Compiled 22 October 2026 from vendor advisories, CVE.org, national CERTs and Phoronix. Items circulating in a widely shared social-media infographic were checked one by one; anything we could not verify is labelled below.
What Is Exploited Right Now
- Exploited in the wild now: FortiMail CVE-2026-104286, Cisco Secure Email CVE-2026-76519, NetScaler CVE-2026-88771, Atlassian CVE-2026-21589 (CISA KEV). Patch these first if you run them.
- Hits a typical Lightsail/Ubuntu stack: PHP CVE-2026-109618/109619 (unauthenticated RCE, fixed 8.2.35/8.3.36/8.4.27/8.5.12), NGINX (fixed 1.30.6/1.31.7), Node.js (fixed 22.23.4/24.22.1/26.12.1), CPython ssl, and the Linux kernel (PwnEscape, plus 6 ZDI bugs leaked on LKML that are still unpatched in mainline, including two 9.0 RCEs in KSMBD/SMB Direct).
- Trust incident: the private keys for 8 eMudhra emSign intermediate CAs can be recovered. Update ca-certificates and Go (1.26.10/1.27.3). Browsers already block these intermediates.
- Windows: the October Patch Tuesday DHCP Server RCE CVE-2026-96934 (9.8) is verified. The infographic's DNS ID CVE-2026-83809 could not be verified.
By the Numbers
- 35 vulnerabilities tracked
- 27 rated Critical, 6 High, 2 Medium / Unknown
- 4 confirmed exploited in the wild
Vulnerability Table
Scroll sideways on phones to see every column.
| ID | Product | Severity | What / attack type | Exploited? | Affected | Fixed in | Mitigation | Sources |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-110264 | GitLab CE/EE | Critical 10.0 | Unauthenticated RCE (integer overflow in Onigmo regex compiler via .org file #+TODO keywords) | No (detection guidance published; none reported) | All from 7.0 before 18.11.13, 19.0<19.0.10, 19.1<19.1.9, 19.2<19.2.9, 19.3<19.3.6, 19.4<19.4.3, 19.5<19.5.1 | 18.11.13 / 19.0.10 / 19.1.9 / 19.2.9 / 19.3.6 / 19.4.3 / 19.5.1 (released 21 Oct 2026). GitLab.com already patched. | Upgrade now; restrict public projects; watch exceptions_json.log for OtherMarkup Timeout::Error bursts and Workhorse 502s on .org blobs. | [1] [2] |
| CVE-2026-97229 | GitLab CE/EE | Critical 10.0 | Unauthenticated RCE via crafted regex in .gitlab-ci.yml (CI/CD regex compiler integer overflow) | Not confirmed in sources found | 19.2 < 19.2.8, 19.3 < 19.3.5, 19.4 < 19.4.2 (per search summaries; check advisory for older branches) | 19.2.8 / 19.3.5 / 19.4.2 (patch release 19.4.2, ~12 Oct) | Upgrade; restrict public project creation and untrusted CI execution. | [1] [2] |
| CVE-2026-63688 | Dell Container Storage Modules | Critical 10.0 | Missing authentication in csm-authorization-storage gRPC server, exposes storage admin creds for all arrays | Not reported | CSM < 1.18.0 | CSM 1.18.0 (DSA-2026-448) | Restrict network access to Authorization service; rotate storage credentials. | [1] |
| CVE-2026-63692 | Dell Container Storage Modules | Critical 10.0 | Missing authentication in CSM Authorization proxy/tenant service, admin privileges | Not reported | CSM < 1.18.0 | CSM 1.18.0 | Same as above. | [1] [2] |
| CVE-2026-89111 | SAP Cloud SDK for Python | Critical 10.0 | OAuth2 SSRF via tenant_subdomain, client-credential theft | Not reported | SAP Cloud SDK for Python < 0.45.2 | 0.45.2 | Allowlist tenant_subdomain values. | [1] [2] |
