Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

Blog · 2-hour update · 2026-10-26

CVE-2026-20182 Cisco Catalyst sd-wan Manager: exploited in the wild, how to patch

Most urgent: CVE-2026-20182: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
Critical severity (CVSS 10.0), exploited in the wild, remotely exploitable, no login needed. Recommended action: upgrade to 20.9.9.1, 20.12.5.4, 20.12.6.2, 20.15.4.4, 20.15.5.2, 20.18.2.2, 26.1.1.1.

On 26 October 2026, 114 new CVEs were published that we track: 13 critical, 6 already exploited in the wild (CISA KEV) and 11 with a fix or vendor patch available. Each one is ranked by severity, exploitation signals and how easy it is to reach, so you can patch the right ones first.

What happened in this 2-hour window: the most serious item is CVE-2026-20182 in catalyst sd-wan manager (critical, CVSS 10.0, priority 98/100). Recommended action: upgrade to 20.9.9.1, 20.12.5.4, 20.12.6.2, 20.15.4.4, 20.15.5.2, 20.18.2.2, 26.1.1.1. 6 new CVEs from the list below are already being exploited (CVE-2026-20182, CVE-2026-0257, CVE-2026-105134, and more), so those go first. 7 of the 8 top items can be attacked remotely without a login. At least one is linked to ransomware campaigns. Most affected: netty (4), apache software foundation (2), deepseek (2). 11 of 114 new CVEs already have a fix or vendor patch; for the other 103, follow the downgrade or mitigation steps until one ships.

Patch these first

CVE-2026-20182: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

Critical severity (CVSS 10.0), priority 98/100 (patch now). Signals: critical severity; epss top 1%: very likely to be exploited; exploited in the wild (cisa kev). Recommended action: upgrade to 20.9.9.1, 20.12.5.4, 20.12.6.2, 20.15.4.4, 20.15.5.2, 20.18.2.2, 26.1.1.1 for cisco catalyst sd-wan manager.

References: NVD · Vendor Advisory

CVE-2026-0257: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

Critical severity (CVSS 9.1), priority 97/100 (patch now). Signals: critical severity; epss top 1%: very likely to be exploited; exploited in the wild (cisa kev). Recommended action: upgrade to 10.2.7 for paloaltonetworks pan-os.

References: NVD · Vendor Advisory

CVE-2026-105134: Ahsay AhsayCBS Command Injection Vulnerability

Critical severity (CVSS 10.0), priority 93/100 (patch now). Signals: critical severity; epss top 1%: very likely to be exploited; exploited in the wild (cisa kev). Recommended action: upgrade to 10.3.4 for ahsay cloud backup suite.

References: NVD

CVE-2026-8398: Daemon Tools Lite Embedded Malicious Code Vulnerability

Critical severity (CVSS 9.8), priority 91/100 (patch now). Signals: critical severity; exploited in the wild (cisa kev); public exploit reference. Recommended action: downgrade to a release before 12.5.1 until a fix ships for disc-soft daemon tools.

References: NVD · Vendor Advisory

CVE-2026-42897: Microsoft Exchange Server Cross-Site Scripting Vulnerability

High severity (CVSS 8.1), priority 83/100 (patch now). Signals: high severity; epss top 1%: very likely to be exploited; exploited in the wild (cisa kev). Recommended action: downgrade to a release before 2016 until a fix ships for microsoft exchange server.

References: NVD · Mitigation, Vendor Advisory

CVE-2026-105133: Ahsay AhsayCBS Improper Authentication Vulnerability

High severity (CVSS 7.3), priority 80/100 (patch now). Signals: high severity; epss top 1%: very likely to be exploited; exploited in the wild (cisa kev). Recommended action: upgrade to 10.3.4 for ahsay cloud backup suite.

References: NVD

CVE-2026-65184: The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied WebSocket fi

Critical severity (CVSS 9.8), priority 39/100 (patch this month). Signals: critical severity; remotely exploitable, no login, no user action. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-107656: An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 throu

Critical severity (CVSS 9.8), priority 39/100 (patch this month). Signals: critical severity; remotely exploitable, no login, no user action. Recommended action: apply the vendor mitigation.

References: NVD

Most affected vendors

How to act on this list

  1. Start with anything marked exploited or patch now.
  2. Check what you run: see how to check a version and patch it on Linux, Windows, pip and npm.
  3. Prefer the vendor or distro fix. If none exists, read when to downgrade and when to mitigate.
  4. Verify afterwards. Distros often fix a flaw without changing the upstream version, here is how to confirm.

FAQ

What is the most serious vulnerability published on 26 October 2026?

CVE-2026-20182 (Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability) ranks highest, with a priority score of 98/100. Recommended action: upgrade to 20.9.9.1, 20.12.5.4, 20.12.6.2, 20.15.4.4, 20.15.5.2, 20.18.2.2, 26.1.1.1.

Are any of the new CVEs exploited in the wild?

Yes, 6 of the new CVEs appear on the CISA Known Exploited Vulnerabilities list. Patch those first.

Should I downgrade if there is no fix yet?

Only when an older release is confirmed unaffected and the package is not a core system component. Downgrades can break dependent software, so test first and hold the package until a fix ships.

Sources

← All posts

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.