Security Digest: October 26, 2026 - 79 Critical Vulnerabilities

Today’s alert is high-risk across infrastructure, identity, cloud tooling, and edge devices. The most urgent issues enable remote code execution, authentication bypass, file overwrite, and privilege escalation in products many teams rely on for automation, collaboration, and network access.

· 13 min read

Executive Summary

Today’s alert is high-risk across infrastructure, identity, cloud tooling, and edge devices. The most urgent issues enable remote code execution, authentication bypass, file overwrite, and privilege escalation in products many teams rely on for automation, collaboration, and network access. Prioritize exposed internet-facing services first, then patch core platforms and any device firmware with public exploits available.

Immediate action: patch or isolate affected systems now, rotate credentials where auth bypasses are confirmed, and review any service that processes untrusted archives, webhooks, uploads, or HTTP requests.

Critical Vulnerabilities

  • CVE-2026-115905: Rust zip archive path confusion
    • Impact: Crafted ZIP files can write attacker-chosen paths during streaming extraction, potentially overwriting files used downstream.
    • Affected Systems: zip for Rust through 9.0.4.
    • Immediate Action: Block untrusted ZIP uploads/extractions and upgrade to 9.0.5.
    • Mitigation: Validate archive paths before extraction and treat central-directory and local-header filenames as untrusted.
  • CVE-2026-102649: Burrito webhook auth bypass
    • Impact: Attackers can forge repository events and trigger unauthorized Terraform plans; plan content may be exposed in pull request comments.
    • Affected Systems: Burrito prior to 0.13.0.
    • Immediate Action: Disable public access to /api/webhook and upgrade to 0.13.0.
    • Mitigation: Require non-empty webhook secrets for all repositories and restrict network reachability.
  • CVE-2026-110720: Consul-k8s cross-namespace ACL bypass
    • Impact: Elevated Consul privileges may be obtained across namespaces.
    • Affected Systems: consul-k8s 0.42.0 and later before fixed releases.
    • Immediate Action: Upgrade to 2.1.0 or 1.8.18.
    • Mitigation: Review ACL bindings and namespace trust boundaries immediately.
  • CVE-2026-115188: Mautic campaign import file upload RCE
    • Impact: Authenticated users can place arbitrary files, including server-side scripts, into the web root.
    • Affected Systems: Mautic 7 campaign import feature.
    • Immediate Action: Restrict campaign import permissions and patch Mautic immediately.
    • Mitigation: Disable campaign imports for nonessential users; scan web roots for unexpected files.
  • CVE-2026-65184: wsserver command injection
    • Impact: Root-privileged daemon may execute attacker-controlled shell commands.
    • Affected Systems: wsserver terminal-bridge daemon.
    • Immediate Action: Remove network exposure and apply vendor fix if available.
    • Mitigation: Treat as a root compromise risk; isolate affected appliances.
  • CVE-2026-10757: ArcGIS Server SQL injection
    • Impact: Remote attackers with service access can issue unauthorized database functions.
    • Affected Systems: ArcGIS Server 12.1 and earlier; patchable GA/extended-support versions listed by vendor.
    • Immediate Action: Apply vendor patch now and review any public-facing ArcGIS endpoints.
    • Mitigation: Reduce service exposure and enforce least-privilege service accounts.
  • CVE-2026-116508: TOTOLINK A950RG stack overflow
    • Impact: Public exploit can trigger remote code execution or device crash.
    • Affected Systems: TOTOLINK A950RG 4.1.2cu.5268_B20221104.
    • Immediate Action: Disconnect from the internet or replace firmware/device.
    • Mitigation: Block WAN access to admin interfaces; monitor for abnormal reboots.
  • CVE-2026-116485: danmu_api auth bypass
    • Impact: Unauthenticated attackers can change environment variables, lock out operators, and trigger redeployment.
    • Affected Systems: danmu_api before 1.21.7 with default TOKEN conditions.
    • Immediate Action: Rotate tokens, patch, and block public API access.
    • Mitigation: Never deploy with default TOKEN or empty ADMIN_TOKEN.
  • CVE-2026-93328: Google Cloud MCP Toolbox path traversal
    • Impact: Unauthenticated attackers can exfiltrate host files and overwrite local files.
    • Affected Systems: googleapis/mcp-toolbox 1.2.0 through 1.4.0.
    • Immediate Action: Upgrade immediately and restrict tool invocation sources.
    • Mitigation: Run with strict filesystem isolation and outbound egress controls.
  • CVE-2026-112346: OpenHands SDK unauthenticated RCE
    • Impact: Remote shell access as root inside exposed sandbox containers.
    • Affected Systems: OpenHands Software Agent SDK before 1.52.0.
    • Immediate Action: Close published container ports and upgrade to 1.52.0 or later.
    • Mitigation: Require session API keys and bind only to trusted interfaces.
  • CVE-2026-116747: Kener secret fallback auth bypass
    • Impact: Attackers can forge admin sessions and reset tokens.
    • Affected Systems: Kener before 4.1.10 when KENER_SECRET_KEY is empty or unset.
    • Immediate Action: Set a strong secret now and upgrade.
    • Mitigation: Audit for forged cookies and reset any exposed credentials.
  • CVE-2026-115189 / CVE-2026-115190 / CVE-2026-115191 / CVE-2026-115192 / CVE-2026-115193: Mautic code, SQL, and XSS chain
    • Impact: Theme/template RCE, insecure deserialization, SQL injection, and stored XSS can expose data and take over admin sessions.
    • Affected Systems: Mautic 7 and related admin/API paths.
    • Immediate Action: Patch immediately, restrict admin permissions, and review custom themes, imports, and API access.
    • Mitigation: Disable unneeded plugins, scan for malicious templates, and rotate credentials after patching.
  • CVE-2026-114213 / CVE-2026-110499 / CVE-2026-111101 / CVE-2026-113436 / CVE-2026-108525 / CVE-2026-115269 / CVE-2026-111103: Bandit HTTP resource exhaustion issues
    • Impact: Attackers can exhaust memory, CPU, or bypass stream limits over HTTP/1.1 and HTTP/2.
    • Affected Systems: bandit versions across multiple release lines before 1.14.0.
    • Immediate Action: Upgrade to 1.14.0 and rate-limit exposed services.
    • Mitigation: Put Bandit behind a reverse proxy with request-size and connection limits.
  • CVE-2026-105608 / CVE-2026-105765 / CVE-2026-105626: Consul authorization and DoS issues
    • Impact: Unauthorized proxy registration, leaf certificate theft, and agent memory exhaustion.
    • Affected Systems: Consul and Consul Enterprise prior to fixed releases.
    • Immediate Action: Upgrade to 2.1.0 or 1.21.19 depending on edition.
    • Mitigation: Review ACL policies, token exposure, and agent-facing network access.
  • CVE-2026-115915 / CVE-2026-115912: vLLM multimodal and image handling flaws
    • Impact: Can lead to arbitrary code execution or unsafe deserialization in scale-out deployments.
    • Affected Systems: vLLM before 0.32.0.
    • Immediate Action: Upgrade to 0.32.0 and disable untrusted image/model paths where possible.
    • Mitigation: Restrict multimodal inputs and shared-memory caching to trusted workloads only.
  • CVE-2026-116634: OmniRoute missing auth on sync tokens
    • Impact: Attackers can retrieve decrypted provider credentials and API keys.
    • Affected Systems: OmniRoute 3.8.50 before 3.8.52.
    • Immediate Action: Patch and rotate all provider secrets.
    • Mitigation: Do not rely on login toggles as a security boundary.
  • CVE-2026-85297: Google Cloud Run MCP bucket squatting
    • Impact: Source-code interception, arbitrary code execution, and data theft.
    • Affected Systems: Cloud Run MCP prior to 1.11.0.
    • Immediate Action: Upgrade to 1.11.0 or later.
    • Mitigation: Review bucket ownership and service account permissions.
  • CVE-2026-96581: Ash tenant upsert bypass
    • Impact: One tenant can overwrite or take over another tenant’s records.
    • Affected Systems: ash 1.22.0 before 3.37.2.
    • Immediate Action: Patch and review any upsert-enabled create actions.
    • Mitigation: Add tenant scoping checks to all upsert flows.
  • CVE-2026-90885: Apache Camel Saxon XXE
    • Impact: External entities may be resolved when XQuery evaluates stream-based Source bodies.
    • Affected Systems: Camel 4.0.0 before 4.18.5, and 4.19.0 before 4.22.2.
    • Immediate Action: Upgrade to fixed releases and block untrusted XML paths.
    • Mitigation: Disable DOCTYPE and external entity resolution in affected routes.

