Security Digest: October 29, 2026 - 10 Critical Vulnerabilities

Ten critical and high-severity flaws demand immediate attention today, including remote command execution in openEQUELLA, unauthenticated SQL injection in Radius Xenia M2M Platform, and authentication bypass and deserialization risks in Wildfly. Organizations should prioritize exposed internet-facing services, apply vendor patches now, and restrict access to administrative and management interfaces until remediation is complete.

· 9 min read

Executive Summary

Ten critical and high-severity flaws demand immediate attention today, including remote command execution in openEQUELLA, unauthenticated SQL injection in Radius Xenia M2M Platform, and authentication bypass and deserialization risks in Wildfly. Organizations should prioritize exposed internet-facing services, apply vendor patches now, and restrict access to administrative and management interfaces until remediation is complete.

Do not wait for exploitation activity. Several of these issues allow attackers to run commands, steal data, or pivot into internal networks with little to no user interaction.

Critical Vulnerabilities

CVE-2026-66088: openEQUELLA scripting command execution

  • Impact: An attacker who can create or edit scripts can execute arbitrary operating system commands as the openEQUELLA service account.
  • Affected Systems: openEQUELLA versions before 2026.1
  • Immediate Action: Disable script-editing access for non-essential users and review any script-based workflows for abuse.
  • Mitigation: Upgrade to 2026.1 or later and audit the service account privileges immediately.

CVE-2026-114358: Radius Xenia M2M Platform password recovery SQL injection

  • Impact: Unauthenticated attackers can query, read, or modify database content and potentially gain access to sensitive records.
  • Affected Systems: Radius Xenia M2M Platform web management interface; affected versions not specified in the advisory
  • Immediate Action: Remove public exposure of the management interface and block access at the network edge.
  • Mitigation: Apply the vendor fix as soon as available; if no patch is available, isolate the interface and monitor for suspicious database activity.

CVE-2026-111419: Foxit website credential exposure

  • Impact: Third-party authorization information embedded in JavaScript could be stolen and misused.
  • Affected Systems: Foxit official website assets containing exposed JavaScript credentials
  • Immediate Action: Treat any exposed keys or tokens as compromised and rotate them now.
  • Mitigation: Remove hardcoded secrets from client-side code and replace with server-side secret handling.

CVE-2026-85749: MailWatch quarantine access control bypass

  • Impact: Authenticated users can release or delete quarantined email belonging to other users or domains.
  • Affected Systems: MailWatch for MailScanner prior to 1.2.27
  • Immediate Action: Restrict quarantine actions to trusted administrators until patching is complete.
  • Mitigation: Upgrade to 1.2.27 and review quarantine logs for unauthorized message actions.

CVE-2026-111418: Foxit HTML-to-PDF SSRF

  • Impact: Attackers may force server-side requests to internal IPs and discover internal network resources.
  • Affected Systems: Foxit official website HTML-to-PDF conversion service
  • Immediate Action: Disable ZIP-formatted input handling or place the service behind strict egress controls.
  • Mitigation: Apply the vendor fix and block access to internal metadata and private address ranges from the service.

CVE-2026-15564: Wildfly IIOP deserialization before authentication

  • Impact: An attacker with access to the IIOP port may trigger unsafe deserialization and potentially execute code, depending on available gadget chains.
  • Affected Systems: Wildfly deployments exposing the IIOP listener
  • Immediate Action: Close or firewall the IIOP port immediately unless it is strictly required.
  • Mitigation: Patch Wildfly and review any EJBs that accept untyped method parameters.

CVE-2026-114488: Wildfly IIOP authentication bypass

  • Impact: A remote attacker on port 3528 can impersonate any principal and bypass authentication on IIOP-exposed EJBs.
  • Affected Systems: Wildfly systems exposing IIOP EJB invocations
  • Immediate Action: Block external access to port 3528 now.
  • Mitigation: Apply the vendor patch and verify that no IIOP services are reachable from untrusted networks.

CVE-2026-107743: Mapster WP Maps stored XSS

  • Impact: Unauthenticated attackers can inject scripts that execute in visitors’ browsers and steal sessions or alter page content.
  • Affected Systems: Mapster WP Maps plugin versions up to and including 2.0.5
  • Immediate Action: Disable the plugin or restrict access to affected pages until upgraded.
  • Mitigation: Update to a fixed version as soon as available and review site content for injected payloads.

CVE-2026-118905: nvm sed command injection

  • Impact: A crafted version string can lead to shell command execution or file operations when nvm is used in common workflows.
  • Affected Systems: nvm versions 0.31.2 through 0.40.5; auto-switch hooks and scripts that pass untrusted version strings
  • Immediate Action: Upgrade immediately or stop using auto-switch hooks that consume untrusted .nvmrc content.
  • Mitigation: Move to 0.40.6 or later and review developer scripts for unsafe version handling.

CVE-2026-66090: openEQUELLA XML external entity injection

  • Impact: A user with item creation rights can read arbitrary files or trigger SSRF, including requests to cloud metadata services.
  • Affected Systems: openEQUELLA versions before 2026.1
  • Immediate Action: Restrict item creation privileges and block outbound access from the application server where possible.
  • Mitigation: Upgrade to 2026.1 or later and confirm XML external entity resolution is disabled.

What to Do Now

  1. Patch or isolate exposed systems first: openEQUELLA, Wildfly, MailWatch, Radius Xenia, and any public-facing WordPress or Foxit-related services.
  2. Cut off risky network paths: Block management interfaces, IIOP ports, and unnecessary outbound access from application servers.
  3. Rotate secrets: Treat any exposed Foxit authorization data as compromised and replace credentials, tokens, and keys.
  4. Review privileged access: Limit script editing, quarantine actions, and item creation rights to the smallest possible set of trusted users.
  5. Upgrade developer tooling: Move nvm to 0.40.6 or later and audit shell automation that reads attacker-controlled version strings.

Verification Steps

  • Confirm installed versions against vendor advisories and package inventories.
  • Check whether openEQUELLA scripts, MailWatch quarantine actions, or Wildfly IIOP services are exposed to broader user groups than intended.
  • Search logs for unusual SQL activity, unexpected outbound requests, suspicious XML payloads, and repeated access to quarantine or admin endpoints.
  • Validate that patches actually remove exposure by retesting from a non-trusted network segment.

Monitoring Recommendations

  • Alert on new administrative script changes, quarantine deletions/releases, and unexpected item metadata uploads.
  • Watch for outbound connections to internal RFC1918 ranges and cloud metadata endpoints.
  • Monitor web logs for REST calls to Mapster routes and suspicious quote-heavy payloads.
  • Track shell and CI activity for nvm-related command execution anomalies.

Related Resources

  • Internal blog posts: Add links to your organization’s remediation notes and incident response guidance once published.
  • Official vendor advisories: openEQUELLA, Radius Xenia M2M Platform, Foxit, MailWatch for MailScanner, Wildfly, Mapster WP Maps, and nvm security advisories.

Keep reading