Daily briefing · October 27, 2026
Adobe Campaign Classic Hit by a Wave of Critical Flaws as VulnCheck Flags Early Exploitation
Automated Vexday summary · sources: NVD, CISA KEV, EPSS
Verdict of the day — attention2 seen before CISA
The verdict for the day is ATTENTION: no vulnerability has reached weaponized status, but two were seen exploited by VulnCheck ahead of CISA, signaling real-world activity without official confirmation. Of the 638 new CVEs published, 58 are critical, led by a cluster of Adobe Campaign Classic flaws with CVSS between 9.9 and 10.0 and a critical NVIDIA NeMo Agent Toolkit bug. Defenders should prioritize the Electrum and Kerio Connect cases, then patch the critical enterprise stack.
Today’s brief
- Two CVEs (Electrum and GFI Kerio Connect) were observed exploited by VulnCheck before appearing in CISA KEV.
- Adobe Campaign Classic accounts for five critical flaws, two scoring CVSS 10.0 or 9.9 via SQL injection and code execution paths.
- NVIDIA NeMo Agent Toolkit has a CVSS 10.0 missing-authentication flaw that may lead to code execution.
- In Brazil, Qilin claimed three new victims across manufacturing, retail and healthcare.
Critical highlights
1
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs, letting a malicious server swap a just-broadcast transaction for a conflicting one and trick users into fee-bumping and signing it. VulnCheck observed exploitation before CISA, so this is an early warning with direct financial risk; update to 4.8.3 or later.
2
Stored XSS in Kerio Connect Webmail (before 10.0.8 Patch 2) via a crafted SVG attachment lets an attacker run JavaScript in an authenticated session. Although the CVSS is only 6.2, VulnCheck saw exploitation ahead of CISA, which raises its practical urgency for mail servers exposed to the internet.
3
SQL injection in Adobe Campaign Classic with CVSS 10.0 that can lead to arbitrary code execution in the context of the current user. It sits in a platform that holds customer data and campaign infrastructure, so patching should be prioritized.
4
Missing authentication in NVIDIA NeMo Agent Toolkit (CVSS 10.0), with potential for code execution, privilege escalation, data tampering, denial of service and information disclosure. AI agent deployments exposed to untrusted networks are the main concern.
5
OS command injection in Adobe Campaign Classic that a low-privileged attacker can exploit for code execution without user interaction, with changed scope (CVSS 9.9). It extends the impact beyond the vulnerable component.
6
Incorrect authorization in Adobe Campaign Classic allows a low-privileged attacker to achieve arbitrary code execution with no user interaction and changed scope (CVSS 9.9). Part of the same cluster of critical fixes for this product.
7
Another SQL injection in Adobe Campaign Classic (CVSS 9.9) that a low-privileged attacker can leverage for code execution without user interaction. Together with its siblings, it makes unpatched ACC instances a high-value target.
8
Code injection in Adobe Campaign Classic (CVSS 9.9) exploitable by a low-privileged attacker with no user interaction and changed scope. Reinforces the need to apply the full set of vendor updates at once.
9
OS command injection in HiRDB Server (versions 9 and 10 affected, CVSS 9.8, EPSS 2%). Database servers running this software can be compromised at the operating system level if exposed.
10
Authentication bypass by spoofing in HiRDB Server (CVSS 9.8, EPSS 1%), affecting the same version ranges as the command injection flaw. Combined with CVE-2026-82119, it raises the risk for unpatched database instances.
Ransomware today
Qilin claimed three new Brazilian victims recently: P&B Textiles (manufacturing), Animart Pet Stores (retail and e-commerce) and bio3g.com (healthcare). Over the past 30 days the most active groups have been N0n (6 victims), followed by emperador, thegentlemen and qilin (4 each), with akira and Vexy Ransomware at 2 each, all of them with victims in Brazil.
P&B Textiles BRqilin · Manufacturing
Animart Pet Stores BRqilin · Retail & E-Commerce
bio3g.com BRqilin · Healthcare
N0n 6emperador 4thegentlemen 4qilin 4akira 2Vexy Ransomware 2
Active groups & APTs
Groups listed as active or updated include mamona, mogilevich, mosesstaff (Iran), ransomhouse, Elderwood (China) and dragonforce, none with known victims in the data provided. Their presence indicates continued tracking, but there is no attributed activity to report today.
Brazil focus
Brazil remains a heavy target in the recent window: besides the three Qilin victims, the list includes GTL Concreto e Logística (emperador), Prafesta Ind. e Com. de Embalagens (N0n), Universidade de Passo Fundo and Suhai Segurança Pessoal (thegentlemen), and Hospital Sírio-Libanês (THE SEVEN DEADLY SINS). Manufacturing, healthcare and education are among the affected sectors.
Animart Pet Storesqilin · Retail & E-Commerce
P&B Textilesqilin · Manufacturing
bio3g.comqilin · Healthcare
GTL Concreto e Logística LTDAemperador · Manufacturing
Prafesta Ind. e Com. de Embalagens LtdaN0n · Manufacturing
Universidade de Passo Fundothegentlemen · Education
Suhai Segurana Pessoalthegentlemen · Professional Services
Hospital Sírio-LibanêsTHE SEVEN DEADLY SINS · Healthcare
Today’s recommendation: Update Electrum to 4.8.3 and Kerio Connect to 10.0.8 Patch 2 or later right away, then apply the Adobe Campaign Classic fixes and review exposure of NeMo Agent Toolkit and HiRDB instances. Restrict internet access to these services until patched.
With early exploitation signals and critical flaws appearing at this pace, the key question is whether your own exposed surface contains any of these weaknesses, which only regular validation can answer.Find out in minutes, with a free exposure assessment, where your organization is truly exposed.Meet the Autonomous AI Pentest Agent →Previous briefings
November 5, 2026 — BTCPay Server macaroon leak leads a day of critical flaws, with a Juneau cluster and heavy ransomware pressure in BrazilNovember 4, 2026 — Sogou Input Method flaw seen exploited before CISA, as critical router and AI-platform bugs pile upNovember 3, 2026 — Ivanti Connect Secure flaw under active exploitation as a wave of CVSS 10.0 router and Qihoo 360 bugs landsNovember 2, 2026 — WordPress RCE spotted by VulnCheck ahead of CISA leads a day of critical flaws in plugins, routers and enterprise accessNovember 1, 2026 — Quiet KEV Day, but a Wave of CVSS 10.0 Flaws Hits WAVLINK, Linksys and AI SandboxesOctober 31, 2026 — WordPress Plugins Under Fire: Four Flaws Seen Exploited Before CISA ConfirmationOctober 30, 2026 — Five CVEs seen exploited before CISA, led by a critical Dahua RCE and a Gravity Forms flawOctober 29, 2026 — Calm day on the KEV front, but critical flaws in WS_FTP, Langflow and WordPress plugins demand attentionOctober 28, 2026 — Early VulnCheck Warnings on a WooCommerce Plugin and Cisco ASA Lead a Day of Critical FlawsOctober 27, 2026 — Adobe Campaign Classic Hit by a Wave of Critical Flaws as VulnCheck Flags Early ExploitationOctober 26, 2026 — Calm day on the KEV front, but a wave of 10.0 CVSS flaws demands attentionOctober 25, 2026 — Quiet KEV Day, but Authentication Bypasses and Unauthenticated Flaws Lead the DisclosuresOctober 24, 2026 — Calm day on the exploitation front, but critical deserialization and injection flaws pile up in WordPress plugins and PostizOctober 23, 2026 — Calm day on the exploitation front, but critical flaws in Wasmtime, Postiz and LMS platforms demand patchingview full archive →