Weekly AppSec Threat Digest: Ivanti, Cisco & BeyondTrust Zero-Days, Next.js RCE

Nine additions to CISA's Known Exploited Vulnerabilities (KEV) catalog in four days set the tone for this week. Three of them are unauthenticated zero-days in the boxes that sit at the very edge of the enterprise — an Ivanti Connect Secure VPN, a Cisco Secure Email Gateway, and a BeyondTrust Remote Support appliance that attackers had been inside since late August. Microsoft's October Patch Tuesday added an exploited Mark of the Web bypass, and Palo Alto Networks confirmed limited exploitation of a PAN-OS management-interface RCE.

For web application teams the headline is closer to home: Next.js shipped an out-of-band release for two unauthenticated RCEs, GitLab patched a CVSS 10.0 code-execution bug in its CI/CD regex compiler, SAP fixed a maximum-severity OAuth2 SSRF in its Cloud SDK for Python, and a WordPress form plugin was mass-exploited for unauthenticated PHP upload within hours of disclosure. On the offensive-research side, an AI-assisted Chrome full-chain exploit earned a $250,000 bounty — and a criminal crew showed what the same tooling looks like pointed at WordPress at scale.

Actively exploited: this week's KEV additions

CVE-2026-104935 — Ivanti Connect Secure (CVSS 8.6, zero-day)

Disclosed October 13 and added to KEV the same day with a three-day federal deadline, this authentication bypass by spoofing (CWE-290) lets a remote, unauthenticated attacker execute arbitrary commands on Ivanti Connect Secure. Affected releases are 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier; the 22.7.x line and below is not affected.

The incident detail is what should change your response plan. Volexity, which tracks the actor as UTA0576, observed exploitation from at least October 3 and reports that the bug was chained with two further flaws to reach root code execution — one of them a privilege-escalation issue that was still unpatched at disclosure. The attackers deployed no web shell and tampered with logs, which allowed them to evade Ivanti's Integrity Checker Tool. A clean ICT result is therefore not evidence of a clean appliance.

Unauthenticated request

Internet-facing VPN

↓→

CVE-2026-104935

Auth bypass (CWE-290)

↓→

Chained flaws

Escalation to root

↓→

Log tampering

Evades integrity check

Remediation: Upgrade to 22.8R2.5, 25.1.3.0 / 25.1.3.1, or 25.1.1.2 for your branch, then hunt for compromise regardless of patch state using the indicators Volexity published. See Rapid7's analysis and BleepingComputer's coverage.

CVE-2026-76519 — Cisco Secure Email Gateway (CVSS 9.8, exploited)

Published October 14 and added to KEV the same day: a relative path traversal (CWE-23) in the AMP attachment-handling path of AsyncOS lets an unauthenticated attacker write arbitrary files — and execute commands as root — simply by sending an email with a crafted attachment. Cisco PSIRT confirmed active exploitation in October 2026.

Exposure is configuration-dependent: the gateway is vulnerable only when File Reputation is enabled and assigned to a mail policy and Content Scanner Tools is older than 25.3.0.5525. Secure Email and Web Manager and Secure Web Appliance are not affected. An email gateway is a uniquely bad place for this bug class: the attacker's delivery mechanism is the very traffic the appliance exists to accept.

Remediation: There are no workarounds. Update Content Scanner Tools to 25.3.0.5525 or later (no restart required), or move to AsyncOS 15.5.5-014 or 16.5.0-780; the 16.0 branch must migrate to a fixed release. Read the Cisco security advisory.

CVE-2026-102764 — BeyondTrust Remote Support (CVSS 9.3, exploited since August)

Published October 15 and added to KEV on October 16: improper origin validation in internal messaging components lets an unauthenticated attacker perform file operations on Remote Support 26.2.3 and earlier. Reporting on the intrusions describes a full post-exploitation chain — a web shell, escalation to root, a tunneling implant, log wiping, and lateral movement — attributed to a suspected China-nexus group. Exploitation dates to late August, and Shadowserver counts more than 1,400 exposed instances.

