Weekly Threat Roundup: Week 41 · 5 to 9 October 2026

The week at a glance

Between 5 and 9 October 2026, 2,284 vulnerabilities were published. By CVSS severity, 174 were critical, 589 high, 692 medium and 66 low, with 763 not yet scored. Five flaws entered the CISA Known Exploited Vulnerabilities catalogue on 8 October 2026. On the ransomware side, leak-site claims showed 161 victims across 42 active groups for the week ending 9 October 2026, a 17% drop compared to 195 victims the week before. The top claiming groups were Qilin with 21 victims, Safepay with 10, UmBra with 9, Storm-2697 with 9, and Luna Moth with 7. The top targeted sectors were Manufacturing & Industrial with 29 victims, Technology & Telecommunications with 21, and Education & Research with 14. By country, the claims listed 49 victims in the United States, 8 in Germany, 7 in Brazil and 2 in the UK.

Exploited in the wild (CISA KEV)

CISA added five vulnerabilities to the KEV catalogue on 8 October 2026:

• CVE-2015-5477: ISC BIND Data Processing Errors Vulnerability
• CVE-2016-3081: Apache Struts Command Injection Vulnerability
• CVE-2023-22894: Strapi Cleartext Storage of Sensitive Information Vulnerability
• CVE-2021-3199: ONLYOFFICE Docs Server Path Traversal Vulnerability
• CVE-2015-3306: ProFTPD Improper Access Control Vulnerability

CISA KEV acts as the baseline floor, so everything listed on it requires remediation by its designated deadline.

New vulnerabilities worth a look

Several recently published vulnerabilities carry high CVSS scores or initial EPSS scores of interest:

• CVE-2026-105110: OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter. It carries a CVSS of 9.8 and an EPSS probability of 2.8%.
• CVE-2026-105484: Located in TOTOLINK X6000R 9.4.0cu.652_B20230116 within the firmware_check function of /cgi-bin/cstecgi.cgi. Manipulation of the file_name argument leads to remote OS command injection. It holds a CVSS of 10.0 and an EPSS probability of 2.1%.
• CVE-2026-91140: An OS command injection in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0. A crafted Swagger/OpenAPI document triggers command execution during temporary-file cleanup on a developer machine. It has a CVSS of 9.6 and an EPSS of 1.9%.
• CVE-2026-94579: Command injection in the PAM session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. It carries an EPSS probability of 2.6%.
• CVE-2026-87666: Another Brocade Fabric OS issue in versions before 9.2.2d and 10.0.0 through 10.0.0a1, specifically in the time and zone management subsystem via REST API or configuration download routines, holding an EPSS probability of 1.8%.
• CVE-2026-21589: Arbitrary File Access in Atlassian Data Centre products, allowing an unauthenticated attacker to access specific files within the web application root directory in affected versions. Its EPSS probability is 1.8%.

Exploit probability movers

EPSS estimates the probability of exploitation attempts occurring in the next 30 days. The largest movement this week was CVE-2026-50751, which jumped 79.0 points from 6.3% to 85.3%.

Other notable EPSS increases included:

• CVE-2026-73570: rose from 11.7% to 71.7%
• CVE-2026-55040: rose from 17.5% to 69.5%
• CVE-2026-66066: rose from 2.1% to 27.9%
• CVE-2020-15999: rose from 44.3% to 63.9%

Tracking these shifts helps flag where exploitation risk is concentrating before catalogue listings change.

What the honeypots saw

Honeypot data from Shadowserver tracks active exploitation attempts against targeted services. No new CVEs were observed entering the honeypot dataset this week.

Over the past 7 days, the top targeted flaws by attempt volumes were:

• CVE-2025-55182 (Meta React Server Components): 64,642 attempts, first seen 8 December 2025
• CVE-2026-3055 (Citrix NetScaler ADC and NetScaler Gateway): 55,653 attempts, first seen 31 March 2026
• CVE-2018-13379 (Fortinet FortiOS): 46,490 attempts, first seen 23 June 2022
• CVE-2022-40684 (Fortinet FortiOS, FortiProxy, and FortiSwitchManager): 44,840 attempts, first seen 14 October 2022
• CVE-2025-5777 (Citrix NetScaler): 26,703 attempts, first seen 2 July 2025
• CVE-2023-35078 (Ivanti Endpoint Manager Mobile (EPMM), formerly MobileIron Core): 24,868 attempts, first seen 29 July 2023
• CVE-2026-1603 (Ivanti EPM): 23,345 attempts, first seen 17 February 2026
• CVE-2023-46805 (Ivanti Secure Connect and Policy Secure): 23,272 attempts, first seen 18 January 2024
• CVE-2023-36844 (Juniper Junos OS (J-Web)): 20,044 attempts, first seen 29 August 2023
• CVE-2023-20198 (Cisco IOS XE): 18,991 attempts, first seen 19 October 2023
• CVE-2017-17215 (Huawei Home Gateway HG532): 12,054 attempts, first seen 23 June 2022

