This week in security: BeyondTrust, Ivanti and Cisco exploited
This week in security was dominated by exploited edge and remote-access products: BeyondTrust, Ivanti, Cisco, Palo Alto Networks and Ahsay all had flaws added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, with several federal deadlines landing on 16 and 17 October. Alongside them came large customer-data breaches and fresh espionage reporting.
Top stories
- BeyondTrust Remote Support zero-day exploited by China-linked APT (CVE-2026-102764): in KEV with a 19 October deadline, so remote-support servers need checking first.
- UTA0576 chained three zero-days to get root on a patched Ivanti VPN: Volexity’s finding shows that a patched VPN is not proof of a clean one.
- Cisco Secure Email Gateway hardening fixes 5 critical CVEs, 2 exploited: Cisco says there is no workaround, so patching exposed appliances is the only fix.
- PAN-OS management interface RCE exploited (CVE-2026-0322): another reminder to keep management interfaces off untrusted networks.
- Burger King Japan app breach exposes 11.18M customer records: one of the largest consumer-data exposures of the week.
- CenterPoint Energy data breach exposes SSNs of 1 million Texans: SSNs make identity-theft risk long-lived for those affected.
- GitLab CI/CD regex flaw allows unauthenticated RCE (CVE-2026-97229): a CVSS 10.0 flaw in self-managed GitLab, with fixed releases available.
- Microsoft Patch Tuesday October 2026: 348 CVEs, none exploited: a big release, but with no zero-days the rollout can follow normal risk-based order.
- AI-generated payloads hit government Linux systems in CL-UNK-1211 campaign: Unit 42 details web shells, log tampering and mailbox access worth hunting for.
- Meta GitHub breach: stolen employee credentials expose code and data: a stolen login alone reached source repositories.
Newly exploited vulnerabilities
CISA added these entries to KEV this week. Due dates are the federal remediation deadlines.
| CVE | Vendor and product | Issue | Due |
|---|---|---|---|
| CVE-2026-102764 | BeyondTrust Remote Support | Authentication bypass by spoofing | 2026-10-19 |
| CVE-2025-61624 | Fortinet Multiple Products | Path traversal | 2026-10-19 |
| CVE-2026-21589 | Atlassian Multiple Products | Files or directories accessible to external parties | 2026-10-18 |
| CVE-2026-105134 | Ahsay AhsayCBS | Command injection | 2026-10-17 |
| CVE-2026-76519 | Cisco Secure Email Gateway | Relative path traversal | 2026-10-17 |
| CVE-2026-105133 | Ahsay AhsayCBS | Improper authentication | 2026-10-17 |
| CVE-2026-0322 | Palo Alto Networks PAN-OS | Code injection | 2026-10-17 |
| CVE-2026-104935 | Ivanti Connect Secure | Authentication bypass by spoofing | 2026-10-16 |
| CVE-2026-96951 | Microsoft Windows | Command injection | 2026-10-16 |
Our coverage of the individual entries: AhsayCBS authentication bypass, AhsayCBS command injection, Cisco Secure Email Gateway path traversal, Ivanti Connect Secure authentication bypass and Windows Shell command injection.
Why this matters
Analysis, not new facts. Most of this week’s KEV additions sit on internet-facing or administrative infrastructure: remote support, VPN, email gateway, firewall management and backup servers. For a typical environment these are high-value targets because one compromised appliance can expose credentials and internal reach. Items in KEV with deadlines this week should be treated as patch-within-hours work, not next-cycle work.
What to prioritise next week
- Patch or mitigate every KEV entry above that you run, starting with those due on 16 and 17 October, then BeyondTrust and Fortinet (19 October).
- Hunt for compromise on Ivanti, Cisco, Palo Alto Networks and BeyondTrust devices rather than assuming a patch closes the door; see the linked stories for what to look for.
- Confirm management interfaces and remote-support portals are not reachable from the internet.
- Check self-managed GitLab against the fixed releases in our story.
- Review credential hygiene, including MFA on developer and cloud accounts, in light of the Meta GitHub breach.
Related free tool: planning network segmentation or access rules for exposed devices? Our Subnet Calculator shows network ranges, masks and usable hosts for any CIDR block.
All stories this week
- Anne Arundel County confirms August data breach after Rhysida claim
- DDoS attacks top 9.1 million in H1 2026, Netscout report finds
- Kazakhstan-linked UAT-6275 (TAG-193) spies on Central Asian governments
- Fake CAPTCHA pages push malware and ClickFix commands, Barracuda says
- Ransomware gangs reportedly threaten employees’ families
- Ransomware negotiation basics: what defenders should know before an attack
- Cisco UCS UEFI Shell Secure Boot Bypass (CVE-2026-20293)
- Xandr fined record €8.6M over Grindr data sharing in Norway
- Anthropic cuts internet access from AI evaluations after incidents
- Denmark, ASOS, ATB and Osaka University breaches in Check Point’s weekly report
- iRhythm data breach hits 360,000+ patients after extortion
- SonicWall SMA 1000 SSRF flaw exploited after patch (CVE-2026-102255)
- Bricksforge WordPress plugin flaw exploited for RCE (CVE-2026-85097)
- WEF: CEOs now rank cyber fraud above ransomware as top concern
- Daiichi Kosho data exposed in Nippon Columbia malware incident
- Silent Ransom Group leak claims $207M extorted from 27 law firms
- FBI arrests ransomware negotiation firm co-founder in ShinyHunters probe
