The CyberSec Intelligence (csint.ro) team presents the daily cybersecurity bulletin for October 9, 2026. Our analyses highlight a series of critical severity vulnerabilities, some of which are already actively exploited in real cyberattacks, requiring the immediate application of available security patches.
Actively Exploited Vulnerabilities
- CVE-2015-5477 (product: ISC BIND): A data processing error allows remote attackers to cause a Denial of Service (DoS) incident via specific TKEY queries. Source: NVD.
- CVE-2016-3081 (product: Apache Struts): A command injection vulnerability allows remote attackers to execute arbitrary code via method prefixes when the Dynamic Method Invocation option is enabled. Source: NVD.
- CVE-2023-22894 (product: Strapi): Cleartext storage of sensitive information in the admin panel allows attackers to obtain user details; this vulnerability can be combined with CVE-2023-22621 to achieve remote code execution. Source: NVD.
- CVE-2021-3199 (product: ONLYOFFICE Docs): A path traversal vulnerability occurring when using JWT via a /.. sequence in an image upload parameter can allow remote code execution. Source: NVD.
- CVE-2015-3306 (product: ProFTPD): Improper access control that allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. Source: NVD.
- CVE-2026-88779 (product: Citrix NetScaler): Improper restriction of operations within the bounds of a memory buffer in Citrix NetScaler ADC and Gateway, allowing attackers to trigger a Denial of Service (DoS) condition. Source: NVD.
- CVE-2026-102490 and CVE-2026-102489 (product: Zammad GmbH Zammad): A vulnerability chain consisting of improper privilege management (allowing root escalation for the local zammad user) and session fixation, leading to remote code execution. Sources: NVD 102490 and NVD 102489.
New Critical Vulnerabilities
- CVE-2026-76454: Improper input validation and lack of authentication in the Cisco Smart Licensing Utility (Cisco License On-Prem) management API allows unauthenticated attackers to write arbitrary files to the system or cause a DoS condition. Source: NVD.
- CVE-2026-17609: The Super Forms plugin for WordPress is affected by an arbitrary directory recursive deletion vulnerability on the server (including the WordPress root directory) by unauthenticated users, if the option to delete files after form submission is active. Source: NVD.
- CVE-2026-107699: The ppt2png package is vulnerable to OS command injection, allowing command execution by concatenating shell metacharacters in the parameters passed to child_process.exec(). Source: NVD.
- CVE-2026-107700: The dot-access library is affected by a JavaScript code injection vulnerability that allows executing instructions in the Node.js process by providing malicious paths to the get() function. Source: NVD.
- CVE-2026-107704: The Ruby image_optimizer gem exhibits an OS command injection vulnerability in ImageOptimizer#identify_format when the identify option is active, by providing a malicious image path. Source: NVD.
- CVE-2026-104075 and CVE-2026-104076 (product: TVU Networks Receiver/Transceiver): Devices running firmware versions prior to 7.9 allow authentication bypass by sending an empty UserName parameter, and unauthenticated access to REST APIs on port 8288 for information extraction and DNS settings modification, respectively. Sources: NVD 104075 and NVD 104076.
- CVE-2026-84244 and CVE-2026-84272 (product: IBM Guardium Data Protection): Critical vulnerabilities allowing stored XSS attacks in Quick Search, and arbitrary container image execution in edge clusters due to the lack of authentication in the edge-controller component, respectively. Sources: NVD 84244 and NVD 84272.
- CVE-2026-107779 and CVE-2026-107780 (product: Dromara Skyeye): Lack of authentication in xxl-job-admin endpoints allows running arbitrary scripts (GLUE_SHELL/PYTHON/POWERSHELL), and a command injection in TtsController allows breaking the PowerShell string to execute commands with service account privileges. Sources: NVD 107779 and NVD 107780.
- CVE-2026-16823 (product: IBM Security Verify Access / Verify Identity Access): An improper authentication error allows a remote attacker to bypass security restrictions. Source: NVD.
From the Security Press
- SonicWall SMA1000 (no publicly associated CVE): The manufacturer has released hotfixes for a critical pre-authentication Server-Side Request Forgery (SSRF) vulnerability with a CVSS 10.0 severity score, which allows sending requests through the gateway to access internal network functions. Source: The Hacker News.
- LMCache (no publicly associated CVE): An unpatched critical vulnerability in the multi-process mode of LMCache (an open-source LLM acceleration solution) allows unauthenticated attackers to execute remote code on the cache server via the ZeroMQ network. Source: The Hacker News.
- CVE-2026-21589 (products Atlassian Data Center): A critical arbitrary file access vulnerability (CVSS 9.3) in products such as Bitbucket, Confluence, and Jira has seen active exploitation attempts within the first two hours after the publication of technical details. Source: The Hacker News.
Recommendations
- Rigorous patch management: Prioritize updating solutions directly exposed to the internet, such as Atlassian Data Center platforms, Citrix NetScaler, and SonicWall SMA1000 gateways.
- Software dependency inventory: Check if internal applications use vulnerable packages such as dot-access, ppt2png, or image_optimizer, and migrate to secure versions or alternatives.
- Network-level access restriction: Isolate administrative APIs and sensitive ports (such as port 8288 in TVU Networks equipment or ZeroMQ services in LMCache) to be accessible only from trusted networks or via VPN.
- Security log monitoring: Implement alerting rules in SIEM systems to identify unusual TKEY queries in DNS (ISC BIND) or directory traversal attempts (Path Traversal).
Security News, in your inbox
New News articles, with their full text and a link to the website. One daily email at 09:00 Romania time. No new articles in your chosen language, no email.
