The CyberSec Intelligence team presents the summary of major vulnerabilities identified or reported as actively exploited today, October 19, 2026. We recommend immediate analysis of exposed systems and the application of necessary patches.
Actively Exploited Vulnerabilities
The following vulnerabilities are confirmed to be used in active attacks, according to recent security indicators:
- CVE-2026-102764 (BeyondTrust Remote Support): Authentication bypass via spoofing vulnerability that allows a remote attacker to perform file operations on the appliance. Details: source.
- CVE-2025-61624 (Fortinet Multiple Products): Path traversal vulnerability in FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that allows an administrator with write permissions to delete or write arbitrary files via specific CLI commands. Details: source.
- CVE-2026-21589 (Atlassian Multiple Products): Exposes files and directories from the web application root (Bitbucket, Confluence, Jira, Bamboo, etc.) to unauthenticated attackers. Details: source.
- CVE-2026-105134 and CVE-2026-105133 (Ahsay AhsayCBS): Command injection and incorrect authentication vulnerabilities that can be chained to bypass authentication and execute operating system commands. Details: source CVE-2026-105134 and source CVE-2026-105133.
- CVE-2026-76519 (Cisco Secure Email Gateway): Allows an unauthenticated remote attacker to write arbitrary files on the operating system via a relative path traversal vulnerability. Details: source.
- CVE-2026-0322 (Palo Alto Networks PAN-OS): Code injection allowing an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. Details: source.
- CVE-2026-104935 (Ivanti Connect Secure): Authentication bypass via spoofing, providing an unauthenticated attacker with the ability to run arbitrary commands. Details: source.
- CVE-2026-96951 (Microsoft Windows): Command injection in Windows Shell that allows an unauthorized attacker to bypass a security feature over the network. Details: source.
New Critical Vulnerabilities
We highlight two newly identified vulnerabilities, assessed with the highest severity level:
- CVE-2026-111911 (phpMyFAQ): Critical WebAuthn authentication bypass in versions 4.0.0 to 4.1.9, facilitating complete account takeover without validating the security challenge. Details: source.
- CVE-2026-111998 (Vanus): Hardcoded and predefined administration token in versions 0.8.0 to 0.9.0 providing complete cluster-admin access via the gRPC proxy port. Details: source.
Recommendations
To secure your organization’s infrastructure, we recommend the following immediate defensive measures:
- Rapid patch application: Prioritize updating PAN-OS, Fortinet, Cisco Secure Email Gateway, and Ivanti systems, which are subject to active exploitation in the wild.
- Credentials and configuration auditing: Verify the versions used for phpMyFAQ and Vanus to eliminate the use of static tokens or unsecure authentication protocols.
- System log monitoring: Implement specific alerts in SIEM/EDR systems to identify path traversal attempts or unauthorized command executions on exposed application servers.
Security News, in your inbox
New News articles, with their full text and a link to the website. One daily email at 09:00 Romania time. No new articles in your chosen language, no email.
