Technical depth on vulnerability management, AI-powered remediation, and TRIS™ scoring. Written by practitioners, for practitioners.
Six CVEs from October 14 to October 28, 2026: BeyondTrust and Ivanti were exploited before disclosure, while three 9.2 scored flaws in PHP and Node.js have no confirmed exploitation.
When a remediation team exports the queue to a private spreadsheet, risk decisions move into hallways. Picus measured CVSS flagging 63 percent of one customer's findings as critical against 9 percent validated, and the 2026 DBIR found only 26 percent of KEV entries fully remediated. Trust is an output of six design choices. A trust ledger, four ways to read it without a survey, and a rebuild that starts by shipping less work.
Joint advisory AA26-293A names SafePay among the most active crews of 2026, roughly 600 victims since August 2024. The signature move goes past deleting shadow copies: using credentials disclosed by CVE-2023-27532, it signs into the backup NAS management plane and factory-resets the appliance before encryption, so the clean restore is gone first. The five KEV CVEs, TRIS exposure scoring, and what to hunt this week.
On October 22, 2026, Arista disclosed CVE-2026-114625 in on-prem VeloCloud Orchestrator, scored CVSS 9.9. A signed-in Enterprise Read Only session shapes a SQL fragment the backend concatenates into a query against operator records, grafting an operator superuser identity onto the request. CISA added it to KEV on October 23 with a federal deadline of October 26. Mechanism, TRIS layer walk, and the fix today.
For about 100 minutes on October 21, 2026, the BerriAI release pipeline published litellm 1.107.0 to PyPI and tagged four Docker images carrying cook.pth, cook.py, and sitecustomize.py. The three files land in site-packages beside the package, run on every interpreter start, exfiltrate cloud and AI credentials to litellm[.]dev/healthcheck, and never need anyone to import litellm. No CVE. Mechanism, TRIS layer walk, and the clean rebuild sequence.
On April 15, 2026 NIST moved about 29,000 CVEs to Not Scheduled and narrowed enrichment to KEV, federal, and EO 14028 critical software. CPE is the quiet casualty. ENISA's EUVD went live in May 2025 and the Cyber Resilience Act starts reporting through ENISA on September 11, 2026, so programs with EU exposure now carry three identifier databases. An architecture piece on alias sets, precedence policy, and the local mirror.
An improper origin validation flaw in a Remote Support messaging component lets an unauthenticated attacker write files to the appliance web root. ARMORY CASTLE used it from August 29 to drop a SAWFLY webshell, SUID a copy of /bin/sh at /usr/bin/dbus-authd, dump the appliance vault, and tunnel SOCKS5 through haproxy. CISA added it to KEV on October 16 with a federal deadline of October 19. Mechanism, TRIS layer walk, and a hunt-first remediation sequence.
Six supply-chain CVEs cleared the bar to chart over the last two weeks, all on internet-facing products from Fortinet, Cisco, Citrix, and Palo Alto, and every one was confirmed under active exploitation.
Every security maturity model, from CMMI to OWASP SAMM, grades a program on which practices it has adopted. The 2026 Verizon DBIR shows 26 percent of surveyed organisations fully remediated CISA KEV, down from 38 percent, and all of them own vulnerability-management tools. OMB M-26-14 pointed at the better shape, measured coverage gated by level and a rating that respects the weakest element. Five rungs with an evidence test for each.
Court filings unsealed October 8, 2026 describe Integrity Technology Group pointing a scanner called MicroScan at victim networks from a botnet of infected consumer devices, with the scan results handed to separate operators. CISA added five aging flaws to KEV with an October 11 deadline. Why distributed recon defeats scan detection and age-decay triage, the mechanism, a TRIS layer walk, and host artifacts to hunt today.
Attackers began chaining two AhsayCBS zero-days on October 7, 2026 to drop JSP webshells and XMRig miners disguised as Microsoft Edge on MSP backup consoles. The chain is unauthenticated SYSTEM-level RCE through a single HTTP parameter named random, reused across the auth and command-injection paths. Ahsay version 10.3.4.0 does not fix either CVE. Mechanism, MSP multiplier, TRIS layer walk, and a mitigation-first remediation sequence.
