Cybersecurity News

Exploited-now vulnerabilities and patch alerts, each checked against CISA KEV or the vendor.

confirmed2026-10-13

Windows Shell zero-day CVE-2026-96951 exploited; on CISA KEV, due Oct 16

Microsoft's October Patch Tuesday marks this Windows Shell security feature bypass (CVSS 8.8) as 'Exploitation Detected'. CISA added it to KEV on Oct 13 (listed as a Windows command injection) with an Oct 16 federal due date. Patch Windows endpoints first.

Sources: MSRC · CISA KEV

confirmed2026-10-13

Ivanti Connect Secure CVE-2026-104935 added to KEV, due Oct 16

Authentication bypass by spoofing leading to remote command execution (CVSS 8.6). Listed in CISA KEV on Oct 13 with an Oct 16 due date. Apply Ivanti's fix and review appliance integrity.

Sources: Ivanti advisory · CISA KEV

confirmed2026-10-13

October 2026 Patch Tuesday: criticals to prioritize after the zero-day

Not known exploited, but high-value: Exchange Server RCE CVE-2026-70571 (8.1) and AD Domain Services RCE CVE-2026-70229 (8.1), both 'Exploitation More Likely'; Outlook RCEs at 9.8 such as CVE-2026-70242; Message Queuing RCE CVE-2026-100202 (9.8); DHCP Server RCE CVE-2026-96934 and QUIC RCEs. Severity and exploitability labels are Microsoft's.

Sources: MSRC release notes · NVD CVE-2026-70571 · NVD CVE-2026-70229 · NVD CVE-2026-70242 · NVD CVE-2026-100202

exploited (researcher), not on KEV2026-10-13

REDCap CVE-2026-90817 unauthenticated RCE exploited via public surveys

Unit 42 reports attacks dropping a webshell then a fileless XMRig miner. Fixed in 16.0.49, 17.3.10 and 17.4.4. Not in CISA KEV as of Oct 13; NVD has no entry yet.

Sources: Unit 42 (via @Unit42_Intel)

unconfirmed2026-10-13

Rumor: exploit for VMware vCenter CVE-2026-59310 offered for sale

A dark-web monitor claims an exploit is for sale at $10k. No confirmed in-the-wild use. Make sure vCenter is patched and not internet-facing.

Sources: @ptdbugs · NVD

exploited (vendor/researcher), not on KEV2026-10-12

AhsayCBS CVE-2026-105133 + CVE-2026-105134 chain exploited since Oct 7

Auth bypass chained with Replication Receiver RCE gives SYSTEM. Huntress observed webshells and a disguised crypto miner. The first fix was incomplete: install hotfix 10.3.4.45 (v10) or 9.15.2.70 (v7-v9), reboot, then hunt for compromise. Not in CISA KEV as of Oct 13.

Sources: Huntress · Ahsay

exploited (Patchstack), not independently re-verified2026-10-12

Bricksforge WordPress plugin CVE-2026-85097 unauthenticated RCE

Patchstack reports first exploitation on Oct 7. Update the plugin or remove it. We could not reach a primary advisory page today, so treat details as preliminary. Not in KEV as of Oct 13.

Sources: Patchstack database · @averyjparker summary

exploitation reported, not on KEV2026-10-09

SonicWall SMA1000 CVE-2026-102255 pre-auth SSRF under attack

Pre-auth SSRF in the Work Place interface (advisory SNWLID-2026-0017). Upgrade to 12.4.3-03670 or 12.5.0-03082; note 12.5.0-02952, the September zero-day fix, is now listed as affected. Canada's Cyber Centre cites open-source reports of exploitation. Not in KEV as of Oct 13.

Sources: SonicWall PSIRT · CVE record · Cyber Centre AV26-1017