The CyberSec Intelligence team presents the daily cybersecurity bulletin for October 20, 2026. Today’s analysis highlights a significant volume of actively exploited vulnerabilities in critical remote access, network, and messaging systems, as well as a series of severe breaches discovered in artificial intelligence platforms and content management systems (CMS).
Actively exploited vulnerabilities
- BeyondTrust Remote Support (CVE-2026-102764): Authentication bypass via spoofing, allowing remote attackers to perform file operations on the device. Details: CVE-2026-102764.
- Fortinet Multiple Products (CVE-2025-61624): Path traversal in FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that allows an authenticated attacker with read-write privileges to delete or write arbitrary files via specific CLI commands. Details: CVE-2025-61624.
- Atlassian Multiple Products (CVE-2026-21589): Exposure of files or directories to external parties in Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible, and Fisheye, providing an unauthenticated attacker with access to files in the web application’s root directory. Details: CVE-2026-21589.
- Ahsay AhsayCBS (CVE-2026-105134 and CVE-2026-105133): A command injection (CVE-2026-105134) that can be chained with an improper authentication vulnerability (CVE-2026-105133) to bypass authentication and execute operating system commands. Details: CVE-2026-105134 and CVE-2026-105133.
- Cisco Secure Email Gateway (CVE-2026-76519): Relative path traversal allowing an unauthenticated remote attacker to write arbitrary files to the host operating system. Details: CVE-2026-76519.
- Palo Alto Networks PAN-OS (CVE-2026-0322): Code injection allowing an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. Details: CVE-2026-0322.
- Ivanti Connect Secure (CVE-2026-104935): Authentication bypass via spoofing, allowing an unauthenticated remote attacker to execute arbitrary commands. Details: CVE-2026-104935.
- Microsoft Windows (CVE-2026-96951): Command injection in Windows Shell allowing an unauthorized attacker to bypass a security feature over the network. Details: CVE-2026-96951.
New critical vulnerabilities
- Rank Math SEO PRO for WordPress (CVE-2026-111862): Supply-chain compromise in packages downloaded between October 15 and 16, 2026. Affected versions contain malware that can create hidden backdoors and compromise WordPress credentials. Details: CVE-2026-111862.
- Cognition (CVE-2026-109437): Unauthenticated remote code execution (RCE) caused by the lack of authentication in the REST/SSE API and the use of a default local sandbox. Details: CVE-2026-109437.
- Craft CMS (CVE-2026-112776): Authorization bypass in GraphQL tokens, allowing the modification or deletion of content on other sites within the same instance. Details: CVE-2026-112776.
- Grav API plugin (CVE-2026-112779): Exhaustion of storage resources (disk/APCu) through malicious translation requests or the unauthorized creation of pages due to the lack of page rule checks. Details: CVE-2026-112779.
- H3C Magic NX15 (CVE-2026-112370 and CVE-2026-112371): OS command injection and code injection vulnerabilities in the RPC interface, respectively, exploitable remotely. Details: CVE-2026-112370 and CVE-2026-112371.
- Ning compress-lzf (CVE-2026-109395): Information disclosure from JVM heap or virtual machine crash via specially crafted LZF streams. Details: CVE-2026-109395.
- piflow (CVE-2026-109442): Lack of authentication in the DeepAgents chat endpoint, allowing attackers to call shell tools and execute arbitrary commands. Details: CVE-2026-109442.
- Langchain-Chatchat (CVE-2026-75128): Unauthenticated calling of the shell tool on the `/tools/call` endpoint, allowing the execution of OS commands as root in the Docker environment. Details: CVE-2026-75128.
- DB-GPT (CVE-2026-77932 and CVE-2026-77933): Unauthenticated execution of Python or bash code via ReAct agent, as well as a predefined MySQL root password in docker-compose. Details: CVE-2026-77932 and CVE-2026-77933.
- Letta (CVE-2026-77936): Absence of authentication on API routes in the default configuration, coupled with predefined PostgreSQL credentials allowing command execution through external systems. Details: CVE-2026-77936.
From the security press
Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More – A recap of the week highlighting that severe breaches can originate from trusted services, new devices, or uncontrolled systems, where damage occurs before anomalies are detected. Details: The Hacker News.
What we recommend
- Rigorous patch management: Immediately apply updates for externally exposed solutions (Fortinet, Palo Alto Networks, Cisco, Ivanti, BeyondTrust).
- Securing AI and development platforms: Limit internet exposure for solutions such as Letta, DB-GPT, and Langchain, disabling default configurations without authentication.
- Remediating supply-chain issues: If you use Rank Math SEO PRO, verify the download date of version 3.0.123 and upgrade to 3.0.124.
- Implementing the principle of least privilege: Restrict the execution of system scripts from web applications and isolate runtime environments (containers) that use internal databases.
Security News, in your inbox
New News articles, with their full text and a link to the website. One daily email at 09:00 Romania time. No new articles in your chosen language, no email.
