Blog · 2-hour update · 2026-10-27

CVE-2026-57191 Asterisk: top risk today, fix steps

By the PatchTheCVE security team · Updated 2026-10-28 · Data from NVD, CISA KEV, EPSS and vendor advisories

Most urgent: CVE-2026-57191: Asterisk is an open source private branch exchange and telephony toolkit
High severity (CVSS 8.2), remotely exploitable, no login needed. Recommended action: apply the vendor mitigation.

On 27 October 2026, 71 new CVEs were published that we track: 1 critical, 0 already exploited in the wild (CISA KEV) and 0 with a fix or vendor patch available. Each one is ranked by severity, exploitation signals and how easy it is to reach, so you can patch the right ones first.

Key takeaways

Most urgent: CVE-2026-57191 (Asterisk): apply the vendor mitigation.
4 of the top 8 can be attacked over the network without a login.
0 of 71 new CVEs already have a fix or vendor patch.
Most affected vendors: jeremyckahn.

What happened in this 2-hour window: the most serious item is CVE-2026-57191 (high, CVSS 8.2, priority 34/100). Recommended action: apply the vendor mitigation. 4 of the 8 top items can be attacked remotely without a login. Most affected: jeremyckahn (1). 0 of 71 new CVEs already have a fix or vendor patch; for the other 71, follow the downgrade or mitigation steps until one ships.

Patch these first

CVE-2026-57191: Asterisk is an open source private branch exchange and telephony toolkit

Risk: High (CVSS 8.2), priority 34/100 (routine), published 27 October 2026
Exploitation: attackable over the network without a login
What to do: apply the vendor mitigation

Why it ranks here: high severity; remotely exploitable, no login, no user action.

References: NVD

CVE-2026-58256: GRR is a resource management and reservation application

Risk: Critical (CVSS 9.1), priority 32/100 (patch this month), published 27 October 2026
What to do: apply the vendor mitigation

Why it ranks here: critical severity.

References: NVD

CVE-2026-59158: Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications

Risk: High (CVSS 7.5), priority 31/100 (routine), published 27 October 2026
Exploitation: attackable over the network without a login
What to do: apply the vendor mitigation

Why it ranks here: high severity; remotely exploitable, no login, no user action.

References: NVD

CVE-2026-58255: Cronicle is a multi-server task scheduler and runner, with a web based front-end UI

Risk: High (CVSS 8.8), priority 31/100 (routine), published 27 October 2026
What to do: apply the vendor mitigation

Why it ranks here: high severity.

References: NVD

CVE-2026-62765: Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an una

Risk: High (CVSS 7.5), priority 31/100 (routine), published 27 October 2026
What to do: apply the vendor mitigation

Why it ranks here: high severity; on your watchlist.

References: NVD

CVE-2026-57186: Asterisk is an open source private branch exchange and telephony toolkit

Risk: High (CVSS 7.5), priority 31/100 (routine), published 27 October 2026
Exploitation: attackable over the network without a login
What to do: apply the vendor mitigation

Why it ranks here: high severity; remotely exploitable, no login, no user action.

References: NVD

CVE-2026-57190: Asterisk is an open source private branch exchange and telephony toolkit

Risk: High (CVSS 7.0), priority 30/100 (routine), published 27 October 2026
Exploitation: attackable over the network without a login
What to do: apply the vendor mitigation

Why it ranks here: high severity; remotely exploitable, no login, no user action.

References: NVD

CVE-2026-58205: GRR is a resource management and reservation application

Risk: High (CVSS 8.1), priority 28/100 (routine), published 27 October 2026
What to do: apply the vendor mitigation

Why it ranks here: high severity.

References: NVD

Most affected vendors

jeremyckahn: 1 new CVE

How to act on this list

Start with anything marked exploited or patch now.
Check what you run: see how to check a version and patch it on Linux, Windows, pip and npm.
Prefer the vendor or distro fix. If none exists, read when to downgrade and when to mitigate.
Verify afterwards. Distros often fix a flaw without changing the upstream version, here is how to confirm.

FAQ

What is the most serious vulnerability published on 27 October 2026?

CVE-2026-57191 (Asterisk is an open source private branch exchange and telephony toolkit) ranks highest, with a priority score of 34/100. Recommended action: apply the vendor mitigation.

Are any of the new CVEs exploited in the wild?

None of the new CVEs were on the CISA Known Exploited Vulnerabilities list when this was written. Keep watching the list, it changes daily.

Should I downgrade if there is no fix yet?

Only when an older release is confirmed unaffected and the package is not a core system component. Downgrades can break dependent software, so test first and hold the package until a fix ships.

Sources

NIST National Vulnerability Database: CVE details and affected versions
CVE Program: official CVE records
CISA Known Exploited Vulnerabilities catalog: exploitation in the wild
FIRST EPSS: exploit probability
Distribution and vendor advisories linked under each item.

Keep reading

← All posts