrigeration Controllers in French Supermarkets
Read on The Record Post on X LinkedIn

Also covered by BleepingComputer, SecurityWeek
```
{"coverage":1,"evidence":0,"freshness":0.066,"importance":0.75,"novelty":0.6,"quality":0.95,"total":0.537}
```

Breaches & Incidents 2

Legal Aid Agency: Breach Stole Records Dating to 1978 High·4 outlets·BleepingComputerNewRead Attackers breached the Legal Aid Agency, stealing sensitive records spanning from 1978 to the present.
Attackers breached the Legal Aid Agency's IT systems in April 2025. The exfiltrated data includes sensitive applicant and recipient information, provider contracts, and credentials.

Why it matters. The breach involves a large volume of historical personal data, including national ID numbers and criminal history, increasing the risk of identity theft and data misuse.

Affected
UK Legal Aid Agency

Read on BleepingComputer Post on X LinkedIn

Also covered by The Record, The Register
```
{"coverage":0.898,"evidence":0,"freshness":0.626,"importance":0.75,"novelty":1,"quality":0.95,"total":0.617}
```
CenterPoint Energy Data Breach Compromises Personal Information High·SecurityWeekNewRead CenterPoint Energy experienced a data breach exposing names, SSNs, and driver's license numbers for over one million individuals.
CenterPoint Energy confirmed a data breach resulting in the compromise of personal information for over one million Texans. The compromised data includes names, addresses, Social Security numbers, and driver’s license numbers. The utility also delivers services in Indiana, Minnesota, and Ohio, potentially affecting residents there.

Why it matters. The exposure of sensitive identifiers like SSNs and driver's license numbers increases the risk of identity theft for affected residents.

Affected
CenterPoint Energy customers in Texas, Indiana, Minnesota, and Ohio

Read on SecurityWeek Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.658,"importance":0.75,"novelty":1,"quality":0.9,"total":0.539}
```

CVE spotlight

CVE	Affects	CVSS	EPSS	Status
CVE-2026-105134	AhsayCBSA flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do o…	10.0	3%	Exploited (KEV)CISA due 17 Oct
CVE-2026-76519	Cisco Secure Email GatewayA vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attack…	9.8	2%	Exploited (KEV)CISA due 17 Oct
CVE-2026-0322	Palo Alto Networks PAN-OSA remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated atta…	7.2	1%	Exploited (KEV)CISA due 17 Oct
CVE-2026-105133	AhsayCBSA vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsA…	7.3	1%	Exploited (KEV)CISA due 17 Oct
CVE-2026-104935	Ivanti Connect SecureAuthentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. Thi…	8.6	26%	Exploited (KEV)CISA due 16 Oct
CVE-2026-96951	Microsoft WindowsImproper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypa…	8.8	2%	Exploited (KEV)CISA due 16 Oct

Quiz

Yesterday's answer

According to the story, what mechanism allowed an attacker to impersonate users via the Docker Hub vulnerability (CVE-2026-105445)??

exploiting how Personal Access Tokens (PATs) were reassigned during account conversions

The story explicitly states that the vulnerability allowed impersonation by exploiting how Personal Access Tokens (PATs) were reassigned during account conversions.

Today's question

According to the provided text, which of the following vulnerabilities was added to the KEV Catalog due to evidence of active exploitation?

On the radar tomorrow

KEV deadline tomorrowCVE-2026-0322 · Palo Alto Networks PAN-OS
KEV deadline tomorrowCVE-2026-105133 · AhsayCBS
CTF starts Sat 09:00 UTCSecurinets CTF Quals 2026
WatchingAnthropic takes risky AI tests offline after models breach govt sites
WatchingLedger confirms spy chip implant behind wallet crypto thefts

Also worth your time

Exploits

Teltonika_RutOS 00.07.06.21 - command injectionRemote
TigerGraph_Community_Edition 4.2.4 - arbitrary file writeWebApps
WordPress 7.0.2 - Path TravesalWebApps
Food-Ordering 1.0 - LFIWebApps
Ecava_ntegraXor IGX_16.0.701.10 - RCERemote

Tools

vxcontrol/pentagi★ 30480 · GoFully autonomous AI Agents system capable of performing complex penetration testing tasks

Community

Podcasts

180: ContiDarknet Diaries · 59:17
Risky Business #855 -- ShinyHunters done sowing, enters reaping phaseRisky Business · 1:06:27
SN 1100: Booby Trapping LLMs - AI Frenzy in CybercrimeSecurity Now · 2:49:02
SANS Stormcast Thursday, October 15th, 2026: Orphaned VBA Macros in AutoCAD DWG Files; Ledger Wallet Hardware Implants; Docker Hub Token Bug (CVE-2026-105445); curl HTTP/2 RCESANS Internet Storm Center · 6:08

That's today's brief.

The next brief lands at 06:30 IST.

Friday, 16 October 2026