SolusVM published advisory CVE-2026-105474 (updated 13 October 2026) for a server-side template injection in SolusVM 2, the virtual-server control panel used by many hosting providers. An authenticated user can execute arbitrary code on the server with elevated privileges, which SolusVM says can lead to full compromise of the management node and affect other customers hosted on the same node. Rapid7 records CVSS 4.0 base score 9.4 (Critical) for the issue and describes remote authenticated users reaching root. Affected: all SolusVM 2 builds through 2.0.0-44576. Patched version listed by SolusVM: 2.0.0-44739. The advisory tells operators to update to 2.0.0-44739 or later once that build is available. Credited to Georgii Shutiaev. No in-the-wild exploitation is stated in the vendor note or the Rapid7 entry this pass. Primary: SolusVM support advisory; CVE record published around 15 Oct 2026 per Rapid7.
SolusVM — CVE-2026-105474 Server-Side Template Injection in SolusVM 2 (updated 13 Oct 2026)
CISA published ICS advisory ICSA-26-286-01 on 13 October 2026 for Inductive Automation's Ignition, the SCADA/HMI and industrial application platform. CVE-2026-92817 (CWE-266, incorrect privilege assignment) is in the Perspective module, which does not properly validate session privileges when it decides whether a user has Designer-level access. An authenticated user with access to a Vision project can present their valid Vision session identifier and be granted Designer privileges, then use them to execute arbitrary code in the context of the Ignition Gateway process. Affected: Ignition 8.1.0 through 8.1.54 and 8.3.0 through 8.3.8. CISA scores it CVSS v3.1 8.8 and CVSS v4.0 8.7 and lists Critical Manufacturing, Energy and Information Technology as the sectors where Ignition is deployed. Per CISA, Inductive Automation released version 8.3.9 in August 2025 and version 8.1.55 in September 2026 to fix the issue, and recommends updating to the newest version available. The flaw was reported to Inductive Automation by Tim Hemingway. CISA says no known public exploitation specifically targeting this vulnerability has been reported to it. Because the Gateway runs the plant-facing projects, code execution there can reach connected OT systems, so treat Vision project access as a privileged right until patched. Primary: CISA ICSA-26-286-01; vendor: Inductive Automation Trust Center bulletin (its page sits behind a browser check and could not be read for this card); CVE record published 13 October.
CISA — ICSA-26-286-01: Inductive Automation Ignition Software (13 Oct 2026)
Adobe published security bulletin APSB26-152 for Adobe Experience Manager (AEM), with CVE records released on 13 October 2026, its October Patch Tuesday. CVE-2026-48382 and CVE-2026-48383 are incorrect-authorisation flaws (CWE-863) that Adobe says could result in arbitrary code execution, potentially giving the attacker elevated access or control over a victim's account or session. Adobe scores both 10.0 (CVSS 3.1: network, low complexity, no privileges, no user interaction, scope changed). Affected releases are AEM as a Cloud Service up to 2026.9.28187, AEM 6.5 LTS up to SP3, and AEM 6.5 up to 6.5.25. Fixes are AEM as a Cloud Service 2026.9.28386 and a hotfix for GRANITE-72352 on 6.5 LTS SP1 to SP3 and on AEM 6.5.20 to 6.5.25. Details come from Adobe's own CVE records. No exploitation has been reported. This is separate from the September AEM Forms bulletin (APSB26-151) on this desk. Adobe also released ColdFusion bulletin APSB26-144 the same day, with 31 CVEs including three CVSS 10.0 flaws that need no login; it has its own card: /n/adobe-coldfusion-apsb26-144-cvss10-105899-20261013.
Adobe — APSB26-152 Security update available for Adobe Experience Manager (Oct 2026)
Security researcher wunderwussi (Embrace The Red) published on 13 October 2026 that Microsoft patched CVE-2026-103572, an Important-severity remote code execution issue in the shared Microsoft.VisualStudio.Copilot.Core.dll used by GitHub Copilot in Visual Studio (including Visual Studio 2026 and older Visual Studio 2022 trains) and SQL Server Management Studio. A path-validation check that was meant to block writes to sensitive Copilot settings and MCP configuration files could be bypassed by appending a trailing ASCII period to the filename: Win32 APIs strip the final dot, so a write to settings.json. or .mcp.json. lands on the protected file. That lets the agent escape containment and run arbitrary commands; the report also shows a third party can drive the same outcome through indirect prompt injection. Microsoft classified the issue as Important RCE and shipped the fix with the 13 October updates. Operators who enable Copilot inside Visual Studio or SSMS should apply the October Visual Studio / SSMS Copilot updates promptly and treat untrusted repo content as able to steer agent file writes until patched.
