The Exploit Bulletin — Wednesday, October 21, 2026: 3 issues require action
Wednesday, October 21, 2026 — 3 issues require action. If you run none of the software below, you are done.
Affects: Gitea Docker · Plex Media Server · Palo Alto Networks PAN-OS / Prisma Access
1. Gitea Docker image ships REVERSE_PROXY_TRUSTED_PROXIES=* allowing header-based user impersonation (CVE-2026-20896)
AUTHENTICATION BYPASS · CRITICAL · CVSS 9.8
Government CERTs (Singapore CSA and the Canadian Centre for Cyber Security) report this trivially exploitable impersonation flaw is being exploited against internet-reachable Gitea Docker instances, so operators running reverse-proxy auth who do not patch today face unauthenticated admin takeover.
The official Gitea Docker images hard-code REVERSE_PROXY_TRUSTED_PROXIES = * in their app.ini templates instead of the documented loopback-only default. When an admin enables reverse-proxy authentication, any source IP that can reach the container can set X-WEBAUTH-USER to log in as any existing user, including administrators, with no password or cookie.
Affected: Gitea Docker images <= 1.26.2 (docker/root and docker/rootless app.ini templates); fixed in 1.26.3 / 1.26.4
How to Test: Check the running Gitea version (admin panel or gitea --version) and whether the image is <= 1.26.2; inspect the container app.ini (docker/root/etc/templates/app.ini:55 or rootless:52) for REVERSE_PROXY_TRUSTED_PROXIES = * and whether ENABLE_REVERSE_PROXY_AUTHENTICATION is true; test with curl -s -L -H "X-WEBAUTH-USER: <existing_user>" http://host:3000/ and see if you are logged in as that user.
How to Patch: Upgrade to Gitea 1.26.3/1.26.4 (or 1.27.1), which removes REVERSE_PROXY_LIMIT/REVERSE_PROXY_TRUSTED_PROXIES from the Docker templates; as a stop-gap, set REVERSE_PROXY_TRUSTED_PROXIES to your proxy's address (e.g. 127.0.0.0/8,::1/128) or disable ENABLE_REVERSE_PROXY_AUTHENTICATION.
Evidence: VulnCheck KEV · Singapore CSA: attackers exploiting Gitea Docker vulnerability · Canadian Centre for Cyber Security: CVE-2026-20896 exploited in the wild · VulnCheck XDB exploit
2. Unauthenticated RCE chain (Plex2Shell) via SSRF and arbitrary file write in Plex Media Server (CVE-2026-96656)
CISA KEV (due 2026-10-23) · REMOTE CODE EXECUTION · CRITICAL · CVSS 8.6
CISA added the four Plex2Shell CVEs to KEV on 2026-10-20 with a 2026-10-23 remediation deadline after exploitation began a day after a public proof of concept, so an internet-reachable Plex server left below 1.43.3.10861 should be assumed to be a target for miner and proxy implants.
CVE-2026-96656 lets an admin-level request write arbitrary files that Plex executes on load; chained with the SSRF flaw CVE-2026-96652 and the URI-scheme handling flaws CVE-2026-96654 and CVE-2026-96655 (together called Plex2Shell), it allows arbitrary code execution on an exposed Plex Media Server without valid credentials. Attackers have been observed using the chain to install cryptocurrency miners and proxy software.
Affected: Plex Media Server < 1.43.3.10861 (all platforms, including NAS app-store builds)
How to Test: Check the installed Plex Media Server build in the server settings/about screen; any build below 1.43.3.10861 is affected. Determine whether the server is reachable from the internet (remote access enabled or a forwarded port). On affected servers, look for unexpected cryptocurrency-miner or proxy processes running under the Plex service account, unexpected newly written files in the Plex application/data directories, and unusual API requests from external addresses in the server's access logs.
