The Exploit Bulletin — Friday, October 16, 2026: 5 issues require action
Friday, October 16, 2026 — 5 issues require action. If you run none of the software below, you are done.
Affects: Cisco AsyncOS for Secure Email Gateway · BeyondTrust Remote Support · AhsayCBS · Palo Alto Networks PAN-OS / PA-Series / VM-Series firewalls / Panorama · Google Chrome / the report does not state the earliest affected / the V8 and WebP stages are not described as
1. Crafted email attachment gives unauthenticated root file write and command execution on Cisco Secure Email Gateway (CVE-2026-76519)
CISA KEV (due 2026-10-17) · REMOTE CODE EXECUTION · CRITICAL · CVSS 9.8
Cisco published the advisory on 2026-10-14 stating its PSIRT is aware of active exploitation and CISA added the flaw to KEV the same day with a 2026-10-17 due date; a gateway left on a vulnerable AsyncOS build can be rooted by anyone able to deliver mail through it.
A relative path traversal in the Advanced Malware Protection (AMP) attachment handling of Cisco Secure Email Gateway lets an unauthenticated remote sender write arbitrary files to the appliance's operating system by sending an email with a crafted attachment, leading to command execution as root. Only appliances with the File Reputation service enabled and assigned to a mail policy are exploitable.
Affected: Cisco AsyncOS for Secure Email Gateway 15.5 releases earlier than 15.5.5-014; Cisco AsyncOS for Secure Email Gateway 16.5 releases earlier than 16.5.0-780
How to Test: Check the AsyncOS release on each Secure Email Gateway: 15.5 builds earlier than 15.5.5-014 and 16.5 builds earlier than 16.5.0-780 are affected. Confirm whether the File Reputation (AMP) service is enabled and assigned to a mail policy, since the flaw is reachable only in that configuration. Because exploitation arrives as a crafted attachment through normal mail flow, review AMP/file-reputation and mail logs for anomalous attachments and processing errors, and inspect the appliance for unexpected files or processes; CERT-EU advises checking all affected appliances for indicators of compromise, and any sign of tampering should be treated as a root-level compromise of the mail perimeter.
How to Patch: Upgrade AsyncOS for Secure Email Gateway to 15.5.5-014 (15.5 train) or 16.5.0-780 (16.5 train). Cisco states there are no workarounds; the vulnerable code path is only reachable when the File Reputation service is enabled and assigned to a mail policy, so appliances that cannot be upgraded immediately should have that exposure reviewed until the fixed build is installed.
Evidence: CISA KEV · VulnCheck KEV · CISA SSVC: active · Vendor confirmed · CISA adds CVE-2026-76519 to KEV · CERT-EU advisory 2026-017
2. Unauthenticated message-origin bypass allows file operations and appliance takeover in BeyondTrust Remote Support (CVE-2026-102764)
REMOTE CODE EXECUTION · CRITICAL · CVSS 9.3
BeyondTrust published advisory BT26-05 and a fix on 2026-10-15 after Google Threat Intelligence attributed zero-day use since late August 2026 to the China-nexus group Armory Castle (UNC5221), so an unpatched, internet-facing Remote Support appliance should be treated as a likely target already.
Internal components of BeyondTrust Remote Support do not validate the origin of messages they receive, letting an unauthenticated remote attacker perform file operations on the appliance. Reports describe the flaw as an authentication bypass / file upload used to take over Remote Support servers.
Affected: BeyondTrust Remote Support 26.2.3 and earlier
How to Test: Check the Remote Support appliance version in the administrative interface: any build 26.2.3 or earlier is affected. Because exploitation reportedly dates to late August 2026, review the appliance for unexpected files, modified components, and unexplained file operations or sessions since then, and compare against the indicators in the Google Threat Intelligence Armory Castle write-up and BeyondTrust KB0024066; treat any match as a compromise of the appliance and the credentials and sessions it brokers.
How to Patch: Apply the fix released with BeyondTrust advisory BT26-05, upgrading self-hosted Remote Support appliances to a release newer than 26.2.3; prioritize any appliance reachable from the internet.