Remediation: SaaS instances were patched by the vendor on October 8. Self-hosted customers must apply BeyondTrust's patch for their release line (older releases must first upgrade to a supported version) and should treat any appliance that was internet-reachable since August as potentially compromised. See the CVE record and BleepingComputer's report.

CVE-2026-96951 — Windows Shell Mark of the Web bypass (CVSS 8.8, exploited)

The exploited zero-day in Microsoft's October 13 Patch Tuesday is a command-injection flaw (CWE-77) that lets a crafted file bypass Mark of the Web warnings and Protected View. User interaction is required — the victim must open the file — which makes it a natural fit for phishing payloads. It affects supported Windows 10, Windows 11 and Windows Server releases and was added to KEV on October 13. Microsoft did not share attack details.

Two other items in the release matter to web teams: CVE-2026-102866, an unauthenticated elevation of privilege in SharePoint Server Subscription Edition caused by improper signature verification (CVSS 8.1, not exploited, fixed in build 16.0.20326.20190), and a publicly disclosed .NET WDAC bypass (CVE-2026-108398) found by Google Project Zero. Remediation: deploy the October cumulative updates. See Help Net Security and BleepingComputer.

CVE-2026-0322 — Palo Alto Networks PAN-OS (CVSS 8.6, limited exploitation)

A code-injection flaw in the PAN-OS management interface gives an authenticated administrator root code execution on PA-Series, VM-Series and Panorama. Palo Alto Networks reports “very limited exploitation”, and CISA added it to KEV on October 14. The high-privilege requirement lowers the score, but management interfaces reachable from untrusted networks keep turning stolen admin credentials into full device compromise. Cloud NGFW and Prisma Access are not affected.

Remediation: Upgrade to the first fixed release on your branch (for example 12.2.4, 12.1.10-h2, 11.2.16, 11.1.16-h3, 10.2.18-h12) and restrict management access to trusted IPs or a jump host. See the Palo Alto Networks advisory.

Also added to KEV this week

• AhsayCBS CVE-2026-105133 + CVE-2026-105134 — an authentication bypass chained with OS command injection (CVSS 10.0 for the injection), added to KEV October 14. Ahsay says its first patches were incomplete: install hotfix v10.3.4.45 (v10) or v9.15.2.70 (v7–v9) and reboot. Ahsay announcement.
• Atlassian Data Center CVE-2026-21589 — the unauthenticated file-disclosure bug from last week's digest was added to KEV on October 15. If it is still on your backlog, it is now confirmed exploited.
• Fortinet CVE-2025-61624 — an authenticated CLI path traversal (CVSS 6.0, below our usual bar) now marked as known exploited. FortiGuard FG-IR-26-122.

Critical web application CVEs

Next.js out-of-band release — two unauthenticated RCEs (October 14)

Vercel shipped Next.js 16.4.1 and 15.5.28 to fix two remote-code-execution issues and a denial of service:

• GHSA-673q-mjm6-r5xr (CVSS v4 9.5) — RCE in use cache functions that return multiple typed arrays, affecting App Router applications with Cache Components enabled on 16.0.0–16.4.0. The root cause is upstream in react-server-dom-*. There is no CVE yet, so dependency scanners that key on CVE IDs may not flag it.
• CVE-2026-96889 / GHSA-2464-fhr4-w9xw — RCE through the Image Optimization API when processing SVG, via a memory bug in librsvg reached through sharp on glibc Linux. Exposure requires dangerouslyAllowSVG; next/og on the Node runtime is also exposed.
• GHSA-p3m5-59mp-jv5r (High) — CPU exhaustion in Server Actions.

No in-the-wild exploitation was known at release. Remediation: upgrade to 16.4.1, or 15.5.28 with sharp 0.35.5 or later (check with npm ls sharp). If you cannot upgrade immediately, disable SVG decoding with sharp.block({ operation: ["VipsForeignLoadSvg"] }). Read the Next.js security update and GitHub advisory.