| CVE-2026-89110 | SAP NetWeaver Visual Composer | Critical 9.9 | Broken access control (authenticated low-priv user invokes internal ops) | Not reported | VC70RUNTIME 7.50 | SAP Note 3797111 | Enable secure data-service allowlist config. | [1] |
| CVE-2026-89107 | SAP S/4HANA | Critical Unverified (9.1-10.0 range per infographic) | Code injection (ABAP) via Fiori substitution/validation rules, authenticated | Not reported | S4CORE 105-109 | SAP Note 3805589 | Temporarily disable ZUI_SUBSTNVALDNRULE_MANAGE. | [1] |
| CVE-2026-89108 | SAP MII | Critical Unverified (9.1-10.0 range per infographic) | Privilege escalation: MII admin can create SAP_J2EE_Engine_Admin account | Not reported | XMII 15.4 / 15.5 | SAP Note 3798788 | No workaround listed by SAP. | [1] |
| CVE-2026-96934 | Windows DHCP Server | Critical 9.8 | Unauthenticated RCE via crafted DHCP packets | Not confirmed (the October zero-day reported was CVE-2026-96951) | Windows Server with DHCP role | October 2026 Patch Tuesday (13 Oct) | Patch DHCP servers first; never expose DHCP to untrusted networks. | [1] |
| CVE-2026-83809 | Windows DNS Server | Unknown UNVERIFIED | Could not find any record for this ID. Sources list a Windows DNS RCE as CVE-2026-96113, so the infographic ID may be wrong | Unknown | Unknown | October 2026 Patch Tuesday covers Windows DNS fixes | Install October 2026 cumulative updates on DNS servers. | [1] |
| CVE-2026-104286 | Fortinet FortiMail | Critical 9.8 | Unauthenticated path traversal, arbitrary file write (IBE endpoint) | YES, actively exploited (zero-day) | 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, 7.2.0-7.2.9 | 8.0.2 / 7.6.7 / 7.4.9; 7.2: migrate to 7.4+ | Disable IBE, restrict web admin, block POST /ibe with '../'; hunt IoCs. | [1] [2] |
| CVE-2026-76504 | Cisco Catalyst SD-WAN Manager | Critical 9.8 | API authentication bypass | Not confirmed | See advisory | 20.9.10.1 / 20.12.8.2 / 20.15.6.1 / 20.18.4.1 / 26.1.2.1 / 26.2.1 | Restrict management API access. | [1] |
| CVE-2026-76519 | Cisco Secure Email Gateway | Critical 9.8 | Arbitrary file write | YES, actively exploited | AsyncOS (see advisory) | AsyncOS 15.5.5-014 / 16.5.0-780 | Patch; review appliance for compromise. | [1] [2] |
| CVE-2026-76471 | Cisco NX-OS | Critical 9.8 | NX-API RCE / DoS | Not confirmed | NX-OS with NX-API enabled | Use Cisco Software Checker; Live Protect shield LP00074 for 10.6(3) | Disable NX-API if not needed. | [1] |
| CVE-2026-76742 | HPE Aruba AOS-Switch | Critical 9.8 | Web management authentication bypass | Not reported | AOS-S 16.11.0000-16.11.0031 | 16.11.0032+ | Restrict mgmt to admin VLAN, disable web UI if unused. | [1] [2] |
| CVE-2026-76743 | HPE Aruba AOS-Switch | Critical 9.8 | Management interface authentication bypass | Not reported | AOS-S 16.11.0000-16.11.0031 | 16.11.0032+ | Same as above. | [1] |
| CVE-2026-76744 | HPE Aruba AOS-Switch | Critical 9.8 | Unauthenticated buffer overflow, RCE | Not reported | AOS-S 16.11.0000-16.11.0031 | 16.11.0032+ | Same as above. | [1] |
