Weekly Threat Roundup: Week 42, 2026

The week at a glance

Across 12 to 16 October 2026, 4,408 vulnerabilities were published. Among those, 316 were scored critical, 2,168 high, 1,530 medium, 173 low, and 221 unscored. CISA added 7 entries to the Known Exploited Vulnerabilities catalogue.

On the ransomware side, leak-site claims totalled 260 victims for the week ending 16 October 2026, up 60% compared to 163 the previous week across 43 active groups. The top groups by claimed victims were N0n with 64, Storm-2697 with 35, Qilin with 30, Wallstreet with 14, and Akira with 12. By sector, Transportation & Logistics recorded 40 victims, Manufacturing & Industrial recorded 28, and Healthcare & Pharmaceuticals recorded 27. The top countries were the US with 74, KR with 13, and BR with 12, alongside 9 UK victims.

Exploited in the wild (CISA KEV)

CISA KEV added 7 vulnerabilities during the week. Because KEV is the baseline, anything listed here requires remediation by its designated deadline:

• CVE-2026-96951: Microsoft Windows Command Injection Vulnerability, added 13 October 2026.
• CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability, added 13 October 2026.
• CVE-2026-0322: Palo Alto Networks PAN-OS Code Injection Vulnerability, added 14 October 2026.
• CVE-2026-76519: Cisco Secure Email Gateway Relative Path Traversal Vulnerability, added 14 October 2026.
• CVE-2026-105133: Ahsay AhsayCBS Improper Authentication Vulnerability, added 14 October 2026.
• CVE-2026-105134: Ahsay AhsayCBS Command Injection Vulnerability, added 14 October 2026.
• CVE-2026-21589: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability, added 15 October 2026.

New vulnerabilities worth a look

CVSS alone decides nothing, but several freshly published vulnerabilities carry notable CVSS ratings and EPSS values that warrant review:

• CVE-2026-59774 (CVSS 9.8, EPSS 28.3%): Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a public repository to read files accessible to the service account, including app.ini and INTERNAL_TOKEN.
• CVE-2026-110908 (CVSS 8.8, EPSS 6.1%): Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter, accessible to an authenticated WebGUI user with page-status-frr privilege.
• CVE-2026-101967 (CVSS 9.3, EPSS 3.9%): OS command injection in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved, allowing unauthenticated root execution over the management LAN via a crafted DHCP response.
• CVE-2026-101978 (CVSS 8.7, EPSS 3.9%): OS command injection in bootzd on Juniper Networks Junos OS Evolved PTX Series, allowing unauthenticated root execution via a crafted gRPC response.
• CVE-2026-102059 (CVSS 8.7, EPSS 3.9%): OS command injection in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved on EX, SRX, and QFX Series, allowing an adjacent unauthenticated attacker to execute commands as root via a rogue DHCP server.
• CVE-2026-110645 (CVSS 9.3, EPSS 3.2%): Video-stitch before 2.0.0-beta.1 interpolates unquoted file names into shell-executed ffmpeg command lines passed to concat(), cut(), or merge().

Exploit probability movers

EPSS reflects the probability of exploitation attempts occurring in the next 30 days. Several CVEs saw large increases this week:

• CVE-2026-35273 jumped from 9.4% to 96.7% (an increase of 87.3 percentage points).
• CVE-2026-72898 shifted from 19% to 97.3%.
• CVE-2026-93616 moved from 19.7% to 75.9%.
• CVE-2026-85102 rose from 7.5% to 50.4%.
• CVE-2001-1342 climbed from 12% to 30.7%.

