Daily briefing · October 26, 2026
Calm day on the KEV front, but a wave of 10.0 CVSS flaws demands attention
Automated Vexday summary · sources: NVD, CISA KEV, EPSS
Verdict of the day — calm
October 26 was a CALM day for the bulletin's exploitation signals: no vulnerabilities became weaponized, none are under active exploitation in the CISA KEV, and none were seen by VulnCheck ahead of CISA. Even so, 28 of the 758 new CVEs are critical, and the featured list includes two flaws with a perfect 10.0 CVSS score, plus authentication bypass and command execution risks in infrastructure and edge devices. The tone is one of monitoring and prioritized patching, not emergency response.
Today’s brief
- Calm verdict: 0 weaponized, 0 in active exploitation, 0 seen by VulnCheck before CISA.
- 758 new CVEs and 28 critical ones; two featured flaws score CVSS 10.0 (TOTOLINK A950RG and the Rust zip2 library).
- FortiSandbox, Avocent ACS8000 and ArcGIS Server carry risks of code execution, command injection and SQL injection and deserve fast triage.
- In Brazil, ransomware victims continue to pile up, with qilin hitting three companies in the manufacturing, retail and healthcare sectors.
Critical highlights
1
Stack-based buffer overflow in the Device-Information CGI of the TOTOLINK A950RG, remotely exploitable, with a public proof of concept. Consumer and small-office routers exposed to the internet are frequent targets of botnets, so exposure should be reviewed.
2
In the Rust zip library (zip2), inconsistent filename handling between the central directory and the local headers lets a crafted archive look benign to one component and behave differently when extracted by another. This can bypass inspection and validation pipelines that process uploaded archives.
3
Cross-namespace authorization bypass in the ACL binding rules of consul-k8s that may allow privilege escalation in Consul. Fixed in versions 2.1.0 and 1.8.18; clusters with multiple namespaces should prioritize the update.
4
The Burrito operator accepts unsigned GitHub and GitLab webhook events when the webhook secret is omitted or empty, allowing forged events to trigger Terraform automation flows. The risk is greatest where credentials were configured only for git authentication and polling; the fix is in version 0.13.0.
5
Unrestricted file upload in the campaign import feature of Mautic 7, which copies assets into a publicly accessible directory without checking names or types. An authenticated user with import permission could place malicious files on the server through the UI or the API.
6
SQL injection in Esri ArcGIS Server 12.1 and earlier, on Windows and Linux. The risk rises if the service is configured as public, which could expose it to anonymous attackers; apply the vendor's patch.
7
The root-privileged wsserver daemon on the Avocent ACS8000 builds shell commands from unsanitized WebSocket fields, and the public-key session path performs no appliance-session check. Console servers like this one sit in critical management networks, so compromise could be severe.
8
Authentication bypass via alternate path in Fortinet FortiSandbox (several 5.0, 4.4 and 4.2 releases, including PaaS), allowing unauthorized code or command execution through crafted HTTP requests. Fortinet products are recurring targets, so check versions and restrict management exposure.
9
CRLF injection in the L2TP authentication component of the Oray Pugongying X5 Pro 7.6.1 via the Username argument, remotely exploitable, with a public proof of concept. The vendor did not respond to the disclosure, so there is no known fix and mitigation depends on exposure reduction.
10
CRLF injection in the IPsec policy handler (/etc/ipsec.conf) of the Pugongying X5 Pro 7.6.1 through the secproto argument, with a public exploit and no vendor response. It may allow tampering with VPN configuration, and EPSS is currently very low.
Ransomware today
The group qilin recently claimed three Brazilian victims: P&B Textiles (manufacturing), Animart Pet Stores (retail and e-commerce) and bio3g.com (healthcare). Over the last 30 days, the most active groups were N0n (6 victims, all in Brazil), thegentlemen (5), emperador (4) and qilin (4), with akira and Vexy Ransomware at 2 each, all in Brazil.