A compromised maintainer identity shipped tensorlake 0.5.144 to npm on October 8, 2026 with a preinstall hook that downloaded the Bun runtime and ran a 856 KB obfuscated credential worm under it. No CVE. The Sigstore attestation was valid. The dead-man's switch deletes your home directory if you revoke the stolen GitHub token first. Mechanism, TRIS layer walk, and the kill-the-monitor-first remediation sequence.
CVE arrivals grew 263 percent against 2020 and remediation service rate stayed roughly flat, so most programs are now running a queue above capacity. Little's Law, Kingman's formula, and Reinertsen's cost of delay explain why prioritisation alone cannot clear the pile. The three structural levers, the Kingman cliff, and six weekly questions a program should actually report.
An unattributed cluster is mass-exploiting Citrix NetScaler CVE-2026-88771 and CVE-2026-88772. A rejected management login writes a command into the appliance audit log, and a root telemetry worker that Citrix enables by default executes it minutes later, so there is no suspicious response to alert on. Mechanism, the TRIS layer walk, the handler map hunt, and what to rotate.
CVE-2026-104286 is a CVSS 9.8 pre-auth path traversal in FortiMail's Identity-Based Encryption module. One HTTP request with a null byte lets the extension check see dot cgi while the write resolves to slash data slash bin slash webconsole, and the webshell runs. Fortinet FG-IR-26-175, CISA KEV October 1, no patch at disclosure. Mechanism, TRIS layer walk, mitigation, and the three hunt artifacts.
CVE-2026-76504 is a CVSS 9.8 authentication bypass in Catalyst SD-WAN Manager. A single hex-encoded character in the j_security_check path slips past the auth filter and lands on the admin API. Cisco PSIRT confirms active exploitation; CISA added it to KEV on September 30, 2026 with a federal deadline of October 3. Mechanism, TRIS scoring, and remediation.
IR tabletops rehearse breaches. Vulnerability teams rarely rehearse the day a vendor advisory hits a program that cannot yet answer whether it even runs the affected product. A framework with four capability tests, an inject set that bites, scoring that converts gaps into dated backlog, and a composite scenario you can run tomorrow, grounded in CISA CTEP and NIST SP 800-84.
Seven critical CVEs charted from two weeks of CVEasy AI threat-intel, all under active exploitation, with edge and security appliances from Cisco, F5, Check Point, and Citrix leading the list.
Anthropic's official MCP Python SDK (mcp 1.9.1 through 1.29.1 and 2.0.0 through 2.1.1) let a malicious MCP server publish a metadata document that reroutes the client's OAuth handshake to attacker infrastructure, capturing the client secret, authorization code, and PKCE code_verifier. CVSS 7.5, no CVE assigned, fixed in 1.30.0 and 2.2.0. Mechanism, TRIS layer walk, and the issuer= argument the version bump alone will miss.
CVE-2026-88771 is a CWE-20 improper input validation RCE that hits every NetScaler ADC and Gateway on affected builds including the default configuration. CVE-2026-88772 is a memory overflow reachable over DTLS on UDP/443, on by default on every VPN virtual server. Both scored CVSS 9.5, both exploited before the CTX697096 patch shipped, both on CISA KEV with a federal deadline of September 30, 2026. Mechanism, TRIS layer walk, patch, rotate, and hunt checklist.
A fixed 0x4100 byte heap buffer in the BIG-IP APM OAuth UserInfo handler copies an attacker controlled Authorization header without a length check, overwrites a neighbouring callback pointer, and yields unauthenticated remote code execution inside TMM on any virtual server acting as an OAuth Authorization Server. F5 confirmed exploitation before publishing K000162605. CISA added the CVE to KEV September 22 with a federal deadline of September 25, 2026.