Shadowserver's honeypots also recorded unique attacking IPs summed per country per day between 5 Oct and 8 Oct:

• CVE-2014-8361 (Realtek): 1,684 unique IPs
• CVE-2017-17215 (Huawei): 1,550 unique IPs
• CVE-2018-10562 (Dasan): 1,256 unique IPs
• CVE-2024-12847 (Netgear): 1,168 unique IPs
• CVE-2016-10372 (Zyxel): 1,119 unique IPs
• CVE-2023-20198 (Cisco): 1,008 unique IPs
• CVE-2022-41082 (Microsoft): 1,000 unique IPs

The single peak day across this window was CVE-2022-41082 on 5 October 2026, which recorded 513 unique attacking IPs.

Software supply chain

There were 113 malicious packages recorded across the supply chain data this week.

On 8 October 2026, a critical compromise was flagged on npm: tensorlake@0.5.144 was published one patch version above the authentic TensorLake AI release 0.5.143. The legitimate package is an official document-ingestion and sandbox CLI/SDK with 100 releases across four maintainers. The unauthorised 0.5.144 version was quarantined and removed by npm security.

Several advisory sweeps caught multiple package clusters:

• 8 October 2026: 20 fresh malware advisories covered 19 npm packages and 1 PyPI package. Aside from the tensorlake incident, this sweep caught the internallib_v788 reverse-shell package, dependency-confusion probes against npm (troubleshooting, browser-metrics-plugin.contrib, and personio-pipeline-projen), sleeper clusters imgbundle and cdn-img-fetch, backfilled low-version sleepers (function-flag@1.7.3 and its sibling package), typosquats @ikyyjee/ikkysingle, ikyysingle, and ikyysinggle, plus namespace holders windows_registry_editor and store-webpack-config.
• 7 October 2026: 10 advisories across npm and PyPI, including hardhat-init (a pino-impersonator), Wix dependency-confusion recon package css-jptvix-polyfill, tarball-URL installer @pinecone-experience/messages@99.9.1, four internallib packages (internallib_v23, v30, v86, and v875), and PyPI probe lore-cs.
• 6 October 2026: Advisories included PyPI package zencleaner, npm packages virgil-cli and dotenv-async, alongside backfilled probes @inpeek/odata* and erc7730-hackathon@99.0.0.
• 5 October 2026: OpenSSF and Amazon Inspector flagged a cluster of 25 RubyGems packages posing as crypto utilities (all version 1.0.0), where extconf.rb base64/XOR-decodes a payload, double-forks, sleeps 20 to 40 minutes, and pulls wgkit.tar.gz from 45.138.. to run /tmp/.w1/wg_install.sh. On the same day, 52 npm advisories were logged, covering 10 hellscripter typosquats, 26 Wix dependency-confusion probes, 4 pino-impersonators, and 5 ChaCha20 PowerShell loaders.

What we'd do first

Start by addressing the five vulnerabilities added to CISA KEV on 8 October 2026: CVE-2015-5477, CVE-2016-3081, CVE-2023-22894, CVE-2021-3199, and CVE-2015-3306. These meet the mandatory baseline for confirmed active exploitation.

Next, evaluate edge infrastructure against the vulnerabilities showing elevated exploit probabilities and high attempt volumes in Shadowserver's honeypots. Check internet-facing instances of Citrix NetScaler (CVE-2026-3055, CVE-2025-5777), Fortinet FortiOS (CVE-2018-13379, CVE-2022-40684), and Ivanti (CVE-2023-35078, CVE-2026-1603, CVE-2023-46805), alongside CVE-2026-50751 given its EPSS rise to 85.3%. Finally, check build environments for any accidental installation of tensorlake@0.5.144.

Sign up for the newsletter to get the roundup in your inbox every Friday.