How to Patch: Upgrade Plex Media Server to 1.43.3.10861 or later. App-store builds (e.g. QNAP) may lag behind the direct download; until the fixed build is installed, remove the server from internet exposure by disabling remote access and closing the forwarded port.
Evidence: CISA KEV · VulnCheck KEV · CISA adds Plex2Shell CVEs to KEV (2026-10-20) · CISA SSVC: active · SecurityWeek: Plex2Shell chain weaponized hours after disclosure, miners and proxy software deployed · The Hacker News: CISA orders patching of exploited Plex2Shell flaws
3. GlobalProtect portal and gateway authentication bypass grants unauthorized VPN sessions in PAN-OS and Prisma Access (CVE-2026-0257)
CISA KEV (due 2026-06-01) · AUTHENTICATION BYPASS · HIGH · CVSS 7.8
Palo Alto Networks disclosed on 2026-10-20 that it is still observing Qilin and INC ransomware operators exploiting this bypass against unpatched devices five months after fixes shipped, so any GlobalProtect portal or gateway still on a vulnerable build with authentication override cookies enabled is a standing ransomware entry point.
Authentication bypass flaws in the GlobalProtect portal and gateway of PAN-OS and Prisma Access let an unauthenticated remote attacker establish a VPN connection without valid credentials, sidestepping MFA and landing inside the protected network. Arctic Wolf has traced intrusions through this flaw to Qilin ransomware deployment. Panorama and Cloud NGFW are not affected.
Affected: PAN-OS 12.1 earlier than 12.1.4-h6 / 12.1.7; PAN-OS 11.2 earlier than 11.2.4-h17 / 11.2.7-h14 / 11.2.10-h7 / 11.2.12; PAN-OS 11.1 earlier than 11.1.4-h33 / 11.1.6-h32 / 11.1.7-h6 / 11.1.10-h25 / 11.1.13-h5 / 11.1.15; PAN-OS 10.2 earlier than 10.2.7-h34 / 10.2.10-h36 / 10.2.13-h21 / 10.2.16-h7 / 10.2.18-h6; Prisma Access 11.2.0 earlier than 11.2.7-h13; Prisma Access 10.2.0 earlier than 10.2.10-h36; Not affected: Panorama, Cloud NGFW
How to Test: On every firewall that hosts a GlobalProtect portal or gateway, compare the running PAN-OS version against the fixed builds listed above and check whether authentication override cookies are enabled, the configuration Palo Alto Networks lists, together with a specific certificate configuration, as required for exposure; for Prisma Access, confirm with Palo Alto Networks that your tenant has been moved to 11.2.7-h13 or 10.2.10-h36 or later under their upgrade schedule. Review GlobalProtect portal and gateway logs for VPN sessions from unexpected users or source addresses and for sessions that completed without the expected MFA step; any such session on a device that was unpatched is a potential intrusion precursor, so hunt internal hosts reachable from the VPN address pool for follow-on Qilin or INC ransomware activity.
How to Patch: Upgrade PAN-OS to a fixed build: 12.1.4-h6 or 12.1.7 and later; 11.2.4-h17, 11.2.7-h14, 11.2.10-h7, or 11.2.12 and later; 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, or 11.1.15 and later; 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, or 10.2.18-h6 and later. Prisma Access is fixed in 11.2.7-h13 and 10.2.10-h36 and is being upgraded by Palo Alto Networks per the schedule shared with customers; confirm your tenant has received it.
Evidence: CISA KEV · VulnCheck KEV · The Hacker News (2026-10-20): Palo Alto Networks continuing to observe Qilin and INC ransomware exploitation · Unit 42: active exploitation of CVE-2026-0257 · Arctic Wolf: exploitation of CVE-2026-0257 leads to Qilin ransomware · Rapid7 observed exploitation of GlobalProtect authentication bypass
Read on the web · Every past edition
The Exploit Bulletin is free and daily. It publishes only what security teams must act on today — nothing else. Forward it freely.
Spot an error, or an exploit we missed? Reply here or email [email protected].
