Blog · 2-hour update · 2026-10-26

CVE-2026-116232 Oray Pugongying X5 Pro 7.6.1: critical flaw, patch first

On 26 October 2026, 9 new CVEs were published that we track: 4 critical, 0 already exploited in the wild (CISA KEV) and 2 with a fix or vendor patch available. Each one is ranked by severity, exploitation signals and how easy it is to reach, so you can patch the right ones first.

What happened in this 2-hour window: the most serious item is CVE-2026-116232 (critical, CVSS 9.9, priority 35/100). Recommended action: apply the vendor mitigation. Most affected: oray (2), opnsense (1), rt-labs ab (1). 2 of 9 new CVEs already have a fix or vendor patch; for the other 7, follow the downgrade or mitigation steps until one ships.

Patch these first

CVE-2026-116232: A weakness has been identified in Oray Pugongying X5 Pro 7.6.1

Critical severity (CVSS 9.9), priority 35/100 (patch this month). Signals: critical severity. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-116231: A security flaw has been discovered in Oray Pugongying X5 Pro 7.6.1

Critical severity (CVSS 9.9), priority 35/100 (patch this month). Signals: critical severity. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-116234: A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1

Critical severity (CVSS 9.1), priority 32/100 (patch this month). Signals: critical severity. Recommended action: downgrade to a release before 7.6.1 until a fix ships for oray pugongying x5 pro.

References: NVD

CVE-2026-116233: A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1

Critical severity (CVSS 9.1), priority 32/100 (patch this month). Signals: critical severity. Recommended action: downgrade to a release before 7.6.1 until a fix ships for oray pugongying x5 pro.

References: NVD

CVE-2026-70388: SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device on the network can send speci

High severity (CVSS 8.3), priority 29/100 (routine). Signals: high severity. Recommended action: upgrade to 2.0.1 for rt-labs ab soem.

References: NVD · Vendor Advisory

CVE-2026-96581: Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant

High severity (CVSS 7.6), priority 27/100 (routine). Signals: high severity. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-116230: A vulnerability was identified in Ndemic Creations Plague Inc Evolved up to 1.24.0.3

Medium severity (CVSS 6.3), priority 22/100 (routine). Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-115425: Multiple cross site scripting (XSS) vulnerabilities affect OPNsense firewall vesrion 26.7.1_1 and earlier allo

Medium severity (CVSS 5.6), priority 20/100 (routine). Recommended action: upgrade to newer than 26.7.1_1 for opnsense opnsense firewall.

References: NVD · Vendor Advisory

Most affected vendors

• oray: 2 new CVEs
• opnsense: 1 new CVE
• rt-labs ab: 1 new CVE

How to act on this list

1. Start with anything marked exploited or patch now.
2. Check what you run: see how to check a version and patch it on Linux, Windows, pip and npm.
3. Prefer the vendor or distro fix. If none exists, read when to downgrade and when to mitigate.
4. Verify afterwards. Distros often fix a flaw without changing the upstream version, here is how to confirm.

FAQ

What is the most serious vulnerability published on 26 October 2026?

CVE-2026-116232 (A weakness has been identified in Oray Pugongying X5 Pro 7.6.1) ranks highest, with a priority score of 35/100. Recommended action: apply the vendor mitigation.

Are any of the new CVEs exploited in the wild?

None of the new CVEs were on the CISA Known Exploited Vulnerabilities list when this was written. Keep watching the list, it changes daily.

Should I downgrade if there is no fix yet?

Only when an older release is confirmed unaffected and the package is not a core system component. Downgrades can break dependent software, so test first and hold the package until a fix ships.

Sources

• NIST National Vulnerability Database: CVE details and affected versions
• CVE Program: official CVE records
• CISA Known Exploited Vulnerabilities catalog: exploitation in the wild
• FIRST EPSS: exploit probability
• Distribution and vendor advisories linked under each item.

← All posts