On October 16, 2026, the Python imaging library Pillow shipped version 13.0.0, fixing CVE-2026-112900: an attacker-controlled filename is passed to Ghostscript and runs commands on the server. Upgrade any Python pipeline that opens images, because the flaw affects a library downloaded roughly 436 million times a month.
On October 22, 2026, two remote code execution flaws rated CVSS 9.0 by Trend Micro’s Zero Day Initiative affect KSMBD, the SMB server built into the Linux kernel, with no fix in the mainline kernel. One triggers before any network authentication on port 445: check now whether the module is loaded on your servers.
On October 21, 2026, Node.js shipped security updates for its three supported lines (22.x, 24.x, 26.x) fixing ten flaws, including an out-of-bounds write in the bundled Brotli decoder (CVE-2026-111497) that can lead to remote code execution. With no workaround offered, upgrading to 22.23.4, 24.22.1 or 26.12.1 is the only defense.
On October 16, 2026, researcher Zach Main published Plex2Shell, a chain of four flaws — CVE-2026-96652, 96654, 96655 and 96656 — enabling unauthenticated remote code execution on Plex Media Server. By October 17, attackers were deploying an XMRig miner and a residential proxy on exposed servers: update to 1.43.3.10861 and take Plex off the public internet.
On October 21, 2026, PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix CVE-2026-109618 and CVE-2026-109619, two unauthenticated remote code execution flaws that have lived in PHP since 5.4. They affect 70% of websites, including WordPress, Drupal and Joomla: update the PHP engine, not just your applications.
On October 20, 2026, the NVD published five critical CVEs — scored 9.8 to 9.9 — against the AI agent frameworks Letta, Langchain-Chatchat, DB-GPT, and Piflow: tool-execution endpoints with no authentication and databases shipped with default credentials. If you run one of these frameworks, take it off the public internet until you have checked the version and port exposure.
On 18 October 2026, JPCERT/CC and vendor e-guardian confirmed that CVE-2026-106931, an OS command injection in the statistics feature of SiteGuard Server Edition, is being exploited in the wild. Preserve diagnostic evidence before patching: remediation can erase the attacker’s traces.
On 15 October 2026, Check Point confirms that CVE-2026-85102, a pre-authentication remote code execution flaw in its Security Gateway VPN fixed on 9 September, is now being exploited at scale against Spark firewalls, and ships a fix for a zero-day in its management server. Apply both hotfixes, starting with your management servers, which are watched less closely than the gateways.
On 12 October 2026, GitLab shipped 19.4.2, 19.3.5 and 19.2.8 to fix CVE-2026-97229, an integer overflow in the CI/CD regular expression compiler that allows unauthenticated remote code execution. If you self-host GitLab, upgrade now and treat your .gitlab-ci.yml files as code, not configuration.
On October 14, 2026, Palo Alto Networks patched CVE-2026-0322, a code-injection flaw in the PAN-OS management interface that hands root to an authenticated attacker, and confirmed exploitation has already been observed. Patch before October 17 and verify that your management interface is not exposed to the internet.
On October 12, 2026, GitLab shipped a critical patch closing 24 flaws, including CVE-2026-97229, a CVSS 10.0 integer overflow in the CI/CD regular-expression compiler that is exploitable without authentication. Every operator of a self-managed instance should move to 19.4.2, 19.3.5 or 19.2.8 immediately, because this one no longer even asks for an account.
CVE-2026-84411, scored CVSS 9.8, is an integer underflow in RouterOS’s web management service, reachable before authentication with a single crafted request that yields root code execution. Any MikroTik router whose web interface is reachable from the internet must move to 7.24 or pull that interface off the network.
On October 9, 2026, Citrix shipped a fix for CVE-2026-107406, a memory-overflow bug that lets an attacker run code remotely or crash NetScaler ADC and Gateway appliances configured as a SAML identity provider or service provider. Upgrade to 14.1-73.46 or 13.1-64.29, or drop the SAML configuration if you do not use it.
On October 7, 2026, JFrog disclosed CVE-2026-105192, an unauthenticated remote code execution flaw rated 9.8 in LMCache, the cache layer that speeds up LLM servers such as vLLM, with no fix available. If your LMCache cache listens on a routable address, isolate it now instead of waiting for a patch.