Embrace The Red — Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572, 13 Oct 2026)
Rockwell Automation published security advisory SD1801 on 13 October 2026 for the 1732E ArmorBlock I/O, an on-machine EtherNet/IP distributed I/O module with a built-in configuration web server. CVE-2026-12655 (CWE-294, authentication bypass by capture-replay) lets an unauthenticated attacker change the device's web server password without valid credentials, which can mean admin account takeover or unauthorised configuration changes. CVE-2026-12656 is a denial-of-service issue: network storm traffic can interrupt communication, fault the device and affect open TCP and UDP ports, and a power cycle is needed to recover. Rockwell lists both as corrected with no workaround and not on the CISA KEV list; the advisory's overall severity is High. No exploitation is reported.
Schneider Electric published security notification SEVD-2026-286-01 on 13 October 2026 for its Pro-face STW6000 and Harmony STW6 basic web HMI panels (Harmony ST6 / Pro-face ST6000 range). CVE-2026-96434 is CWE-1104 (use of unmaintained third-party components): Schneider says failure to apply the listed mitigations may allow various attack scenarios from third-party component obsolescence, including unauthorised control of the device and operational failures, when a user visits malicious web pages for browsing. CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); CVSS 4.0 base is 8.6. All versions of both products are listed as known affected. The advisory does not publish a fixed firmware build for this CVE; remediations are mitigations — run the HMI only in a protected environment, minimise network exposure and keep panels off the internet, plus Schneider's standard ICS hygiene guidance. A second same-day notice, SEVD-2026-286-02, covers SAGE RTU CVE-2026-102250 (CVSS 7.2, privileges required high) with a firmware fix in C3414-500-S02L0. No exploitation is stated. Primary: Schneider Electric SEVD-2026-286-01 CSAF/JSON.
Schneider Electric — Security notifications (SEVD-2026-286-01, 13 Oct 2026)
Ivanti disclosed CVE-2026-106042 on 13 October 2026 in Ivanti Xtraction: an external control of file name or path (CWE-73) that lets a remote authenticated attacker redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials the application transmits. OpenCVE and reporting rate it Critical 9.9 (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The Canadian Centre for Cyber Security advisory AV26-1035 lists Ivanti Xtraction 2026.2.1 and prior as affected; public CVE enrichment marks 2026.4 as unaffected. Ivanti's October security update points customers to the Xtraction multiple-CVE advisory and says it is not aware of exploitation for these product fixes. EPMM connector credentials are high value for mobile-device management integrations, so treat this as a credential-exposure priority alongside rotating any EPMM secrets after upgrade. Separate from the Connect Secure zero-day chain. Primary: Ivanti Xtraction multiple-CVE advisory; secondary: CCC AV26-1035 / OpenCVE.
Ivanti — Security Advisory Ivanti Xtraction (Multiple CVEs) October 2026
Ivanti's 13 October 2026 security update discloses CVE-2026-109412 in Ivanti Neurons Patch for Intune, a cloud service that publishes patches into Microsoft Intune. The CVE record describes an exposed dangerous endpoint (CWE-749) that lets a remote authenticated attacker leak sensitive authentication information. Ivanti rates it Critical 9.9 (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Environments using versions prior to the 16 September 2026 server-side fix are listed as affected; Ivanti states the cloud service was fixed for all environments on that date, so no customer software update is required. Out of caution Ivanti recommends rotating the Microsoft Entra ID app-registration client secret used for Intune publication. Ivanti says it is not aware of exploitation. This is separate from the Connect Secure zero-day (CVE-2026-104935) disclosed the same day. Primary: Ivanti Neurons Patch for Intune security advisory; secondary: Canadian Centre for Cyber Security AV26-1035 and CVE record.
Ivanti — Security Advisory Ivanti Neurons Patch for Intune October 2026 (CVE-2026-109412)
The Xen Project published eight security advisories on 13 October 2026 (12:00 UTC). The most serious for shared hosting is XSA-517 (CVE-2026-79610): a race in grant-table version changes lets an unprivileged x86 guest that can use grant table v2 and has more than one vCPU possibly escalate to host privileges, leak information or crash the host; every Xen release from 4.0 onward is affected. XSA-516 (CVE-2026-79609) is a page-table isolation (XPTI) flaw that lets a 64-bit PV guest escalate to the host, but only on x86 hosts with RAM above the 5 TiB boundary (3.5 TiB with CONFIG_BIGMEM). XSA-515 (CVE-2026-79608) says a rework of the Zenbleed workaround left it ineffective on AMD Zen 2 CPUs, so code can read data from other contexts on the same core, such as AES-NI key material and memcpy contents; it affects Xen 4.19.4 and later, 4.20.3 and later, 4.21.1 and later and 4.22, and only systems still running pre-Zenbleed (2023) microcode. XSA-519 (CVE-2026-102699 and CVE-2026-102702) lets a malicious guest on Arm crash the hypervisor or corrupt another domain's memory through GNTTABOP_cache_flush, with privilege escalation not ruled out and no mitigation, on Xen 4.5 onward. XSA-521 (CVE-2026-102701) is a missing bounds check in tapdisk, the userspace block backend used by the XAPI toolstack, which a malicious guest can use to overflow the stack and possibly run code as root. The rest are denial-of-service issues: XSA-514 (CVE-2026-79607) crashes C xenstored during a Xenstore live update on Xen 4.22, XSA-518 (CVE-2026-79611) lets HVM or PVH guest userspace crash its own guest on Intel VMX hosts, and XSA-520 (CVE-2026-102700) leaks page references through x86 cache-flush handling on Xen 4.5 to 4.20. The Xen Project does not assign CVSS scores and reports no exploitation. Primary: Xen Project security advisories.
