CVEasy Weekly

This Week in Exposure

Week 43 · 2026-W43 · October 19 to October 25, 2026

The theme this week is the patch that does not evict. Both lead stories are KEV entries where the vendor fix closes the door but leaves the attacker who already walked through it, and one of them turns on an eleven year old bug a severity queue wrote off years ago.

This week's checklist

1. BeyondTrust Remote Support (CVE-2026-102764, CISA KEV): apply BT26-05-RS, which covers Remote Support 24.3.1 through 26.2.3, and if the appliance faced the internet since August 29, rebuild from a clean 26.2.3 and rotate every credential the vault held.
2. ProFTPD, Struts, ONLYOFFICE, BIND (CVE-2015-3306, CVE-2016-3081, CVE-2021-3199, CVE-2015-5477): move ProFTPD to 1.3.5a, Struts to 2.3.28.1, ONLYOFFICE Document Server to 5.6.3, and apply the BIND release that fixes TKEY handling; take any end-of-life build off the perimeter.
3. Strapi (CVE-2023-22894): upgrade to 4.8.0 and rank it by CISA's 7.2, not NVD's 4.9, because the KEV deadline already passed on October 11.

Top Exposures This Week

1. The BeyondTrust zero-day that patching does not evict

CVE-2026-102764 · BeyondTrust Remote Support 24.3.1 through 26.2.3 · unauthenticated file write chained to root · CISA KEV October 16, federal deadline October 19

Exposed: any Remote Support appliance that answered on its public HTTPS listener between August 29 and the day it was patched.

What happened: an improper origin validation flaw (CWE-290) in an internal messaging component lets an unauthenticated attacker write files into the appliance's own Laravel web root. ARMORY CASTLE, a suspected PRC-nexus actor Mandiant tracks as UNC5221, chained that to a root shell through a SUID binary and read the stored secrets vault, per Google's Threat Intelligence Group. BeyondTrust disclosed BT26-05 on October 15, and CISA added the CVE to KEV on October 16 with a federal deadline of October 19.

Do this:

• Apply BT26-05-RS, which covers Remote Support 24.3.1 through 26.2.3; on an older release, upgrade to 24.3.1 first, then patch.
• Hunt appliance logs from August 29 forward for POSTs to /app_84304470%2Ephp or numeric PHP paths under the public web root, and for mangoapi.php anywhere under laravel/public.
• Verify /usr/bin/dbus-authd is not /bin/sh owned by root with the SUID bit, that /ns/config/sudoers.template holds no passwordless entry for the site service account, and that /ns/config/haproxy.conf has no loopback backend on 127.0.0.1:19800.
• If the appliance was internet-reachable in that window, rotate every credential the vault held and rebuild from a clean 26.2.3 install rather than cleaning in place.

Why it ranks here: confirmed in-the-wild abuse by a named actor, an unauthenticated file write that reaches root in two moves, top exposure band for any internet-facing appliance, and a blast radius that holds every Jump Item and vault secret the box ever authenticated.

Read how the message with no return address reaches root →

2. A CVSS 10 ProFTPD bug from 2015 is back as a primary entry point

CVE-2015-3306 with CVE-2016-3081, CVE-2021-3199 and CVE-2015-5477 · ProFTPD, Apache Struts 2, ONLYOFFICE, ISC BIND 9 · CISA KEV October 8, federal deadline October 11

Exposed: internet-facing ProFTPD 1.3.5 with mod_copy, Apache Struts 2 with Dynamic Method Invocation on, ONLYOFFICE Document Server before 5.6.3, and ISC BIND 9, with end-of-life builds a program stopped tracking years ago at the top of the list.

What happened: court filings unsealed October 8 describe Integrity Technology Group, a sanctioned Beijing contractor behind Flax Typhoon, running a Mirai botnet and its own MicroScan scanner against United States power infrastructure and targets abroad. CISA added five exploited flaws to KEV the same day with a three day deadline; CVE-2015-3306 is the primary entry, an unauthenticated SITE CPFR and SITE CPTO pair that writes a web shell, and it scores CVSS 10.0. Because the scanning ran on consumer devices, the age of a CVE no longer predicts whether an exposed instance gets found.

Do this:

• Move ProFTPD to 1.3.5a or later, or disable mod_copy where you cannot upgrade.
• Upgrade Struts to 2.3.28.1 or turn off Dynamic Method Invocation, move ONLYOFFICE Document Server to 5.6.3, and apply the BIND release that fixes TKEY handling.
• Take any end-of-life build off the perimeter, because it gets no fix.
• Hunt ProFTPD logs for SITE CPFR and SITE CPTO pairs and web roots for small PHP or ASPX files calling eval on a request parameter; a web shell survives the upgrade, so on any hit rotate every credential the host held and rebuild from a known good image.

Why it ranks here: a KEV listing is CISA asserting observed exploitation, the three unauthenticated entry flaws each reach code execution in one step, exposure is top band on anything answering on 21, 80, or 443, and the ProFTPD foothold opens the rest of the host.

Read how reconnaissance ran from people's living rooms →

3. The Strapi flaw a severity-sorted queue files below everything

CVE-2023-22894 · Strapi 3.2.1 through 4.8.0 · unauthenticated credential leak · CISA KEV, NVD 4.9 against CISA ADP 7.2

Exposed: any internet-facing Strapi build from 3.2.1 through 4.8.0, where filtering on private fields hands back password hashes and reset tokens.

What happened: this is the credential-theft flaw in the same Flax Typhoon set, and it is the one a severity-sorted queue buries. NVD scores it 4.9, a medium, while CISA's own ADP enrichment puts it at 7.2, so a queue sorted on NVD files a KEV entry carrying a three day clock below several hundred 7.x findings nobody is exploiting.

Do this:

• Upgrade Strapi to 4.8.0.
• Rank this by CISA's 7.2 and the KEV deadline that passed on October 11, not by NVD's 4.9.
• If an exposed instance ran during the window, treat the stored password hashes and reset tokens as taken and force a reset.

Why it ranks here: CISA asserts active exploitation, the leak needs no authentication, exposure is top band on any public instance, and the stolen hashes and reset tokens become the entry to whatever those accounts protect.

Read why an age-based queue misses this →

Threat actor to watch

Flax Typhoon is a PRC state-linked espionage actor, catalogued by MITRE as G1044 and tracked elsewhere as Ethereal Panda and RedJuliett, that exploits known internet-facing flaws, drops the China Chopper web shell, then lives off the land. The detail the October 8 filings put on record is the division of labor: a sanctioned Beijing contractor, Integrity Technology Group, ran the reconnaissance on a Mirai botnet of home routers and cameras and handed the results to the operators who act on them, which defeats scan detection built on source address, reputation, and geography. Hardening action: aggregate inbound probes by destination port and request path over a six hour window rather than by source address over minutes, because a residential botnet makes source address worthless and that is the dimension nearly every scan-detection rule groups on.

Signed CVEasy threat-intel IOC bundle current as of 2026-10-19. The desktop app verifies the ED25519 signature before import.

Two of this week's three items are KEV entries where the vendor fix is real and still not enough, because an appliance that was reachable while vulnerable keeps the shell, the sudo entry, or the stolen vault after you patch. The number that tells you which box is your emergency is your own exposure crossed with what attackers are doing today, which is the loop our CTEM platform runs with TRIS. Start with BeyondTrust, where the federal deadline was October 19 and a clean rebuild, not a patch alone, is what closes it.

Patch well,
CVEasy Threat Research
Founder, CVEasy AI