The EU CRA's 24-hour clock went live September 11, 2026, the SEC's Item 1.05 wants four business days, and BOD 26-04 wants risk-tiered remediation on file by December 7. Design evidence as an append-only stream of state-transition events on every finding, keyed to the asset, so one archive answers audit, incident retrospective, and regulatory filing without manual archaeology across ticket comments.
Between September 18 and 22, 2026, CISA added CVE-2025-39682 (kTLS), CVE-2026-53266 (ebtables SNAT), and CVE-2025-39964 (AF_ALG) to KEV with three day patch deadlines under BOD 26-04. Red Hat asserts active exploitation for each, and STAR Labs demonstrated the AF_ALG race as a container escape at Google's kernelCTF. Root cause on each primitive, why CVSS sorts the queue wrong, a four layer TRIS walk, and the patch, hunt, and rotate order.
Sygnia says Fire Ant's tac_plus library-injection technique has not been publicly described before. TacTap hooks accept and accept4 inside the running TACACS+ daemon and copies every device credential on its way through, while the binary on disk stays clean and file integrity monitoring reports green. Mechanism, hunting queries, TRIS scoring, and remediation for CVE-2026-20079.
Vulnerability programs run on a one-way SLA that IT never signed. This is the bilateral Operational Level Agreement version, with concrete clauses on both sides, a false-positive clause, a renegotiation trigger tied to measured MTTR, and a breach path that runs in both directions. Grounded in ITIL, SRE error budgets, BOD 26-04 and the 2026 DBIR and Edgescan numbers.
CrowdSec disclosed on September 18, 2026 that an attacker cloned about 170 private GitHub repositories four months earlier, using a gho_ OAuth token stolen from a former employee's laptop through the May 11 @tanstack npm compromise tracked as CVE-2026-45321. Mechanism from the pull_request_target cache poison to the OAuth clone, why a CVSS-first queue reads this as a closed package finding, four TRIS layers that separate the CVE from the incident, and a rotate-and-hunt list keyed to the developer identity graph.
CVE-2026-76460 is a CVSS 10.0 authentication bypass on a Cisco ISE API endpoint that lets an unauthenticated attacker walk past the login page into the admin console and chain to OS command execution as root on the identity plane. Cisco confirmed in-the-wild exploitation before the advisory shipped and CISA set a September 19 federal deadline. The primitive, why a CVSS-first queue mis-ranks it, four TRIS layers, and the patch, hunt, rotate order.
Critical-high-medium-low is a sorting habit, not a workflow, and the numbers say it stopped scaling years ago. Five purpose-built queues (needs owner, needs decision, needs fix, needs validation, accepted with control) each with its own entry rule, owner, definition of done, and failure mode. Plus how CISA BOD 26-04 quietly made the same argument at the federal level.
Seven actively exploited supply-chain CVEs from September 2 to 16, 2026, charted by CVSS base score, with most hit before a patch existed.
CVE-2026-76461 is a CVSS 9.8 SQL injection in the email parsing logic of Cisco AsyncOS for Secure Email Gateway that chains from an unauthenticated inbound message to root command execution. Cisco confirmed in-the-wild exploitation before the advisory shipped and CISA set a September 17 federal deadline.
CVE-2025-25249 gives unauthenticated code execution on a FortiGate through the cw_acd CAPWAP daemon, and the PivotC2 implant then drives that same CAPWAP tunneling subsystem as its relay into the internal network, so operator traffic arrives sourced from the trusted firewall.
Most programs process findings once and forget them. BOD 26-04 quietly demands a control loop instead. The four parts of that loop mapped to remediation, where the metaphor breaks against an adversary, the three broken-loop patterns showing up in Verizon DBIR 2026 and Edgescan 2026, and how to instrument loop latency as the metric that ties the whole loop together.
CVE-2026-75650, dubbed StyleSmuggler by Sansec, is a CVSS 10.0 unauthenticated PHP injection in Adobe Commerce 2.4.4 through 2.4.9 and Magento Open Source 2.4.6 through 2.4.9, exploited in the wild from September 4, 2026, three days before the APSB26-146 hotfix.
