PatchTheCVEBlog · 2-hour update · 2026-10-26
CVE-2026-105134 Ahsay Cloud Backup Suite: exploited in the wild, how to patch
By the PatchTheCVE security team · Updated 2026-10-26 · Data from NVD, CISA KEV, EPSS and vendor advisories
Critical severity (CVSS 10.0), exploited in the wild, remotely exploitable, no login needed. Recommended action: upgrade to 9.15.2.70, 10.3.4.45.
On 26 October 2026, 62 new CVEs were published that we track: 3 critical, 4 already exploited in the wild (CISA KEV) and 2 with a fix or vendor patch available. Each one is ranked by severity, exploitation signals and how easy it is to reach, so you can patch the right ones first.
Key takeaways
- Most urgent: CVE-2026-105134 (Ahsay Cloud Backup Suite): upgrade to 9.15.2.70, 10.3.4.45.
- 4 exploited in the wild (CISA KEV): patch these before anything else.
- 6 of the top 8 can be attacked over the network without a login.
- 2 of 62 new CVEs already have a fix or vendor patch.
- Most affected vendors: a2aproject, hugging face, n a.
What happened in this 2-hour window: the most serious item is CVE-2026-105134 in cloud backup suite (critical, CVSS 10.0, priority 93/100). Recommended action: upgrade to 9.15.2.70, 10.3.4.45. 4 new CVEs from the list below are already being exploited (CVE-2026-105134, CVE-2026-45321, CVE-2026-0300, and more), so those go first. 6 of the 8 top items can be attacked remotely without a login. At least one is linked to ransomware campaigns. Most affected: a2aproject (3), hugging face (1), n a (1). 2 of 62 new CVEs already have a fix or vendor patch; for the other 60, follow the downgrade or mitigation steps until one ships.
Patch these first
CVE-2026-105134: Ahsay AhsayCBS Command Injection Vulnerability
- Risk: Critical (CVSS 10.0), priority 93/100 (patch now), published 4 October 2026
- Exploitation: exploited in the wild (CISA KEV), federal due date 2026-10-17; 86.3% chance of exploitation in the next 30 days (EPSS); attackable over the network without a login
- Affected: ahsay cloud backup suite (< 9.15.2.70, >= 10.1.0 and < 10.3.4.45)
- Fixed in: 9.15.2.70, 10.3.4.45
- What to do: upgrade to 9.15.2.70, 10.3.4.45 for ahsay cloud backup suite
Why it ranks here: critical severity; epss top 1%: very likely to be exploited; exploited in the wild (cisa kev).
References: NVD · Vendor Advisory
CVE-2026-45321: TanStack Unspecified Vulnerability
- Risk: Critical (CVSS 9.6), priority 91/100 (patch now), published 12 May 2026
- Exploitation: exploited in the wild (CISA KEV), federal due date 2026-06-10; used in ransomware campaigns; 3.3% chance of exploitation in the next 30 days (EPSS)
- Affected: tanstack tanstack\/arktype-adapter (1.166.12, 1.166.15)
- No fix yet, safe release: before 1.166.12
- What to do: downgrade to a release before 1.166.12 until a fix ships for tanstack tanstack\/arktype-adapter
Why it ranks here: critical severity; exploited in the wild (cisa kev); used in ransomware campaigns.
References: NVD · Mitigation, Vendor Advisory · Exploit, Vendor Advisory
CVE-2026-0300: Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability
- Risk: Critical (CVSS 9.8), priority 89/100 (patch now), published 6 May 2026
- Exploitation: exploited in the wild (CISA KEV), federal due date 2026-05-09; 41.7% chance of exploitation in the next 30 days (EPSS); attackable over the network without a login
- Affected: paloaltonetworks pan-os (10.2.0, 10.2.1, 10.2.2)
- No fix yet, safe release: before 10.2.0
- What to do: apply the vendor mitigation for paloaltonetworks pan-os
Why it ranks here: critical severity; epss top 1%: very likely to be exploited; exploited in the wild (cisa kev).
References: NVD · Mitigation, Vendor Advisory
CVE-2026-105133: Ahsay AhsayCBS Improper Authentication Vulnerability
- Risk: High (CVSS 7.3), priority 80/100 (patch now), published 4 October 2026
- Exploitation: exploited in the wild (CISA KEV), federal due date 2026-10-17; 79.2% chance of exploitation in the next 30 days (EPSS); attackable over the network without a login
- Affected: ahsay cloud backup suite (< 9.15.2.70, >= 10.1.0 and < 10.3.4.45)
- Fixed in: 9.15.2.70, 10.3.4.45
- What to do: upgrade to 9.15.2.70, 10.3.4.45 for ahsay cloud backup suite
Why it ranks here: high severity; epss top 1%: very likely to be exploited; exploited in the wild (cisa kev).
References: NVD · Vendor Advisory
CVE-2026-102649: Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator
- Risk: Critical (CVSS 9.9), priority 45/100 (patch this month), published 26 October 2026
- Exploitation: attackable over the network without a login
- What to do: apply the vendor mitigation
Why it ranks here: critical severity; remotely exploitable, no login, no user action; on your watchlist.
References: NVD
CVE-2026-10757: There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux th
- Risk: Critical (CVSS 9.8), priority 44/100 (patch this month), published 26 October 2026
- Exploitation: attackable over the network without a login
- What to do: apply the vendor mitigation
Why it ranks here: critical severity; remotely exploitable, no login, no user action; on your watchlist.
References: NVD
CVE-2026-110720: Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL
- Risk: Critical (CVSS 9.9), priority 35/100 (patch this month), published 26 October 2026
- What to do: apply the vendor mitigation
Why it ranks here: critical severity.
References: NVD
CVE-2026-72753: When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and
- Risk: High (CVSS 8.2), priority 34/100 (routine), published 26 October 2026
- Exploitation: attackable over the network without a login
- What to do: apply the vendor mitigation
Why it ranks here: high severity; remotely exploitable, no login, no user action.
References: NVD
Most affected vendors
- a2aproject: 3 new CVEs
- hugging face: 1 new CVE
- n a: 1 new CVE
- wolfvision: 1 new CVE
How to act on this list
- Start with anything marked exploited or patch now.
- Check what you run: see how to check a version and patch it on Linux, Windows, pip and npm.
- Prefer the vendor or distro fix. If none exists, read when to downgrade and when to mitigate.
- Verify afterwards. Distros often fix a flaw without changing the upstream version, here is how to confirm.
FAQ
What is the most serious vulnerability published on 26 October 2026?
CVE-2026-105134 (Ahsay AhsayCBS Command Injection Vulnerability) ranks highest, with a priority score of 93/100. Recommended action: upgrade to 9.15.2.70, 10.3.4.45.
Are any of the new CVEs exploited in the wild?
Yes, 4 of the new CVEs appear on the CISA Known Exploited Vulnerabilities list. Patch those first.
Should I downgrade if there is no fix yet?
Only when an older release is confirmed unaffected and the package is not a core system component. Downgrades can break dependent software, so test first and hold the package until a fix ships.
Sources
- NIST National Vulnerability Database: CVE details and affected versions
- CVE Program: official CVE records
- CISA Known Exploited Vulnerabilities catalog: exploitation in the wild
- FIRST EPSS: exploit probability
- Distribution and vendor advisories linked under each item.