Today, October 21, 2026, the CyberSec Intelligence team presents the daily security vulnerability analysis. We closely monitor new threats targeting critical infrastructures, enterprise systems, and network equipment to ensure your data protection.
Actively exploited vulnerabilities
- CVE-2026-106931 (EG Secure Solutions SiteGuard Server Edition): An OS command injection vulnerability allows an attacker to execute arbitrary commands with root or SYSTEM privileges. Source: NVD.
- CVE-2026-96656 (Plex Media Server): External control of file name or path, allowing an administrator user to write arbitrary files that can be executed upon loading. Source: NVD.
- CVE-2026-96655 (Plex Media Server): A Server-Side Request Forgery (SSRF) vulnerability in the ‘/video/:/transcode/universal’ parameter that allows authenticated users to request arbitrary internal or external addresses. Source: NVD.
- CVE-2026-96642 (Plex Media Server): Improper neutralization of encoded URI schemes in a web page, allowing functions of other plugins to be called with their own parameters. Source: NVD.
- CVE-2026-96652 (Plex Media Server): SSRF vulnerability that allows an attacker to use an X-Plex-Token value to include a full URL in the ‘protocol’ parameter and force the server to send POST requests to an attacker-selected destination. Source: NVD.
- CVE-2026-110936 (Siemens Software Center): Uncontrolled search path element that allows an authenticated local attacker to execute arbitrary code by placing a malicious DLL in a directory used by the application. Source: NVD.
- CVE-2026-102764 (BeyondTrust Remote Support): Authentication bypass via spoofing, providing a remote attacker with the ability to perform file operations on the appliance. Source: NVD.
- CVE-2025-61624 (Fortinet Multiple Products): Path traversal in FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that allows an authenticated attacker with an administrator profile and write/delete permissions to write or delete arbitrary files via specific CLI commands. Source: NVD.
- CVE-2026-21589 (Atlassian Multiple Products): Externally accessible files and directories in Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible, and Fisheye, allowing unauthenticated users to access specific resources from the web application root. Source: NVD.
- CVE-2026-105134 (Ahsay AhsayCBS): Command injection in the Replication Receiver component by manipulating the ‘random’ parameter in the /rps/api/json/UpdateReceivers.do endpoint (can be chained with CVE-2026-105133). Source: NVD.
- CVE-2026-105133 (Ahsay AhsayCBS): Improper authentication in the checkSysPwd function, allowing a remote attacker to bypass authentication by manipulating the ‘random’ parameter. Source: NVD.
- CVE-2026-76519 (Cisco Secure Email Gateway): Relative path traversal allowing an unauthenticated external attacker to write arbitrary files on the underlying operating system. Source: NVD.
- CVE-2026-0322 (Palo Alto Networks PAN-OS): Code injection allowing an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. Source: NVD.
New critical vulnerabilities
- CVE-2026-112370 (H3C Magic NX15): OS command injection in the sub_416874 function in /usr/bin/usrlist, exploitable remotely. The exploit is public. Source: NVD.
- CVE-2026-113390 (DrayTek Vigor2960): OS command injection in the sub_182B0 function (/cgi-bin/mainfunction.cgi) via the usefile/usescript/option argument. The device is at end-of-support (EoS) and has limited support. Source: NVD.
- CVE-2026-113678 (Froxlor): Symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated clients to take control of host directories by abusing the traffic cron running as root. Source: NVD.
- CVE-2026-113802 (Wavlink WL-WN530BE1-A): OS command injection in the sub_23B54 function via the file_id parameter in /protocol.csp?opt=ovpn_file requests. A remote attacker can bypass authentication by sending a spoofed ‘IP-FROM: 127.0.0.1’ header. Source: NVD.
- CVE-2026-10131, CVE-2026-10132, CVE-2026-10133, CVE-2026-10135, CVE-2026-10136, CVE-2026-10137, CVE-2026-10138, CVE-2026-10139 (TOTOLINK-X2000R): A series of critical vulnerabilities in the router firmware (OS command injection, buffer overflow in formPasswordSetup, formIpQos, batchupg, formUpload, and Mcli) that can lead to arbitrary code execution via specific HTTP requests. Sources: CVE-2026-10131, CVE-2026-10132, CVE-2026-10133, CVE-2026-10135, CVE-2026-10136, CVE-2026-10137, CVE-2026-10138, CVE-2026-10139.
From the security press
- CVE-2026-106173 (FortiSIEM): A Proof-of-Concept (PoC) exploit has been published for a critical path traversal vulnerability, which allows remote code execution by unauthenticated users. Source: The Hacker News.
- Weekly Recap: The current recap highlights large-scale cyber attacks, including 98 zero-day vulnerabilities, compromised AI agents, massive cryptocurrency thefts, and more than 700 supermarkets affected. Source: The Hacker News.
What we recommend
- Patch Management: Prioritize applying security updates provided by manufacturers for products publicly exposed or directly on the internet (Palo Alto, Fortinet, Atlassian, Cisco).
- Asset Inventory and EoS Equipment Retirement: Identify devices on the network that no longer receive security updates from manufacturers (such as DrayTek Vigor2960) and plan for their replacement.
- Network Segmentation and Access Limitation: Protect the management interfaces of SOHO devices and routers through strict access policies (VLAN, VPN), forbidding direct access from the internet.
Security News, in your inbox
New News articles, with their full text and a link to the website. One daily email at 09:00 Romania time. No new articles in your chosen language, no email.