Note: The remaining critical and high-severity items in today’s set include additional Mautic, TOTOLINK, boneIO, Seroval, hackney, Mendix, Transmission, Asterisk, and several edge/device exposures. Treat them as patch-now items if any affected product is present in your environment.

Previously Alerted

What to Do Now

  1. Patch internet-facing services first: Mautic, Consul/consul-k8s, ArcGIS Server, OpenHands, vLLM, Bandit, and any affected cloud tooling.
  2. Isolate or disable exposed device/admin interfaces: TOTOLINK, boneIO, wsserver, OmniRoute, Transmission, and similar management planes.
  3. Rotate secrets immediately where auth bypasses or credential exposure are possible: webhook secrets, API keys, admin tokens, and service credentials.
  4. Audit for abuse: look for unexpected uploads, new admin accounts, forged webhooks, strange Terraform plans, unusual outbound requests, and modified config files.
  5. Block risky inputs: untrusted archives, XML, image files, webhooks, and large/fragmented HTTP traffic until patches are deployed.

Verification: confirm versions against vendor advisories, check for exposed endpoints on public IPs, and review recent logs for repeated 4xx/5xx bursts, token issuance, and file-write activity. Where patching is delayed, place affected services behind allowlists and WAF rules now.

Monitoring: alert on new admin sessions, unexpected outbound traffic, sudden CPU or memory spikes, archive extraction events, and changes to web roots, sudoers files, MQTT credentials, or Terraform repositories.

Related Resources

  • Internal: Upcoming deep-dive on today’s Mautic, Consul, and Bandit exposure patterns.
  • Official: Review vendor advisories for Mautic, HashiCorp Consul, Apache Camel, Google Cloud Run MCP, vLLM, and TOTOLINK firmware.

Keep reading