The Exploit Bulletin — Wednesday, October 14, 2026: 6 issues require action
Wednesday, October 14, 2026 — 6 issues require action. If you run none of the software below, you are done.
Affects: Ivanti Connect Secure · Windows / Microsoft Outlook.com · Avada Builder · Contact Form by Supsystic for WordPress · Forminator Forms · LG webOS smart TVs / webOS
1. Unauthenticated authentication bypass to root command execution in Ivanti Connect Secure (CVE-2026-104935)
CISA KEV (due 2026-10-16) · REMOTE CODE EXECUTION · CRITICAL · CVSS 8.6
Ivanti published the advisory and CISA added the CVE to KEV on 2026-10-13 with a 2026-10-16 remediation deadline after Volexity reported in-the-wild chained exploitation (first signs seen from October 1), so a team that leaves an internet-facing Connect Secure gateway on an affected build is exposing it to unauthenticated command execution and credential theft.
An authentication-bypass-by-spoofing flaw in Ivanti Connect Secure lets a remote, unauthenticated attacker execute arbitrary commands on the appliance. Volexity observed it chained with a further, still-unpatched flaw to run commands as root on fully patched VPN gateways, and CISA reports the activity being used for credential theft and data exfiltration.
Affected: Ivanti Connect Secure 25.1.0.0 through 25.1.1.1; Ivanti Connect Secure 25.1.2.0 through 25.1.2.2; Ivanti Connect Secure 22.8 (22.8R2.4 and prior)
How to Test: On each Connect Secure appliance, check the running version in the admin console and compare against the affected ranges above (25.1.1.1 and prior, 25.1.2.0–25.1.2.2, 22.8R2.4 and prior). Because exploitation is unauthenticated and was observed from at least October 1, review web and authentication logs from that date for unexpected unauthenticated requests to the appliance and for command execution or new administrative activity; Volexity's write-up contains request-level indicators you can match against logs, and a Nuclei template exists to confirm whether a host is still vulnerable. Follow CISA's Forensics Triage Requirements for any appliance that was exposed while unpatched, and treat credentials that transited the appliance as potentially stolen.
How to Patch: Upgrade to a release outside the affected ranges: 25.1.1.2 or later in the 25.1.1 line, or 25.1.3.0 or later; no fixed 22.8 build is listed, so move 22.8 appliances to a fixed 25.1 release. Note that reports state the third flaw in the observed chain has no fix yet, so apply any additional mitigations in Ivanti's advisory and keep the appliance under close monitoring after upgrading.
Evidence: CISA KEV · VulnCheck KEV · CISA SSVC: active · Volexity: active in-the-wild chained exploitation of ICS zero-days · CISA alert: threat actors exploiting for credential theft and data exfiltration · Rapid7: ICS zero-day exploited in the wild
2. Mark-of-the-Web bypass via command injection in Windows Shell lets crafted files run without warnings (CVE-2026-96951)
CISA KEV (due 2026-10-16) · REMOTE CODE EXECUTION · HIGH · CVSS 8.8
Microsoft confirmed in-the-wild exploitation and CISA added the CVE to KEV on 2026-10-13 with a 2026-10-16 remediation deadline, so endpoints that do not take this month's cumulative update stay open to phishing-delivered files that execute without Mark-of-the-Web warnings.
A command-injection flaw in Windows Shell lets a specially crafted file delivered by email, instant message or a link evade Mark-of-the-Web defenses, so attacker-controlled content runs on the victim's machine without the usual security prompts once the user opens it. It is the one exploited zero-day in Microsoft's October 2026 Patch Tuesday.
Affected: Windows 10 Version 1607 builds below 10.0.14393.9612; Windows 10 Version 1809 builds below 10.0.17763.9376; Windows 10 Version 21H2 / 22H2 builds below 7807 (10.0.19044 / 10.0.19045 lines); Windows 11 Version 23H2 builds below 10.0.22631.7652; Windows 11 Version 24H2 builds below 10.0.26100.9711; Windows 11 Version 25H2 builds below 10.0.26200.9711; Windows 11 Version 26H1 builds below 10.0.28000.3231; Microsoft Outlook.com versions below 20260925.100
How to Test: Run winver or check the OS build via your endpoint management inventory and compare against the fixed builds listed above; any build below the threshold for its release line is vulnerable. For signs of attempted exploitation, review email and messaging gateway logs for attachments or links that delivered unusual file types to users, check endpoint telemetry for files that executed without a Mark-of-the-Web prompt after being downloaded from the internet, and deploy the Snort coverage Cisco Talos published for this Patch Tuesday.
