Progress published CVE records on 14 October 2026 for at least 11 vulnerabilities in MOVEit Transfer, its managed file transfer server, all fixed in MOVEit Transfer 2025.1.6 and 2026.0.4 and referenced to Progress's MOVEit Transfer Critical Security Bulletin (September 2026). The highest-rated are CVE-2026-89067, an authentication bypass through an alternate path in Secure Messaging (CVSS 3.1 8.8, low-privileged network attacker; credited to Leo Oliver), and CVE-2026-87093, a service directory writable by local users that allows local privilege escalation (8.8). Several more weaken sign-in: CVE-2026-89068, a missing step in LDAP sign-on authentication (8.1, no privileges needed but high complexity); CVE-2026-89074, an email MFA bypass through unicode handling (7.5); CVE-2026-89070, OIDC authentication replay (7.5); CVE-2026-89073, an OAuth access-restriction bypass through weak session expiry (7.5); CVE-2026-89071, LDAP injection in certificate-based authentication (7.5); CVE-2026-89072, an authorisation flaw in client-certificate management (7.5); and CVE-2026-89077, an identity-validation flaw in SFTP authentication (7.5). The set also includes SQL injection in Custom Reports for admins (CVE-2026-89076, 7.2) and local disclosure of session information (CVE-2026-89075, 7.3). The CVE records do not report exploitation. MOVEit Transfer matters for Australian organisations because internet-facing MOVEit servers were mass-exploited by the Clop gang in 2023 (CVE-2023-34362).
Progress — MOVEit Transfer Critical Security Bulletin, September 2026 (CVE records published 14 Oct 2026)
Juniper Networks published its October 2026 Junos OS and Junos OS Evolved security advisories on 14 October 2026, with CVE records for at least 16 issues. The most serious are in J-Web, the built-in web management interface. CVE-2026-101956 (JSA112188) lets an unauthenticated remote attacker run arbitrary Junos commands with root privileges through an exposed J-Web interface. CVE-2026-101986 (JSA112187) bypasses J-Web authentication to run CGI content with elevated privileges using a crafted HTTP request. CVE-2026-101983 is a stack buffer overflow in httpd that an unauthenticated attacker can reach when a J-Web virtual-domain is configured. Juniper rates all three 9.8 (CVSS 3.1) and 9.3 (CVSS 4.0). Other bugs rated 9.8 are CVE-2026-33792, a stack overflow in srxpfe on SRX Series triggered by a crafted packet on a configured GRE tunnel (JSA112186); CVE-2026-102182 in kmd on MX Series via certificate-based IKE packets (JSA112196); and CVE-2026-33789 and CVE-2026-33796 in rpd when BGP Monitoring Protocol (BMP) is enabled (JSA112187). The release also fixes an SRX ADVPN peer-message overflow (CVE-2026-102084), an SRX Security Intelligence feed format-string bug (CVE-2026-102062), an authd overflow reachable with SNMP read access when SNMP and AAA are on (CVE-2026-101979), and a PTX zero-touch provisioning DHCP command injection (CVE-2026-101967), among others. Juniper SIRT says it is not aware of malicious exploitation, and lists no workarounds for the J-Web, GRE and IKE issues. Primary: Juniper's JSA advisories and Juniper-issued CVE records. UPDATE 19 October 2026: Singapore's Cyber Security Agency (alert AL-2026-146, 19 Oct) and Belgium's CCB (16 Oct) have issued patch-now warnings for the same release, and both list further 9.8-rated bugs that Juniper's CVE records (all referencing JSA112187) confirm: CVE-2026-101954, a fourth unauthenticated J-Web flaw, in J-Web and its NETCONF session handling, that gives root-level configuration access and full device takeover when web management is reachable (Junos OS 25.2, 25.4 and 26.2 trains and matching Evolved releases); CVE-2026-102178, a stack overflow in the BGP daemon triggered by flowspec route re-advertisement from a configured flowspec peer when BGP update-threading is enabled; CVE-2026-101990, an rpd stack overflow from a flow-spec update selected for re-advertisement (code execution on Junos OS, crash on Evolved); CVE-2026-101982, an rpd stack overflow from EVPN-VPWS route advertisements by a configured BGP/EVPN peer (root code execution on Junos OS); and CVE-2026-102175, a heap overflow in the sdxd service-deployment daemon reachable by an attacker who controls or intercepts the configured SDX/SRC server connection. All are rated 9.8 (CVSS 3.1) and 9.3 (CVSS 4.0) by Juniper and are fixed in the same releases as the J-Web bugs. Still no reported exploitation.