| CVE-2026-88771 to -88778 (bulletin also includes -88774) | Citrix NetScaler ADC/Gateway | Critical 8.8-9.5 (CVSS v4, per infographic; per-CVE scores not individually verified) | 88771: unauthenticated RCE; 88778: TCP ISN prediction; others see bulletin | YES, CVE-2026-88771 exploited as a zero-day (CISA, 27 Sep) | Customer-managed NetScaler ADC/Gateway 14.1 and 13.1 | 14.1-73.37+ / 13.1-64.23+; also enable Enhanced ISN Generation for 88778 | Patch, kill active sessions, hunt for webshells. | [1] [2] |
| CVE-2026-21589 | Atlassian Data Center (Jira, Confluence, Bitbucket, Bamboo, Crowd, Fisheye/Crucible) | Critical 9.3 | Unauthenticated arbitrary file read in web root (path must be known) | YES, in CISA KEV since 15 Oct 2026, after public PoC | Self-hosted Data Center/Server products (see advisory) | Fixed versions listed in Atlassian advisory | Remove internet exposure; WAF/Tomcat mitigations; check logs for traversal. | [1] [2] |
| CVE-2026-99999 | Linux Kernel (net/KVM) 'PwnEscape' | Critical Critical (infographic: 8.8-9.3) | KVM guest-to-host escape via IPv4 checksum metadata, host memory corruption | Public research/analysis; in-the-wild exploitation not confirmed | Kernels before fixed stable releases | 5.10.272 / 5.15.223 / 6.1.190 / 6.6.159 / 6.12.113 / 6.18.57 / 7.2.11+ | Update host kernel and reboot. | [1] [2] |
| CVE-2026-98283 | Linux Kernel KVM (PowerPC Book3S HV) | High High | Nested-virt use-after-free from L1 guest | Not reported | PowerPC KVM hosts only | 6.1.189 / 6.6.158 / 6.12.112 / 6.18.54 / 7.2.8+ | Not relevant to x86 servers. | [1] |
| CVE-2026-15176 | NGINX | Critical 9.2 (CVSS v4, F5); nginx.org rates 'medium' | Heap buffer overflow with alias + rewrite | Not reported | 0.1.29-1.31.6 | 1.30.6 / 1.31.7 (14 Oct) | Upgrade; review alias+rewrite configs. | [1] [2] |
| CVE-2026-93479 | NGINX | Critical 9.2 (CVSS v4) | Heap buffer overflow in script/string expression evaluation | Not reported | 1.31.2-1.31.6, 1.30.0-1.30.5 | 1.30.6 / 1.31.7 | Upgrade. | [1] |
| CVE-2026-97205 | NGINX | Critical 9.2 (CVSS v4) | Use-after-free with AIO / SSI | Not reported | 0.8.11-1.31.6 | 1.30.6 / 1.31.7 | Disable aio/ssi if unused until patched. | [1] |
| CVE-2026-109618 | PHP Core | Critical 9.2 | RCE via memory corruption during out-of-memory handling (unauth on mod_php) | No in-the-wild reports found; RCE demonstrated | All web-serving PHP (mod_php, FPM, CGI, FrankenPHP, LiteSpeed); 8.2.0-8.2.34, 8.3.0-8.3.35, 8.4 < 8.4.27, 8.5.0-8.5.11; 8.1 and older: no fix | 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 | memory_limit=-1 via php_admin_value, low post_max_size (partial only). | [1] [2] |
| CVE-2026-109619 | PHP Core | Critical 9.2 | RCE via stale global state (use-after-free across requests) | No in-the-wild reports found | Same as above | Same as above | session.upload_progress.enabled=0 + restart workers (partial). | [1] [2] |
| CVE-2026-19445 | CPython (ssl) | Critical 9.2 (per infographic; not independently confirmed) | Use-after-free of server SSLContext when sni_callback switches contexts | Not reported | Before 3.10.22 / 3.11.17 / 3.12.15 / 3.13.16 / 3.14.8 / 3.15.0rc3 | Those versions | Keep references to SNI contexts for server lifetime. | [1] [2] |
| CVE-2026-111497 | Node.js (Brotli) | High High (CVSS 3.1 8.1 per CERT SantΓ©) | Out-of-bounds write in Brotli decoder (zlib / fetch()), RCE / memory disclosure | No; public PoC exists | 22.x < 22.23.4, 24.x < 24.22.1, 26.x < 26.12.1; 20.x and older EOL | 22.23.4 / 24.22.1 / 26.12.1 (21 Oct). Same release fixes ~10 CVEs: 106069, 106072, 105482, 105483, 105481, 106074, 106070, 106073, 111497 + deps (c-ares, OpenSSL, undici, eMudhra CA) | Upgrade; avoid decompressing untrusted Brotli. | [1] [2] |