Xen Project — Security advisories XSA-514 to XSA-521 (13 Oct 2026)
Mozilla released Firefox 158 on 13 October 2026 with advisory MFSA 2026-106, which lists 77 CVEs: 30 rated high, 33 moderate and 14 low. Mozilla now issues a separate CVE for every internally found memory safety bug instead of rolling them into one, which is why the count is large. High-rated issues include a privilege escalation in the Application Update component (CVE-2026-109704), several sandbox escapes in the Networking component (CVE-2026-109705, CVE-2026-109707, CVE-2026-109708), a sandbox escape through uninitialised memory in Graphics (CVE-2026-109712), a sandbox information disclosure and privilege escalation (CVE-2026-109709), and many use-after-free bugs across IndexedDB, DOM, SVG, XML, canvas and media code. Amy Burnett of OpenAI reported ten of the high-rated bugs, mostly JavaScript engine and JIT boundary and miscompilation issues (for example CVE-2026-109715, CVE-2026-109720 and CVE-2026-109722). The advisory does not say any are exploited in the wild. The same day Mozilla published fixes for Firefox ESR 153.5 (MFSA 2026-108), Firefox ESR 115.43 (MFSA 2026-107), Thunderbird 158 (MFSA 2026-109) and Thunderbird 153.5 (MFSA 2026-110). Primary: Mozilla security advisories.
Mozilla — MFSA 2026-106 Security Vulnerabilities fixed in Firefox 158 (13 Oct 2026)
Google moved Chrome's desktop Stable channel to 155.0.8059.79/.80 for Windows and Mac and 155.0.8059.79 for Linux on 13 October 2026 (US time), rolling out over the coming days and weeks. The release carries 37 security fixes: seven rated critical, 29 high and one medium. The critical ones are a buffer overflow in the ANGLE graphics layer (CVE-2026-110152, reported by Zhenpeng (Leo) Lin of depthfirst) and use-after-free bugs in Browser (CVE-2026-110149), PDF (CVE-2026-110136), Network (CVE-2026-110161), Core (CVE-2026-110165), SVG (CVE-2026-110148) and Media (CVE-2026-110151). High-rated fixes include a V8 type confusion (CVE-2026-110140), V8 use-after-free bugs (CVE-2026-110168 and CVE-2026-110169, the second reported by Xinyang Ge of Anthropic with help from Claude), a privilege elevation in the installer (CVE-2026-110150), incorrect authorisation in the updater and Mojo, and several Passwords bugs including an information leak (CVE-2026-110146). Many of the bugs were reported by Xinyang Ge. Google's post does not say any of them are being exploited. The Extended Stable channel moved to 152.0.7977.167 for Windows and Mac the same day with 28 of the fixes, including the PDF, Network and SVG critical bugs. Chromium-based browsers such as Microsoft Edge, Brave and Opera take these fixes in their own releases. Primary: Chrome Releases blog.
Chrome Releases — Stable Channel Update for Desktop, 155.0.8059.79/.80 (13 Oct 2026)
CISA published ICS advisory ICSA-26-286-02 on 13 October 2026 for the Swann Communications SWIFI-SE2KIC, a product of the Australian-headquartered security camera maker. Firmware 2.0.22 and earlier has three missing-authentication flaws (CWE-306). CVE-2026-107605 lets an attacker on the local network view the live video feed without logging in; CVE-2026-107606 lets them retrieve a snapshot of the live feed; and CVE-2026-107607 lets them open a real-time video stream. CISA scores them 6.2 (CVSS 3.1, Medium) and 5.9 to 6.9 (CVSS 4.0). CISA says the flaws are not exploitable remotely and no public exploitation has been reported. The advisory lists no fixed firmware. Swann's interim advice is to keep the camera behind a secured router and firewall, never expose its RTSP service to the internet through port forwarding, DMZ or a public IP, use strong unique router and account passwords, and install firmware updates when they arrive. Elliott Phillips reported the flaws. CISA lists the products as deployed worldwide in commercial facilities; Swann cameras are also common in Australian homes and small businesses.