Noma Labs published SneakPeek on 14 October 2026, an exploit chain in the preview pane of Claude Code Desktop, the desktop app's coding interface. When Claude reads or edits an HTML file, the pane renders it automatically. Files under 256 KB load as data: URLs with a Content Security Policy that blocks scripts. Files over 256 KB were written to a temporary file and loaded from file://, where the CSP was not applied. The request filter meant to stop local file reads only worked when the pane was proxying a dev server, not when rendering a static file from disk. Noma's proof of concept hid a payload in an oversized test-coverage report in a public repo. Once the victim cloned it and asked Claude to look at the report, the script read SSH private keys, AWS keys, npm and GitHub tokens, Kubernetes and Docker credentials, Git tokens and Claude's own OAuth tokens. It then sent them out with navigator.sendBeacon, and could leak the user's real IP address through WebRTC, with no permission prompt. Noma reported it on 4 July 2026. Anthropic scored it 8.7 (CVSS 4.0, high) and treated it as equivalent to code execution on the host. Its first patch blocked file:// fetches from the page, but Noma bypassed that with a Web Worker created from a blob: URL. Anthropic then shipped a complete fix in Claude Desktop 1.30096.1 (17 August 2026), delivered by auto-update. Noma says a GitHub advisory and CVE are still pending. No in-the-wild exploitation is reported. Separate from the Claude Code plugin SHA-pin bypass (CVE-2026-86063) on this desk.
Noma Labs — SneakPeek: How the Preview Pane in Claude Code Desktop Can Exfiltrate Your Data (14 Oct 2026)
OpenVPN's CNA published CVE-2026-84471 on 14 October 2026 (CVE record datePublished 14:29 UTC). The community security announcement describes a possible double-free of a TLS session buffer in the lame-duck path because the guard in check_session_buf_not_used() was incomplete, extending the earlier work on CVE-2026-13117. The CVE description (also from OpenVPN) frames it as an incomplete fix for the related CVE-2026-12996 use-after-free and says a remote authenticated peer can cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry (CWE-416). OpenVPN rates it CVSS 4.0 7.2 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H). Affected lines in the CVE record are OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7; the vendor announcement says 2.6.0–2.6.22 and 2.7_alpha1–2.7.6 are affected and lists fixed builds 2.6.23 and 2.7.7. GitHub release notes for openvpn 2.6.23 (23 September 2026) explicitly credit the improved check_session_buf_not_used() / double-free lame-duck fix as CVE-2026-84471. No public exploitation is reported. Related earlier TLS-session memory issues on the same code path include CVE-2026-12996 (fixed in 2.6.21 / 2.7.5) and CVE-2026-13117.
OpenVPN community — CVE-2026-84471 security announcement (possible double-free in check_session_buf_not_used() lame duck handling; fixed 2.6.23 / 2.7.7)
nginx.org released nginx 1.30.6 (stable) and 1.31.7 (mainline) on 14 October 2026 with fixes for five vulnerabilities, and F5 published matching advisories and CVE records the same day. The three most serious hit the NGINX data plane and are rated High 8.1 (CVSS 3.1) and Critical 9.2 (CVSS 4.0) by F5: CVE-2026-97205, a use-after-free in ngx_http_core_module when asynchronous file I/O (AIO) is on and a Server Side Includes page uses an include virtual command; CVE-2026-93479, a heap buffer overflow when map regex capture variables are evaluated in a root directive or access-log format before the map's own variable; and CVE-2026-15176, a heap buffer overflow when a location combines alias with rewrite and a set or return that references $request_filename (or $request_filename appears in a log_format). A remote unauthenticated request can crash and restart workers; F5 says code execution is possible only if ASLR is disabled or bypassed, and each bug needs a specific configuration. The same release also fixes CVE-2026-95101, HTTP/3 request body injection (F5 CVSS 5.3 / 6.9), and CVE-2026-97629, session forgery when TLS session ticket keys are rotated (6.5 / 8.3). nginx.org itself grades all five medium. NGINX Plus 37.x, NGINX Instance Manager, F5 WAF for NGINX, NGINX Gateway Fabric and some NGINX Ingress Controller releases are also affected; Plus R35 and R36 get no fix. No exploitation has been reported. Separate from the October nginx-ui card on this desk (a different project).