CVE-2026-97229 — GitLab CE/EE (CVSS 10.0)

GitLab's October 12 patch release fixes an integer overflow (CWE-190) in the CI/CD regular-expression compiler that, under certain conditions, lets an unauthenticated attacker run code on the server through a crafted regex in CI/CD configuration. This is a different issue from last week's AI Gateway sandbox escape. The same release fixes a stored XSS in syntax highlighting (CVE-2026-92883, CVSS 8.7), an authorization flaw in downstream pipeline creation (CVE-2026-16301, CVSS 8.5), raw-file cache poisoning that can expose protected CI variables (CVE-2026-14814, CVSS 8.2), and a Duo Agent Platform prompt injection (CVE-2026-96893, CVSS 7.3).

Remediation: upgrade self-managed instances to 19.4.2, 19.3.5, or 19.2.8. GitLab.com is already patched, and no exploitation had been reported. See the GitLab patch release notes.

CVE-2026-89111 — SAP Cloud SDK for Python OAuth2 SSRF (CVSS 10.0)

The headline fix in SAP's October Patch Day is a server-side request forgery (CWE-918) in sap-cloud-sdk before 0.45.2. In multi-tenant SAP BTP applications, an attacker who controls the tenant_subdomain value can redirect the SDK's OAuth2 token request to a server they own and steal the application's client credentials — no privileges required. It is a textbook example of a trusted identifier becoming part of an outbound URL.

Remediation: upgrade to 0.45.2, and allowlist tenant_subdomain values before they reach any SDK call. SAP also fixed critical issues in NetWeaver Visual Composer and Manufacturing Integration and Intelligence. See the CVE record and BleepingComputer's coverage.

CVE-2026-85097 — Bricksforge for WordPress (exploited, unauthenticated RCE)

Patchstack disclosed on October 8 that the Bricksforge plugin (3.1.8.9 and earlier) allows unauthenticated arbitrary file upload, and that automated exploitation from 63 source IPs began on October 7. The chain is a neat illustration of how several “minor” checks fail together:

Public nonce

Unauthenticated AJAX action

↓→

GIF/PHP polyglot

Passes MIME check

↓→

form_submit with .php URL

Extension not enforced

↓→

Executable PHP

Remote code execution

Remediation: update to 3.1.8.10 or later, then hunt for unexpected PHP files (including login_admin_*.php) under /wp-content/uploads/ created since October 7. See Patchstack's analysis and SecurityWeek.

Web application security research worth your time

Filename-to-shell command injection in SPIP odt2spip — VulnCheck, October 16

Valentin Lobstein documented CVE-2026-104085 (CVSS 8.8) in the odt2spip plugin for SPIP (4.3.0 and earlier). The upload filename was escaped only with addslashes() before being concatenated into an exec() shell call. That function was never designed for shell quoting, so metacharacters such as $, (, ; and | survive and any low-privileged author account gets code execution as the web server user. Version 4.4.0 fixes it by passing an argument array to proc_open.

Practical takeaway: filenames are user input. Anywhere an application shells out with an uploaded file's name, test for metacharacter injection, and fix by removing the shell rather than by escaping. Read the VulnCheck write-up.

AI agents at criminal scale — SOCRadar via The Hacker News, October 12

SOCRadar described a financially motivated initial-access broker that orchestrated dozens of agents built on a commercial AI coding assistant to mass-exploit known WordPress and WordPress-plugin vulnerabilities, including SQL injection. In one reported run the operation scanned 4,708 targets, reached 429 admin panels and dropped 32 web shells in 61 seconds. None of the techniques were novel; the change is the speed and parallelism with which known, unpatched web bugs are now turned into access.

Practical takeaway: the window between “public CVE in a plugin” and “mass exploitation” was already short — Bricksforge shows it at under a day — and automation compresses it further. Continuous asset inventory and fast patching of internet-facing CMS estates matter more than ever. Read The Hacker News report.