On October 7, 2026, Cisco shipped five critical fixes for NX-OS, the operating system of its Nexus 3000 and 9000 switches: a forged request can run code with root privileges, or crash a process and force a reload. Check whether NX-API, NGOAM or MPLS OAM is enabled on your gear, then patch or disable those features.
FatPipe MPVPN, WARP and IPVPN appliances on the end-of-life 10.1.2r60p100 firmware expose an OS command injection and a stack buffer overflow that both yield an unauthenticated root shell. Move to a supported release and lock down the management interface, which ships disabled by default.
Mandiant and Google Threat Intelligence attribute CVE-2026-88772 to a state-sponsored actor that has exploited the NetScaler DTLS flaw since early September across dozens of organizations. Updating is not enough: hunt for web shells and rotate stolen credentials.
On September 23, 2026, GitLab released a critical patch for 19.4.1, 19.3.3, and 19.2.7, closing two remote code execution flaws at CVSS 9.9 in the pipeline’s regular-expression parser, triggerable by a forged .gitlab-ci.yml file. Any authenticated user who can edit a CI/CD configuration becomes a vector: patch self-managed instances immediately.
watchTowr has documented two remote-code-execution zero-days in Citrix NetScaler ADC and Gateway, already exploited before any fix existed. With nothing published by Citrix, the only defense is isolation: preserve evidence, cut the appliance off the network and keep management off the internet.
Microsoft described CVE-2026-65660 as a CVSS 6.5 spoofing issue; researcher Dinh Ho Anh Khoa showed it is actually a code-injection flaw (CWE-94) enabling authenticated remote code execution, and CISA added it to the KEV catalog on September 25, 2026 after observed attacks. Apply the August 11 patch and audit your SharePoint 2016, 2019 and Subscription Edition servers.
On September 22, 2026, WordPress shipped version 7.1.2 to fix CVE-2026-87902, a critical flaw that lets an unauthenticated attacker include a chosen local PHP file during page-template resolution and, under certain conditions, execute code. Update immediately, especially sites without automatic updates.
On September 17, 2026, SolarWinds shipped a fix for CVE-2026-28326, an unauthenticated remote code execution flaw in Access Rights Manager caused by a hard-coded static key. Apply 2026.2.1 immediately and audit your access-governance tooling for embedded secrets.
On September 19, 2026, Fortinet confirmed active exploitation of CVE-2026-58138, an unauthenticated remote code execution flaw in Orkes Conductor that was published to the NVD on June 30. Upgrade to 3.30.2 and treat any exposed instance as compromised.
On September 1, 2026, advisory HPESBNW05134 fixes more than twenty vulnerabilities in ArubaOS-CX, including two independent bugs — CVE-2026-73749 (CVSS 9.8) and CVE-2026-73782 — that each give unauthenticated code execution on a switch. Isolate the management plane and apply the fixed branch before a public exploit turns these flaws into a mass campaign.
On September 10, 2026, CISA added two MikroTik RouterOS flaws — a missing authentication check and a command injection — to its KEV catalog after active exploitation. The chain yields remote code execution with no credentials, and the federal remediation deadline lands on September 13.
The self-hosted forge Forgejo shipped versions 16.0.4 and 15.0.8 on September 10 to fix a critical RCE born of template expansion, alongside three authorization flaws that share the same root cause. Everything on 16.0.3 or earlier must be patched, and fine-grained token inventories need a review.
On September 9, 2026, SAP shipped fixes for four critical flaws, including CVE-2026-44756 (CVSS 10.0), a memory-corruption bug in Extended Passport processing that yields unauthenticated remote code execution across three protocols at once. Basis teams should patch the SAP kernel first, ahead of any network segmentation effort.
The September 8, 2026 Patch Tuesday fixes nine remote code execution flaws in Windows DNS Server, including CVE-2026-69730, a CVSS 9.8 use-after-free triggerable with a single forged packet. Patch the servers running the DNS role first and segment port 53 before a public exploit appears.
Sansec documents StyleSmuggler, a Magento and Adobe Commerce zero-day exploited since September 4, 2026 that runs code without authentication through the template engine and installs a persistent backdoor. Adobe has published no CVE and no patch yet: disable GraphQL on your stores while waiting for the September 8 bulletin.