How to Patch: Install the October 2026 Patch Tuesday cumulative update for each Windows release so the OS build reaches at least 10.0.14393.9612 (1607), 10.0.17763.9376 (1809), build 7807 for Windows 10 21H2/22H2, 10.0.22631.7652 (23H2), 10.0.26100.9711 (24H2), 10.0.26200.9711 (25H2) or 10.0.28000.3231 (26H1); Outlook.com is fixed in 20260925.100. Until patched, tighten mail and messaging controls on inbound file attachments and links.
Evidence: CISA KEV · VulnCheck KEV · Vendor confirmed · CISA adds CVE-2026-96951 to KEV based on evidence of active exploitation · Rapid7: exploited-in-the-wild Windows Shell MOTW bypass · ZDI: lone bug listed as under active attack
3. Unauthenticated PHP function injection to RCE in Avada Builder via fusion_get_widget_markup (CVE-2026-6279)
PUBLIC EXPLOIT · NO ATTACKS CONFIRMED · REMOTE CODE EXECUTION · CRITICAL · CVSS 9.8
Five public exploits are catalogued in VulnCheck XDB and VulnCheck added the flaw to its KEV catalog on 2026-10-13; an Avada site still on Fusion Builder 3.15.2 or earlier is exploitable with a single unauthenticated request.
The wp_conditional_tags case in Fusion_Builder_Conditional_Render_Helper::get_value() passes attacker-controlled values from a base64-decoded JSON blob straight to call_user_func() with no allowlist. Because the fusion_get_widget_markup AJAX action is registered for unauthenticated users, anyone can call arbitrary PHP functions and execute code on the server.
Affected: Avada (Fusion) Builder (fusion-builder) <= 3.15.2
How to Test: In WordPress Admin > Plugins (or the Avada dashboard), confirm the Avada Builder / fusion-builder version; 3.15.2 and earlier are affected. Review access logs for unauthenticated requests to wp-admin/admin-ajax.php with action=fusion_get_widget_markup carrying base64-encoded JSON that includes wp_conditional_tags, and check the server for newly created PHP files, modified theme files, or unknown administrator accounts.
How to Patch: Update Avada Builder to the latest release later than 3.15.2 through the Avada theme updater or ThemeFusion account. If you cannot update immediately, block requests to admin-ajax.php with action=fusion_get_widget_markup at the WAF until you can.
Evidence: VulnCheck KEV · VulnCheck XDB public exploit · VulnCheck XDB public exploit · VulnCheck XDB public exploit · VulnCheck XDB public exploit · VulnCheck XDB public exploit
4. Unauthenticated Twig template injection to RCE in Contact Form by Supsystic for WordPress (CVE-2026-4257)
PUBLIC EXPLOIT · NO ATTACKS CONFIRMED · REMOTE CODE EXECUTION · CRITICAL · CVSS 9.8
Three public exploits for this unauthenticated RCE are catalogued in VulnCheck XDB and VulnCheck added the flaw to its KEV catalog on 2026-10-13; a site still running 1.7.36 or earlier is a one-request target.
The plugin renders form field values through Twig's string loader without a sandbox, and the cfsPreFill prefill feature lets anyone inject Twig expressions through GET parameters. An unauthenticated attacker can execute arbitrary PHP functions and OS commands on the web server.
Affected: Contact Form by Supsystic (contact-form-by-supsystic) for WordPress <= 1.7.36
How to Test: In WordPress Admin > Plugins, confirm the Contact Form by Supsystic version; anything at or below 1.7.36 is affected. Review web server access logs for requests to pages with embedded forms carrying cfsPreFill GET parameters containing Twig syntax such as '{{' or '}}' and function names like 'register', and inspect the server for unexpected PHP files or webshells in wp-content and the uploads directory; treat any such hit as a compromise.
How to Patch: Update the plugin to the latest release later than 1.7.36 from WordPress.org (the fix is in changeset 3491826 of contact-form-by-supsystic). If you cannot update immediately, deactivate the plugin or block requests containing cfsPreFill parameters at the WAF until you can.
