PatchTheCVEBlog · 2-hour update · 2026-10-26
CVE-2026-34197 Apache Activemq: exploited in the wild, how to patch
By the PatchTheCVE security team · Updated 2026-10-27 · Data from NVD, CISA KEV, EPSS and vendor advisories
High severity (CVSS 8.8), exploited in the wild. Recommended action: upgrade to 5.19.4, 6.2.3.
On 26 October 2026, 74 new CVEs were published that we track: 1 critical, 3 already exploited in the wild (CISA KEV) and 29 with a fix or vendor patch available. Each one is ranked by severity, exploitation signals and how easy it is to reach, so you can patch the right ones first.
Key takeaways
- Most urgent: CVE-2026-34197 (Apache Activemq): upgrade to 5.19.4, 6.2.3.
- 3 exploited in the wild (CISA KEV): patch these before anything else.
- 7 of the top 8 can be attacked over the network without a login.
- 29 of 74 new CVEs already have a fix or vendor patch.
- Most affected vendors: openpanel-dev, yeswiki, cure53.
What happened in this 2-hour window: the most serious item is CVE-2026-34197 in activemq (high, CVSS 8.8, priority 91/100). Recommended action: upgrade to 5.19.4, 6.2.3. 3 new CVEs from the list below are already being exploited (CVE-2026-34197, CVE-2026-34486, CVE-2026-32201), so those go first. 7 of the 8 top items can be attacked remotely without a login. Most affected: openpanel-dev (14), yeswiki (9), cure53 (3). 29 of 74 new CVEs already have a fix or vendor patch; for the other 45, follow the downgrade or mitigation steps until one ships.
Patch these first
CVE-2026-34197: Apache ActiveMQ Improper Input Validation Vulnerability
- Risk: High (CVSS 8.8), priority 91/100 (patch now), published 7 April 2026
- Exploitation: exploited in the wild (CISA KEV), federal due date 2026-04-30; 98.3% chance of exploitation in the next 30 days (EPSS)
- Affected: apache activemq (< 5.19.4, >= 6.0.0 and < 6.2.3)
- Fixed in: 5.19.4, 6.2.3
- What to do: upgrade to 5.19.4, 6.2.3 for apache activemq
Why it ranks here: high severity; epss top 1%: very likely to be exploited; exploited in the wild (cisa kev).
References: NVD · Vendor Advisory
CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
- Risk: High (CVSS 7.5), priority 91/100 (patch now), published 9 April 2026
- Exploitation: exploited in the wild (CISA KEV), federal due date 2026-08-07; 98.5% chance of exploitation in the next 30 days (EPSS); attackable over the network without a login
- Affected: apache tomcat (9.0.116, 10.1.53, 11.0.20)
- No fix yet, safe release: before 9.0.116
- Patch ID: RHSA-2026:36788, RHSA-2026:36790, RHSA-2026:36787
- What to do: downgrade to a release before 9.0.116 until a fix ships for apache tomcat
Why it ranks here: high severity; epss top 1%: very likely to be exploited; exploited in the wild (cisa kev).
References: NVD · Mailing List, Vendor Advisory · Mitigation, Third Party Advisory
CVE-2026-32201: Microsoft SharePoint Server Improper Input Validation Vulnerability
- Risk: Medium (CVSS 6.5), priority 82/100 (patch now), published 14 April 2026
- Exploitation: exploited in the wild (CISA KEV), federal due date 2026-04-28; 43.4% chance of exploitation in the next 30 days (EPSS); attackable over the network without a login
- Affected: microsoft sharepoint server (< 16.0.19725.20210, 2016, 2019)
- Fixed in: 16.0.19725.20210
- What to do: upgrade to 16.0.19725.20210 for microsoft sharepoint server
Why it ranks here: epss top 1%: very likely to be exploited; exploited in the wild (cisa kev); remotely exploitable, no login, no user action.
References: NVD · Vendor Advisory
CVE-2026-116508: A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104
- Risk: Critical (CVSS 10.0), priority 40/100 (patch this month), published 26 October 2026
- Exploitation: attackable over the network without a login
- What to do: apply the vendor mitigation
Why it ranks here: critical severity; remotely exploitable, no login, no user action.
References: NVD
CVE-2026-116591: compress provides various compression algorithms
- Risk: High (CVSS 8.7), priority 35/100 (routine), published 26 October 2026
- Exploitation: attackable over the network without a login
- What to do: apply the vendor mitigation
Why it ranks here: high severity; remotely exploitable, no login, no user action.
References: NVD
CVE-2026-116588: Datadog dd-trace-py is the Datadog Python APM client
- Risk: High (CVSS 8.7), priority 35/100 (routine), published 26 October 2026
- Exploitation: attackable over the network without a login
- What to do: apply the vendor mitigation
Why it ranks here: high severity; remotely exploitable, no login, no user action.
References: NVD
CVE-2026-116589: Datadog dd-trace-py is the Datadog Python APM client
- Risk: High (CVSS 8.2), priority 34/100 (routine), published 26 October 2026
- Exploitation: attackable over the network without a login
- What to do: apply the vendor mitigation
Why it ranks here: high severity; remotely exploitable, no login, no user action.
References: NVD
CVE-2026-116747: Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attacker
- Risk: High (CVSS 8.1), priority 33/100 (routine), published 26 October 2026
- Exploitation: attackable over the network without a login
- What to do: apply the vendor mitigation
Why it ranks here: high severity; remotely exploitable, no login, no user action.
References: NVD
Most affected vendors
- openpanel-dev: 14 new CVEs
- yeswiki: 9 new CVEs
- cure53: 3 new CVEs
- sourcecodester: 2 new CVEs
- apache software foundation: 1 new CVE
- parse-community: 1 new CVE
How to act on this list
- Start with anything marked exploited or patch now.
- Check what you run: see how to check a version and patch it on Linux, Windows, pip and npm.
- Prefer the vendor or distro fix. If none exists, read when to downgrade and when to mitigate.
- Verify afterwards. Distros often fix a flaw without changing the upstream version, here is how to confirm.
FAQ
What is the most serious vulnerability published on 26 October 2026?
CVE-2026-34197 (Apache ActiveMQ Improper Input Validation Vulnerability) ranks highest, with a priority score of 91/100. Recommended action: upgrade to 5.19.4, 6.2.3.
Are any of the new CVEs exploited in the wild?
Yes, 3 of the new CVEs appear on the CISA Known Exploited Vulnerabilities list. Patch those first.
Should I downgrade if there is no fix yet?
Only when an older release is confirmed unaffected and the package is not a core system component. Downgrades can break dependent software, so test first and hold the package until a fix ships.
Sources
- NIST National Vulnerability Database: CVE details and affected versions
- CVE Program: official CVE records
- CISA Known Exploited Vulnerabilities catalog: exploitation in the wild
- FIRST EPSS: exploit probability
- Distribution and vendor advisories linked under each item.