nginx.org — nginx security advisories (CVE-2026-15176, -93479, -95101, -97629, -97205; not vulnerable 1.31.7+, 1.30.6+; 14 Oct 2026)
Ahsay AhsayCBS Command Injection Vulnerability. Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
Ahsay AhsayCBS Improper Authentication Vulnerability. Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
Collabora published GHSA-g3vx-3m76-fghh on 14 October 2026 for CVE-2026-110447 in the optional Nextcloud app Collabora Online - Built-in CODE Server (package richdocumentscode). When the local CODE process is not running (restart, upgrade, or crash), an unauthenticated HTTP request can inject OS commands through proxy.php because request path text was placed inside a double-quoted bash command up to 26.4.302. Attackers used that window to plant web shells; admins reported first hits from 10 September 2026, with request markers such as %2e%2e, $(, ${IFS}, and base64 -d piped to sh. Collabora rates it Critical (CVSS 4.0 9.2), fixed the bug in 26.4.303 on 11 September, and warns that disabling the app is not enough — it must be upgraded to ≥ 26.4.303 or removed. Standalone Collabora Online servers are not affected; installs that use only the Nextcloud Office app (richdocuments) against an external Collabora server are not affected. Fixed builds need Nextcloud 30 or later; EOL Nextcloud ≤ 29 still receive an affected app-store build and should upgrade Nextcloud or remove the app. This path is separate from CVE-2025-66208 in the same script. UPDATE (24 Oct 2026): CISA added CVE-2026-110447 ('Collabora Online – Built-in CODE Server OS Command Injection Vulnerability') to its Known Exploited Vulnerabilities catalog on 23 October 2026, with a remediation due date of 26 October 2026 for US federal civilian agencies and forensic triage required. (source: CISA KEV)
Collabora GHSA-g3vx-3m76-fghh — Unauthenticated OS command injection in richdocumentscode proxy (CVE-2026-110447, 14 Oct 2026)
Cisco published cisco-sa-esa-afw-zqYJkjxp on 14 October 2026 for CVE-2026-76519 (CWE-23) in the Advanced Malware Protection File Reputation path of Cisco Secure Email Gateway (physical and virtual). An unauthenticated remote attacker can send a crafted attachment through an affected gateway and, when File Reputation is enabled on a mail policy and Content Scanner Tools is older than 25.3.0.5525, write arbitrary files and execute commands as root on the underlying AsyncOS host. Cisco rates it Critical (CVSS 3.1 9.8) with no workarounds, says its PSIRT became aware of active exploitation in October 2026, and notes the issue was found in internal scanning. Fixed builds include AsyncOS 15.5.5-014 and 16.5.0-780; the Content Scanner Tools package 25.3.0.5525 or later also delivers the fix without a full software upgrade or restart. Admins should check contentscannerstatus, grep system_logs for "System Security" compromise indicators, and cross-check firewall and network logs because root access can erase evidence. Secure Email and Web Manager and Secure Web Appliance are not affected. This is a separate actively exploited SEG flaw from September's CVE-2026-76461 SQL injection (already on the desk and in CISA KEV). CISA also added CVE-2026-76519 itself to the Known Exploited Vulnerabilities catalog on 14 October 2026 with a 17 October due date for US federal agencies. Wires on 14–15 Oct: BleepingComputer and The Hacker News.