Bug bounty highlights

Chrome VRP pays $250,000 for an AI-assisted full-chain exploit

XBOW announced on October 13 that Google's Chrome Vulnerability Reward Program paid $250,000 for a three-bug full chain — a V8 bug (CVE-2026-85045), an animated-WebP stage, and a Crashpad bug (CVE-2026-78952) — built by researcher Brendan Dolan-Gavitt working with AI agents running a publicly available model, at roughly $40,000 of compute. XBOW describes it as the first full-chain award under Google's 2026 VRP rules. The bugs are fixed and were never used in attacks.

Read alongside the criminal campaign above, the lesson is symmetric: the same class of tooling that compressed a browser full chain into days is compressing commodity web exploitation into seconds. Read XBOW's post and The Hacker News coverage.

Pwn2Own Ireland 2026 closes at $1,262,000 for 98 zero-days

Last week we covered day one; the final tally landed on October 9. Ikotas Labs took Master of Pwn with $361,000, including a $300,000 Pixel 10 chain, and AI products such as OpenAI Codex and Oracle Autonomous AI Database were among the targets that fell. Vendors now have 90 days to patch before the Zero Day Initiative publishes details.

See BleepingComputer's summary.

Block consolidates its bug bounty on HackerOne

Block merged five Bugcrowd programs into a single private, invite-only HackerOne program covering Square, Cash App, Afterpay, TIDAL and its open-source projects. The new program went live October 7; Bugcrowd stopped accepting new submissions on September 30, and earlier reports are still honored. Researchers with previously accepted findings can request an invitation. Read the Block engineering blog.

The pattern: the edge is still the softest target

Line up this week's KEV additions and every exploited zero-day is an appliance that accepts traffic from the internet by design — a VPN, an email gateway, a remote support server, a firewall management plane. Two of them were exploited for weeks before disclosure, and in two cases attackers specifically worked to defeat the forensic tools defenders rely on. Patching closes the door; it does not tell you who already walked through it.

Meanwhile the application layer keeps producing critical bugs in mainstream frameworks and platforms — Next.js, GitLab, SAP's SDK — and the time from disclosure to automated exploitation keeps shrinking. The practical answer has not changed, only its urgency: know what you expose, patch exposed systems first, and verify exploitability continuously rather than once a quarter.

What to do first: October 9–16 action matrix

Sources and further reading

• Ivanti Connect Secure (CVE-2026-104935) — Rapid7: Ivanti Connect Secure zero-day exploited in the wild
• Cisco Secure Email Gateway (CVE-2026-76519) — Cisco Security Advisory cisco-sa-esa-afw-zqYJkjxp
• BeyondTrust Remote Support (CVE-2026-102764) — BleepingComputer: BeyondTrust patches zero-day exploited since August
• Windows MOTW bypass (CVE-2026-96951) — Help Net Security: October 2026 Patch Tuesday
• PAN-OS (CVE-2026-0322) — Palo Alto Networks security advisory
• AhsayCBS (CVE-2026-105133, CVE-2026-105134) — Ahsay: patch update announcement
• CISA — Known Exploited Vulnerabilities catalog
• Next.js — Next.js security update, October 14, 2026
• GitLab (CVE-2026-97229) — GitLab patch release 19.4.2
• SAP Cloud SDK for Python (CVE-2026-89111) — BleepingComputer: SAP warns of maximum-severity OAuth2 SSRF flaw
• Bricksforge (CVE-2026-85097) — Patchstack: exploited arbitrary file upload in Bricksforge
• SPIP odt2spip (CVE-2026-104085) — VulnCheck: odt2spip authenticated command injection
• AI-driven WordPress exploitation — The Hacker News: SOCRadar campaign report
• Chrome full chain — XBOW: building a Chrome full-chain exploit
• Pwn2Own Ireland final results — BleepingComputer: $1,262,000 for 98 zero-days
• Block bug bounty — Block: our bug bounty program is moving to HackerOne