Cybersecurity Bulletin – October 15, 2026

CyberSec Intelligence presents the daily analysis of the most important reported vulnerabilities and cybersecurity incidents. This report includes details about active exploits, newly identified vulnerabilities with critical impact, and news from the specialized press, providing clear recommendations for protecting your infrastructure.

Actively Exploited Vulnerabilities

• CVE-2026-105134 (Ahsay AhsayCBS): A “command injection” vulnerability in the Replication Receiver component allows a remote attacker to execute commands in the operating system by manipulating the random parameter. This can be chained with CVE-2026-105133.
• CVE-2026-76519 (Cisco Secure Email Gateway): A “relative path traversal” flaw that allows an unauthenticated remote attacker to write arbitrary files to the host operating system.
• CVE-2026-105133 (Ahsay AhsayCBS): An improper authentication issue in the checkSysPwd function allows authentication bypass by manipulating the random parameter, which can be used in tandem with CVE-2026-105134.
• CVE-2026-0322 (Palo Alto Networks PAN-OS): A code injection vulnerability that allows an authenticated attacker, with network access, to execute arbitrary code with root privileges on the firewall.
• CVE-2026-104935 (Ivanti Connect Secure): Authentication bypass via spoofing, allowing an unauthenticated remote attacker to execute arbitrary commands.
• CVE-2026-96951 (Microsoft Windows): A command injection in Windows Shell that allows an unauthorized attacker to bypass security features over the network.
• CVE-2015-5477 (ISC BIND): Data processing errors that allow remote attackers to cause a denial of service (DoS) state via TKEY queries.
• CVE-2016-3081 (Apache Struts): Command injection that allows remote attackers to execute arbitrary code via the method prefix when Dynamic Method Invocation is enabled.
• CVE-2023-22894 (Strapi Strapi): Cleartext storage of sensitive information in the admin panel, allowing user details extraction. Can be chained with CVE-2023-22621 for RCE; transitioning to a supported version is recommended if the product is at End of Life (EoL).
• CVE-2021-3199 (ONLYOFFICE Docs): Directory traversal via an image upload parameter when using JWT, facilitating remote code execution.
• CVE-2015-3306 (ProFTPD): Improper access control that allows remote attackers to read and write arbitrary files via site cpfr and site cpto commands.

New Critical Vulnerabilities

• CVE-2026-109108 (Wavlink WL-WN530BE1-A): An operating system command injection via the popen function in uploadVpn.cgi, remotely exploitable (CVSS score 9.9).
• CVE-2026-109110 (Wavlink WL-WN592AX6): Command injection in the wmapd Daemon component, allowing remote attacks (CVSS score 10).
• CVE-2026-63354 (Affected System): Improper validation of data from imported CSV trace files allows execution of JavaScript code in the browser of an authorized user who has diagnostic read permissions (CVSS score 9.6).
• CVE-2026-74040 (Wazuh): Bypassing filename checks allows a cluster worker to overwrite protected files on the master, obtaining remote code execution with root privileges on the manager and agents (CVSS score 9.1).
• CVE-2026-100133 (Adobe Commerce): A stored XSS vulnerability in vulnerable form fields can be exploited to run malicious scripts in the victim’s browser (CVSS score 9.3).
• CVE-2026-106629 (Adobe Experience Manager): Stored XSS vulnerability in form fields that allows attackers to run scripts in the victim’s browser to obtain elevated access (CVSS score 9.3).
• CVE-2026-63146 (Omnispace Agora Project): The combination of a code injection vulnerability in the config.inc.php file with an SQL injection allows unauthenticated attackers to obtain remote code execution on the host system (CVSS score 9.8).
• CVE-2026-93895 (IBM WebSphere Application Server – Liberty): Allows an unauthenticated remote attacker to bypass configured access controls on gRPC service methods (CVSS score 9.1).
• CVE-2026-92097 (Click to Chat for WhatsApp – WordPress plugin): Arbitrary shortcode execution due to faulty REQUEST_URI sanitization, allowing unauthenticated attackers to run registered shortcodes in WordPress (CVSS score 9.1).
• CVE-2026-110002 (Snazzy Social Media Feed – WordPress plugin): Allows arbitrary file upload (RCE) due to the absence of authentication and nonce checks in the standalone script save-to-cache.php (CVSS score 9.8).
• CVE-2026-97668 (Abandoned Cart Pro for WooCommerce – WordPress plugin): SQL Injection vulnerability in the update_guest_persistent_cart() function, allowing unauthenticated attackers to extract data or obtain administrator privileges through checkout fields (CVSS score 9.8).
• CVE-2026-104800 (AGE-GATE – WordPress plugin): Allows remote code execution by injecting POST parameters into included files, caused by the lack of authentication and nonce checks on the admin.php endpoint (CVSS score 9.8).

From the Security Press

Cisco Warns of Active Attacks Exploiting New Critical Flaw in Secure Email Gateway

Attackers are actively exploiting a critical security flaw in Cisco Secure Email Gateway. This allows an unauthenticated sender to write files to the device’s operating system by sending an email with a specially crafted attachment, potentially obtaining root privileges.

Nextcloud Servers Compromised via Critical Flaw in Collabora CODE Integration

Attackers exploited a vulnerability in the optional Collabora Online – Built-in CODE Server application to install web shells on Nextcloud servers, allowing command execution with the privileges of the web server account.

An AI-Based Agent Discovered a Critical OTP Bypass in Production

During an authorized assessment, an AI-based pentesting agent autonomously identified a critical authentication bypass on a major insurer’s production website, allowing the user to configure the destination of the OTP code.

Docker Fixes Critical Two-Year-Old Hub Flaw That Allowed Users to Push Images on Behalf of Others

A vulnerability in Docker Hub, located in the personal account to organization conversion feature, allowed a user to push, pull, or delete images belonging to another user. No evidence of active exploitation has been found.

Attackers Chain Three Zero-Day Vulnerabilities in Ivanti Connect Secure for Root Access

An attacker used a sequence of three zero-day vulnerabilities to execute commands as root without authentication in Ivanti Connect Secure. The vendor released patches for only two of the flaws, with the third still being addressed.

SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft

The flaw affects multi-tenant applications on the SAP Business Technology Platform (BTP). An attacker capable of controlling the tenant subdomain can force the application’s OAuth2 credentials to be sent to a server under their control.

LG Smart TVs Vulnerable to Local Network Pre-Auth Root Access Takeover

Three vulnerabilities in LG webOS can be chained to grant an attacker on the same local network root access to certain smart TVs (models 32LQ636BPSA and 27TQ600SW running webOS 7.5.7-25), without requiring a PIN code or user interaction.

What We Recommend

• Patch Management: Urgently apply updates provided by vendors for critical affected products (Cisco, Ivanti, Palo Alto Networks, Microsoft, and Adobe/Wazuh/Wavlink platforms) to prevent active exploitation of these systems.
• Asset Inventory: Conduct a comprehensive inventory of all active plugins on WordPress platforms within the organization and immediately disable unsupervised, outdated, or known-vulnerable modules (such as Click to Chat for WhatsApp, Snazzy Social Media Feed, Abandoned Cart Pro, AGE-GATE).
• Network Traffic Monitoring: Implement strict network traffic monitoring rules, especially for sensitive services such as those using gRPC or internal APIs, to detect early attempts at authentication bypass or command injection.
• Endpoint and Local Network Securing: Given the risks identified at the level of IoT and smart devices, isolate these equipments in separate VLAN networks (network segmentation) and limit their exposure to the internet or to internal production resources.