Blog · 2-hour update · 2026-10-25

CVE-2026-49869 Kestra: exploited in the wild, how to patch

On 25 October 2026, 11 new CVEs were published that we track: 0 critical, 3 already exploited in the wild (CISA KEV) and 0 with a fix or vendor patch available. Each one is ranked by severity, exploitation signals and how easy it is to reach, so you can patch the right ones first.

What happened in this 2-hour window: the most serious item is CVE-2026-49869 in kestra (critical, CVSS 10.0, priority 93/100). Recommended action: upgrade to 1.0.45, 1.3.21. 3 new CVEs from the list below are already being exploited (CVE-2026-49869, CVE-2026-56291, CVE-2026-59822), so those go first. 4 of the 8 top items can be attacked remotely without a login. Most affected: sourcecodester (2). 0 of 11 new CVEs already have a fix or vendor patch; for the other 11, follow the downgrade or mitigation steps until one ships.

Patch these first

CVE-2026-49869: Kestra OSS OS Command Injection Vulnerability

Critical severity (CVSS 10.0), priority 93/100 (patch now). Signals: critical severity; exploited in the wild (cisa kev); public exploit reference. Recommended action: upgrade to 1.0.45, 1.3.21 for kestra kestra.

References: NVD · Exploit, Vendor Advisory · Exploit, Vendor Advisory

CVE-2026-56291: Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability

Critical severity (CVSS 9.8), priority 93/100 (patch now). Signals: critical severity; epss top 3%: very likely to be exploited; exploited in the wild (cisa kev). Recommended action: upgrade to 2.4.1 for balbooa forms.

References: NVD

CVE-2026-59822: BerriAI LiteLLM Improper Authentication Vulnerability

High severity (CVSS 8.2), priority 73/100 (patch now). Signals: high severity; exploited in the wild (cisa kev); remotely exploitable, no login, no user action. Recommended action: upgrade to 1.84.0 for litellm litellm.

References: NVD · Patch · Issue Tracking, Patch

CVE-2026-116060: A vulnerability was determined in SourceCodester Performance Indicator System 1.0

High severity (CVSS 7.3), priority 31/100 (routine). Signals: high severity; remotely exploitable, no login, no user action. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-116062: A security flaw has been discovered in SourceCodester Performance Indicator System 1.0

High severity (CVSS 7.3), priority 26/100 (routine). Signals: high severity. Recommended action: downgrade to a release before 1.0 until a fix ships for sourcecodester performance indicator system.

References: NVD

CVE-2026-116061: A vulnerability was identified in SourceCodester Performance Indicator System 1.0

High severity (CVSS 7.3), priority 26/100 (routine). Signals: high severity. Recommended action: downgrade to a release before 1.0 until a fix ships for sourcecodester performance indicator system.

References: NVD

CVE-2026-116058: A vulnerability was found in Alfresco Activiti up to 7.21.0-rc.692

Medium severity (CVSS 6.3), priority 22/100 (routine). Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-116057: A vulnerability has been found in KodCloud KodExplorer up to 4.55

Medium severity (CVSS 6.3), priority 22/100 (routine). Recommended action: apply the vendor mitigation.

References: NVD

Most affected vendors

• sourcecodester: 2 new CVEs

How to act on this list

1. Start with anything marked exploited or patch now.
2. Check what you run: see how to check a version and patch it on Linux, Windows, pip and npm.
3. Prefer the vendor or distro fix. If none exists, read when to downgrade and when to mitigate.
4. Verify afterwards. Distros often fix a flaw without changing the upstream version, here is how to confirm.

FAQ

What is the most serious vulnerability published on 25 October 2026?

CVE-2026-49869 (Kestra OSS OS Command Injection Vulnerability) ranks highest, with a priority score of 93/100. Recommended action: upgrade to 1.0.45, 1.3.21.

Are any of the new CVEs exploited in the wild?

Yes, 3 of the new CVEs appear on the CISA Known Exploited Vulnerabilities list. Patch those first.

Should I downgrade if there is no fix yet?

Only when an older release is confirmed unaffected and the package is not a core system component. Downgrades can break dependent software, so test first and hold the package until a fix ships.

Sources

• NIST National Vulnerability Database: CVE details and affected versions
• CVE Program: official CVE records
• CISA Known Exploited Vulnerabilities catalog: exploitation in the wild
• FIRST EPSS: exploit probability
• Distribution and vendor advisories linked under each item.

← All posts