The security bulletin of October 12, 2026 highlights both security threats actively exploited in recent campaigns and newly identified critical vulnerabilities that require immediate attention from system administrators to prevent infrastructure compromise.
Actively exploited vulnerabilities
The following vulnerabilities are included in the CISA KEV catalog and are actively used in attacks:
- CVE-2015-5477 (ISC BIND): A data processing error allows remote attackers to cause a Denial of Service (DoS) attack via TKEY queries. Details: CVE-2015-5477.
- CVE-2016-3081 (Apache Struts): A command injection vulnerability allows remote arbitrary code execution via the “method:” prefix when Dynamic Method Invocation is enabled. Details: CVE-2016-3081.
- CVE-2023-22894 (Strapi Strapi): Cleartext storage of sensitive information allows users with admin panel access to discover sensitive details through search filters. This can be chained with CVE-2023-22621 to achieve remote code execution (RCE). Details: CVE-2023-22894.
- CVE-2021-3199 (ONLYOFFICE Docs): A path traversal vulnerability via “/..” sequences in the image upload parameter (when using JWT) allows remote code execution. Details: CVE-2021-3199.
- CVE-2015-3306 (ProFTPD): Improper access control allows attackers to read and write to arbitrary files using the “site cpfr” and “site cpto” commands. Details: CVE-2015-3306.
New critical vulnerabilities
- CVE-2026-108576 (TOZED X300): Maximum severity (CVSS 10). An OS command injection vulnerability in the “process_ping” function of the IPPingDiagnostics Handler component via the “Host” argument allows remote attacks. Details: CVE-2026-108576.
- CVE-2026-108540 (OpenSpug Spug): Critical severity (CVSS 9.9). An OS command injection vulnerability affects the File Transfer component (“/exec/transfer”) up to versions 3.4.0/4.0.1, allowing remote execution. Details: CVE-2026-108540.
- CVE-2026-108551 (openapi-typescript-codegen): Critical severity (CVSS 9.8). A code injection via attacker-controlled OpenAPI documents allows running arbitrary JavaScript code through the interpolation of unfiltered values in string literals. Details: CVE-2026-108551.
- CVE-2026-108598 (Floci): Critical severity (CVSS 9.8). A code injection vulnerability in VtlTemplateEngine (versions 1.1.0 through 2.2.0) allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Details: CVE-2026-108598.
- CVE-2026-108707 (Wukong_HRM): Critical severity (CVSS 9.8). Authentication bypass in ParamAspect by omitting the AUTH-TOKEN header provides unauthenticated access to all API endpoints of the HR platform, exposing employee data and payslips. Details: CVE-2026-108707.
- CVE-2026-108753 (Agnaistic agnai): Critical severity (CVSS 9.4). The presence of hardcoded credentials in the “self-host.docker-compose.yml” file allows attackers to authenticate as administrators or generate their own JWT tokens to compromise server configurations. Details: CVE-2026-108753.
- CVE-2026-108860 (BotSharp): Critical severity (CVSS 9.1). Authentication bypass vulnerability in WebStarter by using a hardcoded JWT key in the application settings, allowing token spoofing to impersonate any known user or administrator on protected routes. Details: CVE-2026-108860.
What we recommend
To ensure the protection of your systems against these threats, we recommend implementing the following practical measures:
- Patch management (Patch Management): Prioritize applying security updates provided by manufacturers for the affected products, paying special attention to those actively exploited (BIND, Struts, ONLYOFFICE, ProFTPD, Strapi). For EoL systems, consider replacing or migrating them.
- Configuration and credential auditing: Verify if configuration files contain hardcoded credentials (such as JWT secrets or default passwords in docker-compose files). Replace all default secrets with randomly generated and secure ones.
- IT Asset Inventory (Asset Inventory): Maintain an updated inventory of all software libraries and applications used (such as openapi-typescript-codegen or BotSharp) to quickly identify vulnerable components in development and production environments.
- Monitoring and access control: Monitor connection logs to detect authentication bypass attempts or unauthorized API calls to sensitive systems (such as HRM platforms or file transfer utilities).
Security News, in your inbox
New News articles, with their full text and a link to the website. One daily email at 09:00 Romania time. No new articles in your chosen language, no email.
