Security Digest: October 30, 2026 - 11 Critical Vulnerabilities

Today’s alert is urgent: multiple critical flaws affect network appliances, Microsoft Veeam management components, and widely used WordPress plugins. The highest-risk issues include unauthenticated remote code execution, privilege escalation to administrator, and stored XSS that can compromise admin sessions.

· 10 min read

Executive Summary

Today’s alert is urgent: multiple critical flaws affect network appliances, Microsoft Veeam management components, and widely used WordPress plugins. The highest-risk issues include unauthenticated remote code execution, privilege escalation to administrator, and stored XSS that can compromise admin sessions. Patch exposed systems immediately, restrict access to management interfaces, and verify whether any vulnerable plugins or services are in production.

Action now: prioritize internet-facing Teltonika and Veeam systems first, then WordPress sites with the affected plugins. If you cannot patch immediately, isolate the service, disable exposed features, and increase monitoring for suspicious admin activity, new accounts, and unexpected outbound connections.

Critical Vulnerabilities

  • CVE-2026-82104: Teltonika RUTOS/TSWOS unauthenticated command execution
    • Impact: An unauthenticated attacker can call LUA functions directly and potentially execute OS commands.
    • Affected Systems: Teltonika RUTOS 7.22 through 7.24.2 on RUT, RUTX, RUTM, RUTC, ATRM, TAP, CAP, OXA, DAP, TRB, OTD, EBG; SWM 1.9 through 1.10; TSW 1.9 through 1.10.
    • Immediate Action: Treat as internet-exposed emergency. Remove public access to the admin/API surface now.
    • Mitigation: Apply vendor updates as soon as available; if patching is delayed, restrict management access to trusted IPs only and monitor for command-execution indicators.
  • CVE-2023-22793: Veeam Management Pack RCE in Virtualization Extensions service
    • Impact: Unauthenticated remote code execution on servers running the Veeam Virtualization Extensions service.
    • Affected Systems: Veeam Management Pack for Microsoft System Center, Virtualization Extensions service.
    • Immediate Action: Identify all Veeam Management Pack deployments and isolate any exposed management server.
    • Mitigation: Install the vendor fix immediately; block external access to the service and review for suspicious service activity.
  • CVE-2026-104368: WordPress Export and Import Users and Customers privilege escalation
    • Impact: Authenticated users at Subscriber level can create an arbitrary Administrator account through a crafted export/import workflow.
    • Affected Systems: Export and Import Users and Customers plugin up to and including 2.7.5.
    • Immediate Action: Disable the plugin if not essential; audit for unexpected administrator accounts right now.
    • Mitigation: Update to a fixed version when released; temporarily restrict Subscriber-level registration and review all imported CSVs.
  • CVE-2026-107239: Veeam Management Pack Collector service RCE for Users group members
    • Impact: A member of the Veeam Virtualization Extensions Users group can execute code on the Collector service host.
    • Affected Systems: Veeam Management Pack for Microsoft System Center Collector service.
    • Immediate Action: Review group membership immediately and remove unnecessary users from the affected group.
    • Mitigation: Apply vendor remediation; enforce least privilege and isolate the Collector service host from untrusted networks.
  • CVE-2026-59387: Cloud Controller internal v3 callback bypass
    • Impact: Attackers with a valid build or droplet GUID can forge staging callbacks and escalate privileges beyond intended boundaries.
    • Affected Systems: Cloud Controller Nginx routing affecting /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed.
    • Immediate Action: Block public access to internal callback endpoints immediately.
    • Mitigation: Apply the routing fix; verify that /internal/v3/ is protected by the same deny controls as v4/v5.
  • CVE-2026-107238: Veeam Management Pack Collector service RCE as LocalSystem
    • Impact: An authenticated domain user can gain LocalSystem-level code execution on the Collector service host.
    • Affected Systems: Veeam Management Pack for Microsoft System Center Collector service.
    • Immediate Action: Limit domain user access to the service and review privileged group assignments now.
    • Mitigation: Patch immediately; segment the service host and monitor for new services, scheduled tasks, or privilege changes.
  • CVE-2026-14467: Forocoches comments editor information disclosure
    • Impact: Attackers can force victims’ browsers to contact an attacker-controlled server and leak metadata such as IP address and user agent.
    • Affected Systems: Forocoches comments editor.
    • Immediate Action: Disable or filter image-based comment content until fixed.
    • Mitigation: Apply the vendor update; consider content security controls and outbound request monitoring for user-facing pages.
  • CVE-2026-110732: AI Engine WordPress missing authorization in MCP OAuth registration
    • Impact: Unauthenticated attackers can register an OAuth client and potentially obtain administrator-bound MCP access after consent, with clickjacking assistance.
    • Affected Systems: AI Engine – The Chatbot, AI Framework & MCP for WordPress up to and including 3.8.6.
    • Immediate Action: Disable MCP registration exposure and review recent OAuth client registrations.
    • Mitigation: Update immediately; add frame-busting protections and restrict OAuth consent workflows until patched.
  • CVE-2026-97645: Gravity Forms stored XSS via List Field
    • Impact: Attackers can inject scripts that execute when an admin opens a crafted entry and confirms a dialog.
    • Affected Systems: Gravity Forms up to and including 3.1.2.
    • Immediate Action: Update the plugin and review admin accounts for suspicious actions after opening entries.
    • Mitigation: Patch now; limit admin access and inspect forms that accept List Field input.
  • CVE-2026-90437: Gravity Forms stored XSS via post excerpt/custom field/rich-text paragraph values
    • Impact: Stored scripts can execute in admin browsers when crafted content is rendered.
    • Affected Systems: Gravity Forms up to and including 3.1.1.
    • Immediate Action: Upgrade immediately and check for unexpected HTML in form submissions.
    • Mitigation: Apply the fixed release; restrict raw HTML-capable fields where possible.
  • CVE-2026-116622: Food Store plugin stored XSS via service_time
    • Impact: Unauthenticated attackers can store malicious scripts that execute for site visitors.
    • Affected Systems: Food Store – Online Food Delivery & Pickup up to and including 1.5.5, when Checkout Service Fields are disabled and Pickup/Delivery Service is enabled.
    • Immediate Action: Turn the affected feature on or disable the plugin until patched.
    • Mitigation: Update to a fixed version; review pages that display service time values and clear cached content.

Previously Alerted

What to Do Now

  1. Patch or isolate first: Teltonika, Veeam, and internet-facing WordPress sites with the listed plugins.
  2. Check for compromise: Look for unexpected admin accounts, new OAuth clients, suspicious service changes, and unusual outbound traffic.
  3. Reduce exposure: Restrict management interfaces to trusted IPs, disable unused plugins/features, and block access to internal callback endpoints.
  4. Verify versions: Confirm whether any system is on a vulnerable release before the next maintenance window.
  5. Escalate if needed: Treat any signs of exploitation as a potential incident and preserve logs immediately.

Verification steps: inventory affected products, compare installed versions against the ranges above, and confirm whether public access exists to admin, API, or callback endpoints. Review authentication logs, plugin activity, and account creation events for anomalies.

Monitoring recommendations: alert on new administrator accounts, OAuth client registrations, unexpected LUA/API calls, service restarts, webshell indicators, and outbound requests from user-facing pages.

Related Resources

  • Internal blog posts: to be published on emergency patching, WordPress hardening, and exposed management service containment.
  • Official vendor advisories: Teltonika, Veeam, WordPress plugin vendor notices, and Cloud Controller security guidance.

Keep reading