| CVE-2026-111943 | eMudhra emSign CA / Go crypto/x509 | High N/A (trust incident) | 8 intermediate CA private keys recoverable (weak entropy), so attackers can forge TLS certs for any site | Unknown: no CT-logged misuse; non-CT clients can't be ruled out | Go < 1.26.10, 1.27.0 < 1.27.3; any client with stale CA store | Go 1.26.10 / 1.27.3 (rebuild binaries); updated ca-certificates (Ubuntu, Debian, Alpine...); Chrome/Firefox/Apple/MS already blocked. Chrome drops emSign ECC Root CA - G3 on 27 Oct | Update ca-certificates; replace any cert chaining to emSign ECC Root CA - G3. | [1] [2] [3] |
| ZDI-CAN-33549 | Linux Kernel (ZDI LKML leak, 22 Oct) | Critical 9.0 | SMB Direct RCE via integer underflow; patch in a branch for Linux 7.5, likely to be expedited | Not known; details are now public with no CVE assigned yet | Mainline currently unpatched | None in mainline yet; watch distro kernel updates | KSMBD/SMB Direct: unload ksmbd, block TCP 445; vmwgfx only matters on VMware guests. | [1] |
| ZDI-CAN-33774 | Linux Kernel (ZDI LKML leak, 22 Oct) | Critical 9.0 | KSMBD race condition, RCE | Not known; details are now public with no CVE assigned yet | Mainline currently unpatched | None in mainline yet; watch distro kernel updates | KSMBD/SMB Direct: unload ksmbd, block TCP 445; vmwgfx only matters on VMware guests. | [1] |
| ZDI-CAN-33367 | Linux Kernel (ZDI LKML leak, 22 Oct) | High Not stated | skb_zerocopy (skbuff) local privilege escalation; same bug reported by another source, patch expected soon | Not known; details are now public with no CVE assigned yet | Mainline currently unpatched | None in mainline yet; watch distro kernel updates | KSMBD/SMB Direct: unload ksmbd, block TCP 445; vmwgfx only matters on VMware guests. | [1] |
| ZDI-CAN-34068 | Linux Kernel (ZDI LKML leak, 22 Oct) | High Not stated | vmwgfx (VMware graphics) out-of-bounds write, LPE | Not known; details are now public with no CVE assigned yet | Mainline currently unpatched | None in mainline yet; watch distro kernel updates | KSMBD/SMB Direct: unload ksmbd, block TCP 445; vmwgfx only matters on VMware guests. | [1] |
| ZDI-CAN-34076 | Linux Kernel (ZDI LKML leak, 22 Oct) | Medium Not stated | NVMET uninitialized resource, info disclosure | Not known; details are now public with no CVE assigned yet | Mainline currently unpatched | None in mainline yet; watch distro kernel updates | KSMBD/SMB Direct: unload ksmbd, block TCP 445; vmwgfx only matters on VMware guests. | [1] |
| ZDI-CAN-32005 | Linux Kernel (ZDI LKML leak, 22 Oct) | High Not stated | Search-domain TCP query stack buffer overflow, LPE (posted a day earlier) | Not known; details are now public with no CVE assigned yet | Mainline currently unpatched | None in mainline yet; watch distro kernel updates | KSMBD/SMB Direct: unload ksmbd, block TCP 445; vmwgfx only matters on VMware guests. | [1] |
Action Checklist for Small Businesses
Written for a typical small-business setup: Ubuntu servers, Lightsail with PHP/Node/NGINX, Windows PCs and Fire TVs.
