Cybersecurity News Briefing: October 14, 2026
Wednesday, October 14, 2026 · 12 stories · 6 exploited vulnerabilities
Today's briefing highlights a surge in actively exploited zero‑day flaws, notably Cisco Secure Email Gateway (CVE‑2026‑76519) and Ivanti Connect Secure, both added to CISA’s KEV catalog. CISA also listed additional high‑risk vulnerabilities in Palo Alto Networks and AhsayCBS, urging rapid remediation. Microsoft’s takedown of a Chinese‑language phishing infrastructure and its release of patches for over 1,400 flaws underscore broader threat mitigation. Readers should prioritize applying the newly released patches for the KEV‑listed products.
Top Stories
- CriticalVulnerabilityEuropeThe Register
Cisco Secure Email Gateway zero-day allows remote root execution, added to CISA KEV catalog
A critical vulnerability in Cisco’s Secure Email Gateway, identified as CVE-2026-76519, enables unauthenticated attackers to gain root privileges by sending a crafted email. The flaw has been actively exploited, prompting CISA to list it in its Known Exploited Vulnerabilities catalog and require federal agencies to remediate by a set deadline. Cisco advises customers to install the patched release and follow hardening guidance.
Why it matters: Unpatched SEG appliances can be compromised to execute arbitrary code as root, demanding immediate updates.
- CriticalVulnerabilityGlobalBleepingComputer
Cisco releases patch for actively exploited Secure Email Gateway zero-day
Cisco has issued a security update that resolves a zero-day vulnerability in its Secure Email Gateway product which was being leveraged by attackers to execute commands with root privileges. The patch addresses the flaw that allowed remote unauthenticated code execution.
Why it matters: Applying Cisco’s patch removes the active attack vector targeting email gateways.
- CriticalVulnerabilityNorth AmericaCISA Advisories
CISA adds four actively exploited vulnerabilities to KEV catalog, urges rapid remediation
CISA has placed four newly identified vulnerabilities into its Known Exploited Vulnerabilities catalog after confirming active exploitation. The flaws affect Palo Alto Networks PAN-OS, Cisco Secure Email Gateway, and two AhsayCBS components and represent a high-risk attack vector for federal enterprise systems. Federal agencies are required by Binding Operational Directive 26-04 to prioritize patching of these KEV items on publicly exposed assets, while other organizations are advised to follow risk-based remediation.
Why it matters: Prompt patching of KEV-listed flaws reduces the risk of compromise on critical network infrastructure.
- CriticalVulnerabilityNorth AmericaCISA Advisories
CISA urges immediate patching of Ivanti Connect Secure zero-day authentication bypass
CISA reports active exploitation of a zero-day authentication bypass in Ivanti Connect Secure affecting versions up to 25.1.1.1, 25.1.2.2 and 22.8R2.4. The flaw permits remote unauthenticated command execution, enabling credential theft and data exfiltration. Organizations are instructed to apply the latest Ivanti release, follow upgrade guidance, and conduct forensic analysis if compromise is suspected.
Why it matters: Unpatched Ivanti appliances can be hijacked to steal credentials and exfiltrate data, so rapid patching is essential.
- HighPhishing & FraudGlobalSecurityWeek
Microsoft disrupts Chinese-language phishing ecosystem responsible for over a billion messages
Leveraging a federal court order, Microsoft and the Health-ISAC seized the domains that powered the YAM Store, CoGUI and Iron Man phishing services, which were used to send more than one billion malicious messages in Chinese. The takedown removes critical infrastructure used by the threat actors.
Why it matters: Eliminating phishing service domains reduces the volume of malicious communications and protects users.
- HighThreat IntelligenceEuropeHelp Net Security
Threat actor exploits chain of three Ivanti zero-days to compromise patched VPN appliances
Researchers observed a threat group using a combination of three previously unknown Ivanti Connect Secure vulnerabilities to obtain root access on appliances that were fully patched at the time of attack. The chain enabled credential theft, configuration data exfiltration and network reconnaissance across compromised environments.
Why it matters: Even patched VPN devices can be breached via multi-vulnerability chains, underscoring layered defenses and monitoring.
