Buletin de securitate cibernetică – 16 octombrie 2026

Cybersecurity Bulletin – October 16, 2026

The daily CyberSec Intelligence security bulletin presents the actively exploited vulnerabilities and critical breaches reported on October 16, 2026, as well as essential remediation measures.

The CyberSec Intelligence team presents the daily security bulletin for October 16, 2026. We constantly monitor cyber threats to provide you with the necessary support in protecting your IT infrastructure.

Actively Exploited Vulnerabilities

  • CVE-2026-21589 (Atlassian Multiple Products): Allows an unauthenticated attacker to access specific files in the root directory of the web application in Bitbucket, Confluence, Jira, Bamboo, or Crowd Data Center. Details: CVE-2026-21589.
  • CVE-2026-105134 and CVE-2026-105133 (Ahsay AhsayCBS): Correlated vulnerabilities of faulty authentication and command injection that can allow a remote attacker to execute operating system-level commands. Details: CVE-2026-105133 and CVE-2026-105134.
  • CVE-2026-76519 (Cisco Secure Email Gateway): Relative path bypass (Path Traversal) that allows an unauthenticated remote attacker to write arbitrary files to the host operating system. Details: CVE-2026-76519.
  • CVE-2026-0322 (Palo Alto Networks PAN-OS): Code injection that allows an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. Details: CVE-2026-0322.
  • CVE-2026-104935 (Ivanti Connect Secure): Authentication bypass via spoofing that allows the execution of arbitrary commands by unauthenticated remote attackers. Details: CVE-2026-104935.
  • CVE-2026-96951 (Microsoft Windows): Command injection in Windows Shell that allows bypassing a security measure via the network. Details: CVE-2026-96951.

New Critical Vulnerabilities

  • CVE-2020-37282 (office-converter): Command injection by passing a maliciously crafted filename to the generatePdf() or generateHtml() functions. Details: CVE-2020-37282.
  • CVE-2026-110635 (webp-converter): Command injection by inserting metacharacters into filenames or options passed to the libraries in the Node.js package. Details: CVE-2026-110635.
  • CVE-2026-110636 (pypdftk): OS command execution through metacharacters interpreted by subprocess.Popen with shell=True. Details: CVE-2026-110636.
  • CVE-2026-110638 (doc-recog): Command injection in Node.js via unsanitized document paths passed to pdftotext. Details: CVE-2026-110638.
  • CVE-2026-110640 (Whisper-node): Command injection via filePath or language parameters used in createCppCommand(). Details: CVE-2026-110640.
  • CVE-2026-110643 (transcribe2texts): Command injection due to unsanitized audioPath argument in child_process.exec(). Details: CVE-2026-110643.
  • CVE-2026-101950 (Juniper Networks Junos OS): Heap-based buffer overflow in SRX Series via malformed IPv4 packets, leading to DoS or data compromise. Details: CVE-2026-101950.
  • CVE-2026-102178 (Juniper Networks Junos OS / OS Evolved): Stack-based buffer overflow in the BGP daemon that can lead to routing engine compromise. Details: CVE-2026-102178.
  • CVE-2026-109439 (Lantronix XPress-DR / XPress-DR-I): Absence of authentication on the UDP protocol (port 30718), allowing configuration overwrite. The device reached end-of-support in February 2025. Details: CVE-2026-109439.
  • CVE-2026-110957 (Wavlink WL-WN530BE2-A): OS command injection in api.cgi via the REMOTE_ADDR argument. Details: CVE-2026-110957.
  • CVE-2026-111281 (Jooan JA-A12 IP cameras): Hard-coded credentials that allow running root commands by sending SingleCMD=SetDiagMode. Details: CVE-2026-111281.
  • CVE-2026-111283 (BMC Helix Network Management): Authentication bypass when SAML SSO is configured, allowing access with local administrator credentials and any password. Details: CVE-2026-111283.

From the Security Press

  • CVE-2026-99999 (“PwnEscape”) in Linux Kernel: Critical flaw that allows code from a guest virtual machine to read physical host memory. Details: The Hacker News.
  • Next.js releases emergency fixes: Out-of-band fixes for two RCE vulnerabilities in React Server Components and SVG processing. Details: The Hacker News.
  • Drupal patches critical flaw in Field UI: Critical bug that opens an unauthenticated code execution path through contributed modules. Details: The Hacker News.
  • CVE-2026-105740 (Langflow) actively exploited: An RCE vulnerability in the open-source artificial intelligence platform targeted over 1,400 attack attempts in honeypots. Details: The Hacker News.
  • Attacks on Cisco Secure Email Gateway: Cisco warns of active attacks using modified email attachments to write files on devices. Details: The Hacker News.
  • Nextcloud servers compromised via Collabora CODE: Attackers installed web shell scripts through a vulnerability in CODE Server. Details: The Hacker News.
  • Critical OTP bypass discovered by an AI agent: During a security audit, an AI-based pentesting agent found a fully automated method to send OTP codes to arbitrary destinations on an insurer’s production site. Details: The Hacker News.

Recommendations

  • Patch Management: Immediately update email servers, Atlassian products, and the Next.js and Drupal platforms, prioritizing the remediation of actively exploited vulnerabilities flagged by CISA.
  • Asset Inventory and Lifecycle Management: Isolate or replace Lantronix XPress-DR devices in internal networks, given that they no longer receive security updates as of February 2025.
  • Network Monitoring: Inspect unsecured ports such as UDP port 30718 and monitor authentication system logs (especially those using SAML and SSO integrations) to detect unauthorized access.

Security News, in your inbox

New News articles, with their full text and a link to the website. One daily email at 09:00 Romania time. No new articles in your chosen language, no email.

How personal data is used

Related Posts

Leave a Reply

Your email address will not be published. Required fields are marked *