Vulnerability scoring engines almost never consume control-validation evidence as input. A working definition of defense efficacy, the four kinds of artifact that count, a half-life for freshness, how it moves findings across SLA bands, and the governance rule that keeps downgrades honest.
Microsoft's September 2026 Patch Tuesday shipped two Windows local privilege escalation zero-days already in the wild: CVE-2026-81963, a link-following flaw in the Windows Update Stack, and CVE-2026-85880, a heap-based buffer overflow in Windows ALPC that lets an AppContainer sandbox escape to SYSTEM.
On August 2, 2026, N-able shipped Hotfix 1 for the N-central authentication bypass and Storm-1175 detonated StormEncryptor, a previously undocumented C++ encryptor, on the same calendar day.
CISA's BOD 26-04 made public exposure a required urgency input for federal systems on June 10, 2026. A practitioner definition of reachability across four layers (network, service, code, identity), a cheap approximation for each layer built from tooling most teams already own, the AND rule for composing the four answers, and a ten-item queue re-sorted before and after.
A public PoC for CVE-2026-19490 dropped in early September 2026 and Previdian's sensors logged the first matching requests from six unique IPs on September 3. The bug is a CWE-288 alternate path authentication bypass on NetScaler ADC and Gateway.
CVE-2026-82329 is a CVSS 9.8 authentication bypass in JFrog Access. When no admin ever set a join key, the parser accepts an empty entry and the signing routine PKCS7 pads it to 32 bytes of 0x20. Anyone can then sign a NoAuth join JWT and receive a scope admin service token.
On April 15, 2026 NIST moved 29,000 backlogged CVEs into Not Scheduled and published the criteria for what still gets enrichment. That is the permission structure a private program needs to bring the same move to its auditor.
Seven supply-chain CVEs from the last two weeks of CVEasy threat-intel, plotted by CVSS, showing three perfect 10.0 scores with no reported exploitation while lower-scored flaws were under active attack.
On August 27, 2026 PaperCut disclosed two chained zero-days in NG and MF. CVE-2026-81578 lets an unauthenticated request drive admin components in the web management interface, and CVE-2026-82078 turns a config write into arbitrary Java code via unsafe dynamic class loading.
On April 15, 2026 NIST moved 29,000 backlogged CVEs into Not Scheduled and stopped enriching all but the KEV, federal, and EO 14028 subset. On June 10, CISA BOD 26-04 dropped CVSS as a required federal input.
On August 27, 2026 ServiceNow shipped KB3152242 with three CVSS 10.0 unauthenticated flaws in the AI Platform: CVE-2026-18885 code injection in the GraphQL Composite Data API, CVE-2026-18886 access control gap in the system configuration image upload processor, and CVE-2026-74820 SQL injection through a dynamic schema ORDER BY clause.
CVE-2026-8452 is an unauthenticated heap overflow in NetScaler ADC and Gateway SAML signature canonicalization. An oversized PrefixList in ds:SignedInfo overflows a fixed-size buffer, corrupts an adjacent nsb chunk header, and yields a controlled memcpy that overwrites tx_pkt_complete_fptr inside nsppe running as root.
Assistants moved from experiment to load-bearing part of the SDLC while security controls kept assuming a human wrote every line. The gap is now measurable in Veracode, Spracklen et al, and published enterprise field data: three new surfaces (hallucinated packages in lockfiles, insecure patterns copied at scale, provenance loss), what prior art already covers, and the four pipeline changes to land this quarter.
On Aug 4, 2026 an attacker took over the jaredwray npm account and shipped a self-propagating credential-stealing worm through keyv, cacheable, flat-cache, and seven other caching packages, all with valid Sigstore provenance still validating.
Attackers rewrote 502 git tags across four Composer packages to execute a credential stealer on every composer install. No CVE. Confirmed exploitation.
Traditional scanners struggle with supply chain vulnerabilities. Here's why, and what to do about it.