Evidence: VulnCheck KEV · VulnCheck XDB public exploit · VulnCheck XDB public exploit · VulnCheck XDB public exploit
5. Unauthenticated arbitrary file upload in Forminator Forms for WordPress via handle_file_upload (CVE-2026-15748)
PUBLIC EXPLOIT · NO ATTACKS CONFIRMED · REMOTE CODE EXECUTION · CRITICAL · CVSS 9.8
Two public exploits are catalogued in VulnCheck XDB and VulnCheck added the flaw to its KEV catalog on 2026-10-13, so any site still on Forminator 1.56.1 or earlier with a public form can be turned into a webshell host.
Forminator's handle_file_upload blocklist uses exact-key matching that is bypassed with pipe-alternative MIME keys, and the public submission handler trusts attacker-supplied upload field configuration injected through a forged Select field value. An unauthenticated attacker can upload executable files to the server and achieve remote code execution.
Affected: Forminator Forms – Contact Form, Payment Form & Custom Form Builder (forminator) for WordPress <= 1.56.1
How to Test: In WordPress Admin > Plugins, confirm the Forminator version; 1.56.1 and earlier are affected. Review access logs for unauthenticated POST submissions to the Forminator front-end submission handler that include upload fields, and search wp-content/uploads (including Forminator's upload folders) for recently created .php or other executable files that no legitimate form should have accepted.
How to Patch: Update Forminator to the latest release later than 1.56.1 from WordPress.org. If you cannot update today, disable file upload fields on public forms or deactivate the plugin until it is updated.
Evidence: VulnCheck KEV · VulnCheck XDB public exploit · VulnCheck XDB public exploit
6. Pre-auth root takeover of webOS TVs from the local network via ThinQ pairing service on port 3001 (LG webOS)
UNVERIFIED PUBLIC REPORT · NO CVE · REMOTE CODE EXECUTION · HIGH
Full technical details of a working pre-auth root chain were published on October 12–13, so anyone with a foothold on an office, guest or conference-room network can now reproduce it; LG TVs in meeting rooms and signage are routinely on shared segments, and a rooted TV is a persistent pivot and eavesdropping device.
Three chained webOS flaws let anyone on the same network as an LG smart TV obtain root without a PIN or owner interaction. The attacker replays a built-in app manifest signed with a test certificate the firmware trusts to the ThinQ pairing service on TCP/3001, which skips the PIN prompt and hands over a privileged key; that key launches the built-in cmp-client app pointed at an attacker page, which retains access to the internal PalmServiceBridge and injects shell commands into the root-running pmlogd logging service. The chain was demonstrated at TyphoonPWN 2026 and published by SSD Secure Disclosure; it was tested on two models running webOS 7.5.7-25 / firmware 04.54.40. SSD says LG has issued a fix. No CVE has been assigned, no LG advisory is in the material, and no exploitation has been reported.
Affected: webOS 7.5.7-25 on firmware 04.54.40, tested on models 32LQ636BPSA and 27TQ600SW; other models and firmware versions not stated
How to Test: Inventory LG TVs on your network (webOS devices advertise via SSDP/mDNS and expose TCP/3000-3001 for ThinQ pairing; a port scan for 3001 across office and conference-room VLANs will find them). On each TV check Settings > Support > About This TV for the webOS/firmware version: 7.5.7-25 / 04.54.40 is confirmed affected; treat any firmware predating the October 2026 update as suspect since LG has not published an affected list. Review network logs for unexpected connections to port 3001 from workstations or guest devices, and for TVs making outbound requests to unfamiliar hosts (the chain loads an attacker-controlled page).
How to Patch: Apply the latest LG firmware via Settings > Support > Software Update and turn on automatic updates. Where updates cannot be applied yet, isolate TVs on a dedicated IoT VLAN with inbound access to TCP/3001 restricted to the devices that genuinely need ThinQ pairing, or block it entirely; decommission TVs that no longer receive firmware updates.
Evidence: The Hacker News: LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network · Cybernews coverage
Read on the web · Every past edition
The Exploit Bulletin is free and daily. It publishes only what security teams must act on today — nothing else. Forward it freely.
Spot an error, or an exploit we missed? Reply here or email [email protected].