What the honeypots saw

Honeypot data from Shadowserver tracks exploitation attempts, showing where automated activity focuses on internet-facing services. Across the past seven days, the highest volumes of attempts targeted:

• CVE-2025-55182 (Meta React Server Components): 64,642 attempts (first seen 8 December 2025).
• CVE-2026-3055 (Citrix NetScaler ADC and NetScaler Gateway): 55,653 attempts (first seen 31 March 2026).
• CVE-2018-13379 (Fortinet FortiOS): 46,490 attempts (first seen 23 June 2022).
• CVE-2022-40684 (Fortinet FortiOS, FortiProxy, and FortiSwitchManager): 44,840 attempts (first seen 14 October 2022).
• CVE-2025-5777 (Citrix NetScaler): 26,703 attempts (first seen 2 July 2025).
• CVE-2023-35078 (Ivanti EPMM): 24,868 attempts (first seen 29 July 2023).
• CVE-2026-1603 (Ivanti EPM): 23,345 attempts (first seen 17 February 2026).
• CVE-2023-46805 (Ivanti Secure Connect and Policy Secure): 23,272 attempts (first seen 18 January 2024).
• CVE-2023-36844 (Juniper Junos OS J-Web): 20,044 attempts (first seen 29 August 2023).
• CVE-2023-20198 (Cisco IOS XE): 18,991 attempts (first seen 19 October 2023).
• CVE-2017-17215 (Huawei Home Gateway HG532): 12,054 attempts (first seen 23 June 2022).

Shadowserver's honeypots also recorded unique attacking IPs (summed per country per day) between 12 Oct and 15 Oct. Top counts include CVE-2014-8361 (Realtek) with 1,463, CVE-2017-17215 (Huawei) with 1,375, CVE-2024-12847 (Netgear) with 1,307, CVE-2018-10562 (Dasan) with 1,264, CVE-2016-10372 (Zyxel) with 1,166, CVE-2023-20198 (Cisco) with 990, and CVE-2022-41082 (Microsoft) with 978. CVE-2022-41082 saw a single-day peak of 510 unique attacking IPs on 13 October 2026.

Software supply chain

Advisories published across ecosystems accounted for 192 flagged packages this week. On 13 October 2026, a GitHub Advisory sweep catalogued 87 packages across npm, PyPI, and RubyGems. This included 60+ packages in wave 3 of the Baileys and libsignal WhatsApp-automation lures, alongside PyPI npp-ml deploying ADExplorer, PyPI minecraftaccfinder deploying an infostealer and RAT, and RubyGems wallet-balance-scanner establishing a reverse shell.

On 12 October 2026, 27 packages were flagged across npm and PyPI, covering wave 3 of the s4yhii operator targeting collector.oob.s4yhii.com/_npm-poc/beacon, wave 2 of the 185.158.107.175:8787/_ah/dc recon packages, and 4 packages with HTTP/1.0 raw-socket beacons to 64.181.165.115/dc. That same day, 24 RubyGems packages under the wgkit cluster were flagged at version 0.9.1, piping an extconf.rb payload to a /bin/sh reverse shell at 45.138.12.177:8089, and npm hridoy-ultimate@8.0.0 was identified sending login credentials to minhdong.site/api/v1/facebook/login_ios.

Earlier batches on 11 October 2026 flagged 6 packages, including the PyPI webreader and pafer pickle-execution RAT using Supabase storage and api.npoint.io, and the agentaix 3-package cluster beaconing googleforum.pythonanywhere.com. The 10 October 2026 sweep covered 47 packages across npm, crates, and PyPI, detailing native prebuild binaries exfiltrating tokens to oob.s4yhii.com/native and crates.io sharpnes.

What we'd do first

Address the 7 additions to CISA KEV first: check internet-facing exposure for Microsoft Windows (CVE-2026-96951), Ivanti Connect Secure (CVE-2026-104935), Palo Alto Networks PAN-OS (CVE-2026-0322), Cisco Secure Email Gateway (CVE-2026-76519), AhsayCBS (CVE-2026-105133, CVE-2026-105134), and Atlassian products (CVE-2026-21589). Next, prioritise edge devices and appliances with large EPSS jumps, particularly CVE-2026-35273 (96.7%) and CVE-2026-72898 (97.3%). For perimeter defences, ensure older firmware running on Citrix, Fortinet, and Ivanti is patched, as Shadowserver's honeypots log high attempt volumes against kit first identified years ago.

Subscribe to our weekly newsletter to get this intelligence directly in your inbox.