CyberSec Intelligence presents the analysis of recent cybersecurity developments for October 18, 2026. Active monitoring and remediation of reported flaws are essential to limit attack vectors targeting enterprise networks and web platforms.
Actively exploited vulnerabilities
- CVE-2026-102764 (BeyondTrust Remote Support): Authentication bypass flaw via spoofing, which allows a remote attacker to execute unauthorized operations on files on the device. Source: NVD.
- CVE-2025-61624 (Fortinet Multiple Products): Path traversal vulnerability in FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager allowing an authenticated attacker with administrative profile and read-write privileges to modify or delete files via specific CLI commands. Source: NVD.
- CVE-2026-21589 (Atlassian Multiple Products): Exposure of directories and files in the root of the web application in Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye, allowing unauthenticated access to external users. Source: NVD.
- CVE-2026-105134 and CVE-2026-105133 (Ahsay AhsayCBS): Correlated flaws in the Replication Receiver component and the checkSysPwd function, allowing authentication bypass and remote operating system command injection. Source: NVD (CVE-2026-105134) and NVD (CVE-2026-105133).
- CVE-2026-76519 (Cisco Secure Email Gateway): Path traversal issue that can allow unauthenticated remote attackers to write arbitrary files on the operating system. Source: NVD.
- CVE-2026-0322 (Palo Alto Networks PAN-OS): Code injection through which an authenticated attacker, with network access, can run arbitrary code with maximum administrative privileges (root) on the firewall. Source: NVD.
- CVE-2026-104935 (Ivanti Connect Secure): Authentication bypass via spoofing flaw that allows an unauthenticated attacker to execute arbitrary remote commands. Source: NVD.
- CVE-2026-96951 (Microsoft Windows): Command injection vulnerability in Windows Shell that allows an unauthorized attacker to bypass security barriers via network. Source: NVD.
New critical vulnerabilities
- CVE-2026-111643 (Misaka Danmu Server): Authentication bypass on the configuration history rollback endpoint, allowing unsigned attackers to modify configurations (such as allowed IP lists) to gain administrator access. Source: NVD.
- CVE-2026-111690 (Simple Admin Core): Use of a hardcoded security secret in configuration files allows the generation of valid administrative authentication tokens. Source: NVD.
- CVE-2026-111693 (DataBuff ai-apm-web): Presence of a default administrative account with predefined credentials, allowing the acquisition of an administrative session token on protected routes. Source: NVD.
- CVE-2026-111704 (LangChat): Absence of authentication permission verification exposes configuration parameters, external API keys for LLMs, and plaintext user passwords. Source: NVD.
- CVE-2026-110653 (LatePoint for WordPress): A race condition (TOCTOU) in OTP verification allows bypassing lockout restrictions for multiple login attempts and compromising customer accounts. Source: NVD.
- CVE-2026-104736 (LearnPress for WordPress): Insecure deserialization via the ‘checkout-email’ parameter allowing execution of malicious PHP objects in the system. Source: NVD.
- CVE-2026-111911 (phpMyFAQ): Flaw in the WebAuthn flow allowing the attachment of a security key for a legitimate user without prior authentication validation. Source: NVD.
What we recommend
- Rapid patch application (Patch Management): Prioritize updates for systems with actively exploited vulnerabilities, especially Fortinet, Palo Alto Networks, Cisco, Ivanti, and Atlassian technologies.
- Inventory of affected assets: Identify if you have phpMyFAQ instances, Misaka Danmu servers, DataBuff installations, or vulnerable WordPress plugins (LatePoint and LearnPress) in your network, and update them to secure versions.
- Securing configurations and modifying credentials: Change any default passwords on active systems in the network and ensure that secrets or cryptographic keys are not hardcoded in configuration files.
Security News, in your inbox
New News articles, with their full text and a link to the website. One daily email at 09:00 Romania time. No new articles in your chosen language, no email.