- Today, PHP: run
php -v. Ubuntu packages:sudo apt update && sudo apt full-upgrade, then confirm the Ubuntu USN for CVE-2026-109618/109619 is applied (or use the ondrej PPA to get 8.2.35/8.3.36/8.4.27/8.5.12). Restart php-fpm/apache. If you can't patch yet, setphp_admin_value[memory_limit]=-1andsession.upload_progress.enabled=0. PHP 8.1 and older: upgrade the major version. - NGINX: run
nginx -vand upgrade to 1.30.6+/1.31.7+ (nginx.org repo or distro update). Disableaio/ssiif you don't use them. - Node.js: upgrade to 22.23.4 / 24.22.1 / 26.12.1 (nvm or NodeSource), then restart pm2/systemd services. Move anything on 20.x to a supported line.
- Kernel: install the latest Ubuntu kernel and reboot (PwnEscape fix). For the ZDI leak: if you don't need SMB serving, run
sudo modprobe -r ksmbdand blacklist it, and never expose TCP 445 in the Lightsail firewall. Check for updated kernels again over the next 1-2 weeks. - CA trust: run
sudo apt install --only-upgrade ca-certificates. Rebuild any Go binaries with Go 1.26.10/1.27.3. If a certificate you own chains to emSign ECC Root CA - G3, replace it before 27 Oct. - Python: update python3 packages (CVE-2026-19445). This only matters if you run TLS servers that use sni_callback.
- Lightsail hygiene: take a snapshot before patching. Open only ports 80/443 publicly and restrict SSH to your IP. Run
unattended-upgrades. Check logs for odd 5xx bursts or PHP worker crashes. - Windows PCs: install the October 2026 cumulative update (Settings β Windows Update) and reboot. Update Chrome/Edge/Firefox. Most of the Windows CVEs here affect the DNS/DHCP Server roles, so patch them on any Windows Server you run.
- Fire TVs: Settings β My Fire TV β About β Check for updates. Remove sideloaded apps you don't use. Keep the TVs on a guest/IoT Wi-Fi network, separate from your servers and PCs. None of the listed CVEs are confirmed to affect Fire OS.
- Vendor gear (only if you have it): GitLab, Atlassian, FortiMail, Cisco, Aruba switches, NetScaler, SAP, Dell CSM. Patch them using the fixed versions in the table. Exploited items come first.
What We Could Not Verify
- CVE-2026-83809 (listed as Windows DNS Server 9.8): no record found. Sources point to CVE-2026-96113 as the October Windows DNS RCE.
- Exact CVSS for SAP CVE-2026-89107/-89108, CPython 9.2, and individual NetScaler scores (8.8-9.5 v4) come from the infographic range and were not individually confirmed. GitLab CVE-2026-97229 fixed versions for branches older than 19.2 were not confirmed. The NetScaler bulletin also covers CVE-2026-88774, which the infographic omitted.
- The ZDI-CAN reports have no CVE IDs yet, and four have no published CVSS. Exploitation status of DHCP CVE-2026-96934 was not confirmed.
- Dates are as reported by vendors. Recheck the advisories before acting, because they are updated frequently.
MediaVision Technical Analysis
Most small offices do not run GitLab or FortiMail, but almost every business website runs PHP, NGINX or Node.js, and every office has Windows PCs. Patch those first, take a snapshot before you do, and reboot afterwards — a kernel or Windows update that is installed but not rebooted is not protecting you. If you run a business in Orange County and are not sure what versions your server or website are on, we will check them for you.
