VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible.
Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
Two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, involving out-of-memory corruption during multipart/form-data parsing via session.upload_progress, were leaked before their scheduled patch date. These vulnerabilities have a CVSS v4.0 score of 9.2 but no confirmed successful exploitation in the wild as of October 21, 2026. Scanning activity began shortly after the patch release, linked to a Mirai-style IoT botnet targeting platforms like WooCommerce, WHMCS, and Magento. Despite exposure of over 683,000 IPs running vulnerable PHP versions, technical challenges such as address-space randomization limited reliable exploitation. No official patch information is provided in the data. The threat is currently categorized as a campaign involving php2shell tooling staged across multiple attacker workspaces.
BlueHammer (CVE-2026-33825) is a local privilege escalation chain targeting Windows Defender Antimalware Platform versions before 4.18.26030.3011. It requires initial code execution as a standard user and uses a series of legitimate Windows mechanisms to escalate privileges to NT AUTHORITY\SYSTEM. The exploit freezes the MsMpEng.exe process via CloudFilter manipulation and stages malicious update files. Laboratory tests demonstrated successful privilege escalation, recovery of domain-admin credentials from LSASS, and lateral movement using pass-the-hash techniques to compromise domain controllers. Exploitability depends on runtime factors such as pending signature updates, Defender state, filter drivers, VSS, and CloudFilter reachability. No known exploits are reported in the wild, and no patch information is provided.
Active exploitation of PAN-OS vulnerability CVE-2026-0257 targets GlobalProtect portal and gateway components. This authentication bypass flaw allows unauthorized attackers to circumvent security controls and establish VPN connections. Ransomware operators including Spikey Scorpius (Qilin), Tarnished Scorpius (Inc), and Settra ransomware actors exploit this vulnerability to gain initial network access. Post-exploitation activities include bypassing multi-factor authentication, internal reconnaissance, lateral movement via RDP and SMB, credential harvesting, and ransomware deployment. Sophisticated tactics involve pivoting to the virtualization layer, accessing vCenter management appliances, disabling ESXi hypervisor security controls, and offline credential dumping from domain controller virtual disks. Multiple industries have been impacted. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
CVE-2026-102764 is a critical authentication bypass vulnerability in the BeyondTrust Remote Support platform affecting versions 26.2.3 and earlier. It allows unauthenticated remote attackers to perform file operations without user interaction. Exploitation in the wild has been confirmed, with compromises involving arbitrary file uploads, deployment of web shells and tunneling tools, root escalation, credential vault extraction attempts, persistence mechanisms, and log deletion. The threat actor ARMORY CASTLE, linked to PRC-nexus espionage, is attributed to these attacks. CISA has added this vulnerability to its Known Exploited Vulnerabilities list. Emergency patching and compromise investigations are required, as patching alone does not remove attacker persistence.
In October 2026, Citrix NetScaler ADC appliances running affected 14.1 builds were compromised through a chain of two vulnerabilities: CVE-2026-88771 and CVE-2026-88779. Attackers achieved root code execution by exploiting a pre-authentication log-poisoning/RCE vulnerability and a SAML-parsing crash. The intrusion involved deploying PHP web shells, modifying system shells, creating cron jobs, and establishing boot hooks for persistence. Additional tools included TCP session managers, HTTP tunnels, and reverse agents for command-and-control. Attackers used a Go-based reconnaissance tool to map internal infrastructure and synchronized implants across appliance pairs to maintain persistence. The campaign exfiltrated NetScaler configurations, historical data, and key material, evolving from initial access to a persistent internal reconnaissance platform.
A Microsoft 365 API credential belonging to ConnectWise Cloud Backup (formerly SkyKick) was compromised and used by a threat actor to gain unauthorized access to hundreds of customer M365 environments. The attacker authenticated from a specific IP address on October 15, obtaining Microsoft Graph access tokens and moving through tenants in an automated manner. The ConnectWise Cloud Management MS Teams application was elevated to Global Administrator in at least one case, allowing the attacker to add credentials to other applications, including security tools. The campaign began with password spraying against law firms, followed by role assignments in about 50 tenants, and widespread credential abuse across nearly 1,000 Entra tenants. A second wave targeted 16 tenants in sensitive sectors such as policy, national security, trade, and critical minerals.
Multiple vulnerabilities in Plex Media Server version 1.43.2 and earlier are actively exploited in the wild to deploy cryptominer and proxy malware. Attackers chain four CVEs to achieve remote code execution on vulnerable servers. Exploitation attempts were observed starting October 17, 2026, with payloads including the XMRig cryptominer and myawesomeproxy software. The proxy tool may allow threat actors to use residential IPs to access corporate VPNs and email systems. Proof-of-concept code is publicly available via the plex2shell project. Exploitation was detected from multiple IP addresses, with malicious payloads downloaded from a known IP. No patch or remediation status is provided in the available data.
CVE-2026-88771 is a critical remote code execution vulnerability disclosed by Citrix affecting NetScaler Application Delivery Controller and NetScaler Gateway. It allows unauthenticated attackers to execute arbitrary commands without requiring optional features. Exploitation involves a staged chain using access-log poisoning with Base64-encoded payloads in HTTP User-Agent headers and authentication log poisoning with forged PPE failure messages. A vulnerable Perl diagnostic script executes these commands with elevated privileges. Observed malicious activities include web shell deployment, enabling PHP, and delivery of FreeBSD implants. The vulnerability has been confirmed exploited worldwide and added to CISA's Known Exploited Vulnerabilities catalog. No patch or remediation details are provided in the available data.
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
CVE-2026-0322 is a high-severity remote code execution vulnerability in the management interface of Palo Alto Networks PAN-OS software. It allows an authenticated attacker with network access to execute arbitrary code with root privileges on affected firewalls. The vulnerability affects PA-Series and VM-Series firewalls and Panorama (virtual and M-Series), but not Cloud NGFW or Prisma Access. Access to the management interface should be restricted to trusted internal IPs to minimize risk. Multiple PAN-OS versions prior to specific fixed releases are affected.
A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.