Palo Alto Networks published CVE-2026-0322 on 14 October 2026 (16:00 UTC; 15 Oct 00:00 Perth). A code-injection flaw (CWE-94) in the PAN-OS management interface lets an authenticated attacker with network access run arbitrary code as root on the firewall. It affects PAN-OS on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series); Cloud NGFW and Prisma Access are not affected, and no special configuration is needed to be exposed. Palo Alto rates it HIGH with suggested urgency HIGHEST, Exploit Maturity ATTACKED, and says very limited exploitation has been observed targeting the management interface. The advisory lists three IP addresses tied to the activity and limited exploit attempts: 66[.]42[.]72[.]14, 208[.]83[.]239[.]114 and 149[.]248[.]47[.]234. There is no workaround; Threat Prevention Threat IDs 510046 and 510047 (content 9159-10287 and later) give only limited coverage and need management traffic routed through a data-plane interface with SSL decryption. Risk is highest where the management interface is reachable from the internet. The same 14 Oct bulletin also carries lower-rated PAN-OS, GlobalProtect app, Cortex XSOAR and Checkov fixes, listed separately on the Palo Alto advisory site. CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog on 14 October 2026 with a 17 October due date for US federal agencies (BOD 26-04). Wire: The Hacker News (15 Oct).
Palo Alto Networks — CVE-2026-0322 PAN-OS: Authenticated RCE in the Management Interface (14 Oct 2026)
On 14 October 2026 Microsoft's Digital Crimes Unit, with Health-ISAC, said a US District Court for the Southern District of Florida order let them seize and redirect domains powering YAM Store (Storm-3119), CoGUI and Iron Man (Storm-2990 phishing kits) — a Chinese-language cybercrime marketplace that sold compromised or fraudulently obtained Microsoft and Google environments, accounts, licences and storage, plus ready-made phishing kits. Since January 2026 the three services enabled more than one billion malicious messages targeting over 75,000 organisations and consumers in more than 150 countries, including more than 750 million messages aimed at Microsoft customers, generating tens of millions of dollars for operators. Microsoft has disabled more than 20,000 accounts tied to YAM Store and is blocking more than 100,000 impersonation domains. The investigation began in late 2025 after Japan's National Police Agency flagged campaigns against Japanese victims; JC3, Resecurity, Cloudflare, Oracle, Proofpoint, TRM Labs and US/international law enforcement later joined. YAM Store acted as an access broker: operators bought expired organisation domains (often non-profit and education), rebuilt sites to look live, fraudulently obtained Microsoft 365 tenants, and resold them; AI tools were also used to invent fake organisations. Iron Man (advertised on YAM Store from June 2026) overtook CoGUI with more than 2,300 lure templates across 130+ countries/areas — Microsoft and Resecurity both cite Australia Post package-delivery SMS templates among the samples, alongside ANZ rewards web lures in Microsoft's illustration set. Kits support device-code phishing, geofencing, fake CAPTCHA and live OTP capture. Primary: Microsoft DCU blog 14 Oct; wire: BleepingComputer.
Microsoft Digital Crimes Unit — Disrupting the service economy behind transnational cybercrime operations (14 Oct 2026)
ThreatFabric's Mobile Threat Intelligence team published Hirudo on 14 October 2026: a new Android banking remote-access trojan that combines on-device credential theft with live remote control. Victims first install a functional lure (Shopora shopping, 1V1 X adult video, or ZoyaTV/KoiShort short drama) served via Amazon CloudFront with OpenInstall attribution and Meta Pixel IDs; some download routes were still live in October 2026. The lure shows a fake in-app update, installs a separate Hirudo payload, and may briefly raise a blackhole VPN during install. Once Accessibility and notification access are granted, Hirudo can steal banking passwords, payment PINs, device-unlock secrets and SMS, stream the screen, and use both cameras. What sets it apart from overlay bankers is app replacement: for eight Indonesian banking apps across seven banks it uninstalls the genuine app and installs a purpose-built patched copy that keeps almost all of the bank's code but injects a YAHFA/Dobby hooking engine. The engine substitutes the genuine signing certificate, hides Accessibility services, strips FLAG_SECURE, re-signs key-attestation with a publicly leaked keybox (at least two certificates already on Google's revocation list), and relays Play Integrity requests to an operator server. Credential targets named in code also span China, India, Mexico, Morocco and Thailand; the fake checkout carries Malaysian bank and wallet branding. An unsecured backend panel captured in August 2026 exposed thousands of credential and device records. Victim count is unknown; no Australia-specific targeting is stated. Primary: ThreatFabric; wire: BleepingComputer.
ThreatFabric — Hirudo: From Fake Updates to Patched Banking Apps (14 Oct 2026)