Evidence: VulnCheck KEV · BleepingComputer: BeyondTrust patches zero-day exploited in attacks since August · The Hacker News: China-linked hackers exploited BeyondTrust zero-day to take over Remote Support servers
3. Unauthenticated command injection via the Replication Receiver UpdateReceivers.do endpoint in AhsayCBS backup servers (CVE-2026-105134)
CISA KEV (due 2026-10-17) · REMOTE CODE EXECUTION · CRITICAL · CVSS 10.0
CISA added the flaw to KEV on 2026-10-14 with a 2026-10-17 due date, a public exploit and detailed technical write-ups from Huntress and Horizon3 are available, and Ahsay has issued follow-up fixes after its initial patches were reported incomplete — a server still on 10.3.0–10.3.2 or an incomplete patch is open to web shell deployment.
The random parameter of the Replication Receiver endpoint /rps/api/json/UpdateReceivers.do in AhsayCBS is passed into operating system commands, and when chained with the authentication bypass CVE-2026-105133 it gives a remote attacker code execution on the backup server. Huntress reports attackers using the chain to plant web shells and the XMRig cryptominer on exposed servers.
Affected: AhsayCBS 10.3.0; AhsayCBS 10.3.1; AhsayCBS 10.3.2
How to Test: Check the AhsayCBS version in the CBS console; 10.3.0, 10.3.1 and 10.3.2 are affected, and confirm you are on 10.3.4 or later plus Ahsay's follow-up patch for CVE-2026-105133/105134. Review web server logs for requests to /rps/api/json/UpdateReceivers.do, particularly ones with unusual values in the random parameter or arriving without a valid session, and for preceding API calls consistent with the CVE-2026-105133 authentication bypass. Look for unexpected web shell files under the CBS web root, unknown CPU-heavy processes (XMRig), and unrecognised or modified administrator accounts; treat any of these as compromise and rotate credentials for the server and connected backup destinations.
How to Patch: Upgrade AhsayCBS to 10.3.4 or later and apply Ahsay's latest patch update for CVE-2026-105133/105134, since the initial fixes were reported incomplete. Until the upgrade is done, restrict network access to the CBS console and Replication Receiver (/rps/) to trusted hosts only.
Evidence: CISA KEV · VulnCheck KEV · CISA SSVC: active · Huntress: threat actors exploit AhsayCBS flaws to drop web shells and XMRig · CISA adds CVE-2026-105134 to KEV · The Hacker News: AhsayCBS flaws exploited, new fixes after incomplete patches
4. Authenticated code injection in PAN-OS management interface gives root on the firewall (CVE-2026-0322)
CISA KEV (due 2026-10-17) · REMOTE CODE EXECUTION · HIGH · CVSS 8.6
Palo Alto Networks confirmed attacks and CISA added the flaw to KEV on 2026-10-14 with a 2026-10-17 remediation deadline, and a team that leaves a reachable management interface on an unfixed build risks an attacker with any valid admin session gaining persistent root on the firewall.
A code injection flaw in the PAN-OS management interface lets an authenticated attacker with network access to that interface execute arbitrary code as root on PA-Series and VM-Series firewalls and on Panorama. Palo Alto Networks rates the urgency HIGHEST and reports limited exploitation against customer firewalls; Cloud NGFW and Prisma Access are not affected.
