Security Digest: October 12, 2026 - 12 Critical Vulnerabilities

Today’s digest is dominated by internet-exposed remote code execution, authentication bypass, and SQL injection flaws across unsupported routers, helpdesk platforms, AI orchestration tools, and recruitment systems. Act now: patch or isolate affected systems, disable exposed admin interfaces, revoke and rotate credentials, and assume public exploits will be used quickly.

· 10 min read

Executive Summary

Today’s digest is dominated by internet-exposed remote code execution, authentication bypass, and SQL injection flaws across unsupported routers, helpdesk platforms, AI orchestration tools, and recruitment systems. Act now: patch or isolate affected systems, disable exposed admin interfaces, revoke and rotate credentials, and assume public exploits will be used quickly.

Two themes stand out: unsupported products are being actively targeted, and several of today’s flaws allow attackers to log in without credentials or execute code remotely. If you run any affected OTRS, TRENDnet, Blinko, Agno, or EmployeeRecruitmentSystem deployments, prioritize containment and remediation immediately.

Critical Vulnerabilities

  • CVE-2026-108804: TRENDnet router command injection
    • Impact: Remote attackers can run operating system commands on exposed routers.
    • Affected Systems: TRENDnet TEW-751DR, TEW-752DRU, TEW733GR running 1.03B01/1.03B03; EOL hardware only.
    • Immediate Action: Remove from the internet now, block management access, and replace the device.
    • Mitigation: No vendor fix is available; treat as unpatchable and retire immediately.
  • CVE-2026-93582: OTRS Community Edition auth bypass via Remote-User header
    • Impact: Attackers may authenticate as an existing agent or customer without knowing the password.
    • Affected Systems: ((OTRS)) Community Edition 6 and prior; products based on CE 6 are likely affected.
    • Immediate Action: Disable HTTP Basic Authentication as a backend where possible and restrict access to OTRS behind trusted SSO/reverse proxy controls.
    • Mitigation: Upgrade to OTRS 7+ and remove any deployment path that exposes attacker-controlled HTTP_* headers.
  • CVE-2026-78357: OTRS JWTs remain valid after deactivation or password change
    • Impact: Stolen tokens can keep working for up to the normal expiration window, even after account disablement.
    • Affected Systems: OTRS 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, 2026.X before 2026.7.X.
    • Immediate Action: Revoke active sessions, rotate credentials, and treat account deactivation as incomplete until tokens are invalidated.
    • Mitigation: Upgrade to the fixed release line and force token/session invalidation procedures.
  • CVE-2026-87690: Metasploit iOS gather module path traversal
    • Impact: A hostile iOS device can write files on the operator’s workstation and potentially achieve code execution at next launch.
    • Affected Systems: Metasploit Framework post/apple_ios/gather/ios_image_gather.
    • Immediate Action: Avoid running the module against untrusted devices until patched; review ~/.msf4 for unexpected files.
    • Mitigation: Update Metasploit once a fix is released; validate loot paths before use.
  • CVE-2026-108980: Blinko plugin install path traversal
    • Impact: Authenticated attackers can write outside the plugins directory and overwrite startup files for root code execution.
    • Affected Systems: Blinko through 1.8.8, especially the official Docker image running as root.
    • Immediate Action: Disable plugin installation for untrusted users and move containers off root immediately.
    • Mitigation: Patch to the fixed release, restrict tRPC access, and run with least privilege.
  • CVE-2026-78355: OTRS SendSupportBundle path traversal
    • Impact: Authenticated admins may delete files outside the intended directory.
    • Affected Systems: OTRS 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, 2026.X before 2026.7.X; CE 6.x and derivatives likely affected.
    • Immediate Action: Restrict admin access and disable support bundle generation until patched.
    • Mitigation: Upgrade to the fixed version and verify file system permissions on OTRS hosts.
  • CVE-2026-108806: EmployeeRecruitmentSystem forgot-password SQL injection
    • Impact: Remote attackers can inject SQL and potentially take over the application.
    • Affected Systems: krupalshah EmployeeRecruitmentSystem up to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe.
    • Immediate Action: Take the app off the public internet, disable the forgot-password endpoint, and inspect database logs.
    • Mitigation: Apply parameterized queries or retire the unsupported application immediately.
  • CVE-2026-108818: Agno missing authentication check
    • Impact: Remote attackers may bypass authentication entirely.
    • Affected Systems: agno-agi agno up to 2.7.3/3.0.6.
    • Immediate Action: Restrict external access and rotate any secrets exposed through the service.
    • Mitigation: Upgrade to the patched release and confirm auth is enforced on all endpoints.
  • CVE-2026-108819: Agno agent orchestration remote code execution
    • Impact: Attackers can submit code for remote execution.
    • Affected Systems: agno-agi agno up to 3.0.6/3.1.1.
    • Immediate Action: Disable or isolate agent orchestration features until patched.
    • Mitigation: Update to the fixed version and review any executed payloads or jobs.
  • CVE-2026-108799: XCMS password recovery SQL injection
    • Impact: Remote SQL injection against the password recovery mail endpoint.
    • Affected Systems: jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261.
    • Immediate Action: Block the endpoint from the public internet and check for database tampering.
    • Mitigation: Patch immediately; use prepared statements and review account reset workflows.
  • CVE-2026-108805: EmployeeRecruitmentSystem login SQL injection
    • Impact: Remote attackers can inject SQL through the login handler and may gain application control.
    • Affected Systems: krupalshah EmployeeRecruitmentSystem up to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe.
    • Immediate Action: Put the login page behind access controls and inspect for suspicious authentication attempts.
    • Mitigation: Replace vulnerable query handling; unsupported rolling-release deployments should be retired.
  • CVE-2026-108807: EmployeeRecruitmentSystem registration SQL injection
    • Impact: Remote attackers can inject SQL during registration and potentially create or modify accounts.
    • Affected Systems: krupalshah EmployeeRecruitmentSystem up to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe.
    • Immediate Action: Disable public registration and review database and application logs for abuse.
    • Mitigation: Patch or retire the product; enforce parameterized database access.

Previously Alerted

What to Do Now

  1. Isolate exposed systems immediately, especially OTRS, TRENDnet, Blinko, Agno, XCMS, and EmployeeRecruitmentSystem instances reachable from the internet.
  2. Patch or retire affected products; if no fix exists, remove the service or device from production.
  3. Revoke sessions and rotate secrets for any system impacted by auth bypass, token retention, or RCE.
  4. Disable risky features such as plugin installs, support bundle generation, public registration, and password recovery endpoints.
  5. Verify compromise by checking for new admin users, unexpected files, altered startup scripts, unusual outbound traffic, and database changes.
  6. Monitor aggressively for exploitation attempts against headers, login forms, recovery forms, plugin upload paths, and management interfaces.

Verification steps: confirm versions against the affected ranges above, review reverse proxy/header handling, and inspect application logs for repeated 4xx/5xx spikes, unexpected authentication success, or file writes outside normal directories.

Monitoring recommendations: alert on new admin sessions, token reuse after password changes, webshell-like file creation, outbound connections from management hosts, and SQL error bursts on login/reset endpoints.

Related Resources

  • Internal blog posts: planned coverage on OTRS exposure reduction, unsupported product retirement, and secure file-path handling.
  • Official vendor advisories: monitor vendor security notices for OTRS, TRENDnet, Blinko, Metasploit, Agno, XCMS, and EmployeeRecruitmentSystem-related fixes.

Keep reading