- HighVulnerabilityGlobalThe Hacker News
Local privilege escalation flaw in Linux vhost subsystem enables root and VM host compromise
A vulnerability in the Linux vhost subsystem, identified as CVE-2026-74580 and named Vghost, permits a local user to arbitrarily read and write kernel memory, granting root privileges across multiple kernel releases. In certain virtualization configurations the flaw also allows an untrusted guest to modify host memory and hijack the host’s virtual machine manager.
Why it matters: Exploiting Vghost can give attackers full system control, making prompt kernel updates essential.
- HighVulnerabilityGlobalSecurityWeek
Microsoft releases patches for over 1,400 flaws, including exploited Windows zero-day
Microsoft has issued updates that address 1,413 security issues across its products, with particular emphasis on a Windows security feature bypass that has been observed in active attacks. The widespread patch rollout aims to remediate the exploited vulnerability and other identified flaws.
Why it matters: Applying Microsoft patches eliminates known attack vectors and prevents exploitation of active Windows zero-day.
- HighAI SecurityMiddle EastCheck Point Research
Multiple high-severity flaws discovered in LiteLLM open-source LLM gateway
Security analysis of LiteLLM version 1.77.7 uncovered several critical vulnerabilities, including an authorization bypass on the configuration endpoint that permits any authenticated user to alter runtime settings, leading to arbitrary file access, administrative takeover and remote code execution, as well as an SSRF issue that can expose provider credentials. The issues have been fixed in LiteLLM 1.83.9.
Why it matters: Ensuring proper access controls and input validation in LLM gateways prevents credential theft and remote code execution.
- MediumVulnerabilityGlobalCISA Advisories
Swann Communications cameras vulnerable to unauthenticated video access
Three vulnerabilities in Swann Communications SWIFI-SE2KIC firmware versions up to 2.0.22 permit an attacker on the same network to view live video streams without authentication. The vendor recommends securing the device behind a firewall, disabling public RTSP exposure, using strong passwords and applying firmware updates to mitigate the risk.
Why it matters: Unprotected camera firmware can leak video feeds, so network segmentation and updates are essential.
- InformationalThreat IntelligenceNorth AmericaThe Record
Brooklyn authorities dismantle cryptocurrency fraud operation targeting Russian-speaking residents
Law enforcement in Brooklyn acted on tips from Russian-speaking community members to shut down servers and domains associated with a cryptocurrency fraud scheme that had been operating for several years. The coordinated effort resulted in the disruption of the illicit platform.
Why it matters: Community reporting can lead to successful takedowns of crypto scams, emphasizing vigilance.
- InformationalPolicy & RegulationEuropeKrebs on Security
UK imposes sanctions on Cryptomus for facilitating Russian cybercrime payments
The United Kingdom has placed economic sanctions on the cryptocurrency platform Cryptomus, alleging its role in processing payments for ransomware, drug trafficking, darknet markets and other cyber-crime services that support Russian entities. The measures freeze Cryptomus assets held at UK banks and prohibit British firms from providing services to the platform and related payment services.
Why it matters: Sanctions restrict illicit crypto financing channels, urging businesses to verify compliance with anti-money-laundering rules.
Newly Added Known Exploited Vulnerabilities
Vulnerabilities CISA has confirmed are being exploited in the wild. If you run any of these products, patch or mitigate first.
| CVE | Product | Vulnerability | Ransomware use |
|---|---|---|---|
| CVE-2026-105134 | Ahsay AhsayCBS | Ahsay AhsayCBS Command Injection Vulnerability | Unknown |
| CVE-2026-76519 | Cisco Secure Email Gateway | Cisco Secure Email Gateway Relative Path Traversal Vulnerability | Unknown |
| CVE-2026-105133 | Ahsay AhsayCBS | Ahsay AhsayCBS Improper Authentication Vulnerability | Unknown |
| CVE-2026-0322 | Palo Alto Networks PAN-OS | Palo Alto Networks PAN-OS Code Injection Vulnerability | Unknown |
| CVE-2026-104935 | Ivanti Connect Secure | Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability | Unknown |
| CVE-2026-96951 | Microsoft Windows | Microsoft Windows Command Injection Vulnerability | Unknown |