Affected: PAN-OS 12.2 < 12.2.4; PAN-OS 12.1 < 12.1.4-h12, < 12.1.7-h8, < 12.1.10-h2; PAN-OS 11.2 < 11.2.4-h22, < 11.2.7-h21, < 11.2.10-h15, < 11.2.13-h3, < 11.2.16; PAN-OS 11.1 < 11.1.4-h37, < 11.1.6-h39, < 11.1.7-h11, < 11.1.10-h35, < 11.1.13-h15, < 11.1.16-h3; PAN-OS 10.2 < 10.2.7-h38, < 10.2.10-h41, < 10.2.13-h26, < 10.2.16-h11, < 10.2.18-h12; PA-Series and VM-Series firewalls and Panorama (virtual and M-Series); Cloud NGFW and Prisma Access not impacted
How to Test: Compare the running PAN-OS version on every firewall and Panorama against the fixed hotfix builds for your release train (e.g. 12.2.4, 12.1.4-h12, 11.2.16, 11.1.16-h3, 10.2.18-h12 and the other listed hotfixes). Determine whether the management interface is reachable from the internet or from untrusted networks. Palo Alto Networks has published indicators of compromise alongside the advisory; check management-interface and administrative login logs against them and treat any administrative session from an unexpected source address or any unexplained configuration or system changes as grounds for incident response.
How to Patch: Upgrade to PAN-OS 12.2.4, 12.1.4-h12 / 12.1.7-h8 / 12.1.10-h2, 11.2.4-h22 / 11.2.7-h21 / 11.2.10-h15 / 11.2.13-h3 / 11.2.16, 11.1.4-h37 / 11.1.6-h39 / 11.1.7-h11 / 11.1.10-h35 / 11.1.13-h15 / 11.1.16-h3, or 10.2.7-h38 / 10.2.10-h41 / 10.2.13-h26 / 10.2.16-h11 / 10.2.18-h12 or later as applicable. Until upgraded, restrict management-interface access to trusted internal IP addresses per Palo Alto Networks' best-practice deployment guidelines.
Evidence: CISA KEV · VulnCheck KEV · CISA SSVC: active · CISA alert adding CVE-2026-0322 to KEV · SecurityWeek: limited exploitation against customer firewalls, IoCs available · BleepingComputer: PAN-OS RCE zero-day exploited
5. Full-chain renderer-to-host code execution via V8, WebP and Crashpad bugs, fixed in 152.0.7977.82 (Google Chrome)
UNVERIFIED PUBLIC REPORT · NO CVE · REMOTE CODE EXECUTION · CRITICAL
A detailed technical write-up of the chain is now public, which lowers the bar for others to rebuild it, and Chrome's background update does not protect a machine until the browser is relaunched — many enterprise endpoints are still running the vulnerable build.
Researchers at Xbow chained three Chrome zero-days — a V8 Maglev deoptimization bug giving read/write in the pointer-compression cage, an animated-WebP decoder flaw that escapes the V8 sandbox by abusing a property Blink wrongly trusted, and an overflow in the Crashpad crash handler — into an exploit that runs code on the Windows host from a web page, with no credentials or plugin required. Google has fixed all three and paid its top $250,000 full-chain bounty. The Register's report names no CVE identifiers and reports no exploitation in use; the fix only takes effect after Chrome is relaunched.
Affected: Chrome releases before 152.0.7977.82; the report does not state the earliest affected version. The final Crashpad stage targets Windows; the V8 and WebP stages are not described as platform-specific.
How to Test: Open chrome://version (or chrome://settings/help) and confirm the build is 152.0.7977.82 or later; a pending update shown in the menu means the running process is still the old version. For fleets, query installed Chrome versions via Chrome Browser Cloud Management, your MDM or endpoint inventory. The report gives no indicators of compromise; unexplained Crashpad handler crashes or renderer crashes on WebP-heavy pages would warrant a look but are not stated as indicators.
How to Patch: Push Chrome 152.0.7977.82 or later and force a relaunch (e.g., set RelaunchNotification=Required with a short RelaunchNotificationPeriod); pin a minimum version with Chrome enterprise policy and verify via inventory. Where Chromium-based browsers (Edge, Brave, etc.) are in use, confirm they have picked up the corresponding V8/WebP/Crashpad fixes — the report does not address them.
Evidence: The Register: Xbow full-chain Chrome exploit, Google patched, $250K bounty
Read on the web · Every past edition
The Exploit Bulletin is free and daily. It publishes only what security teams must act on today — nothing else. Forward it freely.
Spot an error, or an exploit we missed? Reply here or email [email protected].