P&B Textiles BRqilin · Manufacturing
Animart Pet Stores BRqilin · Retail & E-Commerce
bio3g.com BRqilin · Healthcare
N0n 6thegentlemen 5emperador 4qilin 4akira 2Vexy Ransomware 2
Active groups & APTs
Among the groups listed as active or recently updated are mamona, mogilevich, mosesstaff (origin: Iran), ransomhouse, Elderwood (origin: China) and dragonforce. None has known victims recorded in the data provided, so the information serves mainly as a monitoring reference.
Brazil focus
Brazil concentrates recent victims across several sectors: manufacturing (P&B Textiles, GTL Concreto e Logística, Prafesta Ind. e Com. de Embalagens), retail (Animart Pet Stores), healthcare (bio3g.com and Hospital Sírio-Libanês), education (Universidade de Passo Fundo) and professional services (Suhai Segurança Pessoal). The groups involved include qilin, emperador, N0n, thegentlemen and THE SEVEN DEADLY SINS, showing sustained pressure on the country.
Animart Pet Storesqilin · Retail & E-Commerce
P&B Textilesqilin · Manufacturing
bio3g.comqilin · Healthcare
GTL Concreto e Logística LTDAemperador · Manufacturing
Prafesta Ind. e Com. de Embalagens LtdaN0n · Manufacturing
Universidade de Passo Fundothegentlemen · Education
Suhai Segurana Pessoalthegentlemen · Professional Services
Hospital Sírio-LibanêsTHE SEVEN DEADLY SINS · Healthcare
Today’s recommendation: Prioritize patching and reducing the exposure of edge and management devices (FortiSandbox, Avocent ACS8000, ArcGIS Server) and review whether TOTOLINK and Oray equipment is reachable from the internet. In CI/CD and orchestration environments, enforce webhook secrets and strict permissions for imports and namespaces.
Even on a calm day, a single exposed service can be enough to open the door, and only by validating your own attack surface can you know whether these risks actually affect you.Don’t wait to become a statistic: validate today, at no cost, whether any of these vectors reach your systems.Meet the Autonomous AI Pentest Agent →Previous briefings
November 5, 2026 — BTCPay Server macaroon leak leads a day of critical flaws, with a Juneau cluster and heavy ransomware pressure in BrazilNovember 4, 2026 — Sogou Input Method flaw seen exploited before CISA, as critical router and AI-platform bugs pile upNovember 3, 2026 — Ivanti Connect Secure flaw under active exploitation as a wave of CVSS 10.0 router and Qihoo 360 bugs landsNovember 2, 2026 — WordPress RCE spotted by VulnCheck ahead of CISA leads a day of critical flaws in plugins, routers and enterprise accessNovember 1, 2026 — Quiet KEV Day, but a Wave of CVSS 10.0 Flaws Hits WAVLINK, Linksys and AI SandboxesOctober 31, 2026 — WordPress Plugins Under Fire: Four Flaws Seen Exploited Before CISA ConfirmationOctober 30, 2026 — Five CVEs seen exploited before CISA, led by a critical Dahua RCE and a Gravity Forms flawOctober 29, 2026 — Calm day on the KEV front, but critical flaws in WS_FTP, Langflow and WordPress plugins demand attentionOctober 28, 2026 — Early VulnCheck Warnings on a WooCommerce Plugin and Cisco ASA Lead a Day of Critical FlawsOctober 27, 2026 — Adobe Campaign Classic Hit by a Wave of Critical Flaws as VulnCheck Flags Early ExploitationOctober 26, 2026 — Calm day on the KEV front, but a wave of 10.0 CVSS flaws demands attentionOctober 25, 2026 — Quiet KEV Day, but Authentication Bypasses and Unauthenticated Flaws Lead the DisclosuresOctober 24, 2026 — Calm day on the exploitation front, but critical deserialization and injection flaws pile up in WordPress plugins and PostizOctober 23, 2026 — Calm day on the exploitation front, but critical flaws in Wasmtime, Postiz and LMS platforms demand patchingview full archive →