On 2 September 2026 Cisco disclosed CVE-2026-20212, a CVSS 9.8 flaw that leaves TCP ports 43210 and 43211 on ten Nexus 9000 switches reachable for unauthenticated remote code execution as root. Apply an iACL on both ports and the Live Protect lp00031 shield now, then check your release in the Software Checker.
On September 1, 2026, VulnCheck observed mass exploitation of CVE-2026-0768, an unauthenticated remote code execution flaw in Langflow, used to harvest OpenAI and AWS keys from exposed instances. It is the sixth Langflow flaw exploited since January: any instance patched below 1.11.6 must be treated as compromised.
On 27 August 2026, GiveWP fixed CVE-2026-82222, a three-bug chain that turns a WordPress donation form into remote command execution with no real authentication. Administrators must upgrade to 4.16.7.2 and check for rogue accounts, even on sites where registration was disabled.
On 30 June 2026, Citrix rated CVE-2026-8452 as a memory overflow. On 14 August, WatchTowr showed it leads to pre-authentication code execution, and on 26 August CISA added it to the KEV catalog with a 29 August deadline. Appliances configured as VPN or AAA servers must be patched today, without waiting for official confirmation of exploitation.
CVE-2026-60004, a critical code-injection flaw in Gitea, has been exploited in the wild since August 25, 2026: an attacker can run shell commands as the forge’s system user. Self-hosted instances with open registration are hit first; the fix comes down to an upgrade and a disable switch.
A deserialization flaw in Entra ID, Microsoft’s cloud identity service, allowed unauthenticated remote code execution — rated CVSS 10.0 and fixed server-side with no customer action. CISOs need to understand what "no action required" actually demands of them.
Ray’s anti-browser defense was a User-Agent header check that Firefox and Safari let you forge through the fetch API. Combined with DNS rebinding, it becomes a remote code execution triggered by a single page visit — added to CISA’s KEV catalog on August 17, 2026 with a fix deadline of August 20.
CVE-2026-73678, scored CVSS 10, lets an attacker with no account run system commands on the MindsDB platform through the Anton agent’s scratchpad tool. If you expose a MindsDB instance, cut public access before even waiting for a patch.
Disclosed on August 12, 2026, an unauthenticated SQL injection in GeoServer’s jsonArrayContains function can lead to remote code execution, and no patch is available yet. Attackers are already probing exposed instances: isolate yours before the fix lands.
On August 2, 2026, Gitea shipped a critical fix for CVE-2026-59774, a path traversal that lets an unauthenticated attacker read any server file via Org-mode markup rendering on a public repository. Worse: by reading the INTERNAL_TOKEN from app.ini, the attacker can escalate to remote code execution. Every self-hosted Gitea administrator must patch and rotate secrets immediately.
A vulnerability chain in WordPress Core, dubbed XSS2Shell, lets an unauthenticated attacker turn a single failed login attempt into full PHP remote code execution. The 7.0.3 patch landed August 6, 2026 — 43% of the web needs to apply it now.
On August 1, 2026, the Rails team patched CVE-2026-66066, a critical Active Storage vulnerability that allows unauthenticated arbitrary file read and RCE escalation via libvips. Akamai named the chain 'KindaRails2Shell' and confirmed full remote-code-execution potential.
CVE-2026-16723 (CVSS 9.0) enables unauthenticated RCE on Fastjson 1.x with no patch forthcoming — ever. Enable SafeMode immediately and plan your Fastjson 2.x migration. Here is the three-step response plan.
CVE-2026-61511 enables unauthenticated PHP code execution through template rendering in vBulletin 5.x and 6.x. A public exploit exists, and the 5.x branch will receive no fix whatsoever.
Broadcom disclosed three critical VMware vulnerabilities on July 29, 2026 — a VMXNET3 VM escape and two unauthenticated RCE flaws targeting vCenter. Patch immediately: compromising vCenter gives an attacker total control over your entire virtualized infrastructure.
JetBrains disclosed CVE-2026-63077 on July 27, 2026 — a CVSS 9.8 unauthenticated remote code execution flaw affecting every on-premises TeamCity instance. No active exploitation has been detected yet, but the clock is ticking: TeamCity's history with state-sponsored attackers makes this a drop-everything patch scenario.
