vFeed Threat Intelligence Newsletter — October 2026
Welcome to the vFeed October 2026 edition of our Cybersecurity and Vulnerability Newsletter.
Key Highlights During the Month
- CVE Volume at Record Highs: October 2026 recorded 13,077 new CVEs — up 8.9% from September’s 12,007, making this the highest-volume month of the year. At ~422 CVEs per day, the attack surface continues to expand at an unprecedented rate. Year-to-date, vFeed has correlated 36,082 vulnerabilities, tracking 18.4% ahead of the same period in 2025 (30,471).
- Critical Vulnerabilities at 1,064: Critical vulnerabilities (CVSS 9.0+) hit 1,064 in October — the highest monthly critical count observed this year, representing 8.1% of all disclosures. The month recorded 84 perfect 10.0 CVSS scores, spanning Oracle Fusion Middleware, Adobe Experience Manager/Commerce/ColdFusion, Microsoft Azure, Cisco, GitLab, Apache Traffic Server, and a surge of SOHO router firmware (TOTOLINK, Tenda, Wavlink, D-Link, Edimax, Linksys).
- Oracle Critical Patch Update Dominates: Oracle’s October CPU drove at least seven CVSS 10.0 scope-change vulnerabilities across E-Business Suite Workflow (CVE-2026-101809), SOA Suite (CVE-2026-91216/91221/91231), Access Manager (CVE-2026-87337), and JD Edwards EnterpriseOne Orchestrator (CVE-2026-91299) — all unauthenticated, network-exploitable takeover paths.
- Adobe October Advisories Hit Hard: Six CVSS 10.0 disclosures affect Experience Manager (CVE-2026-48382, 48383, 90532), Commerce (CVE-2026-103849), and ColdFusion (CVE-2026-105899, 106622, 106624) — all scope-changing arbitrary code execution issues requiring no user interaction.
- PHP Core Pre-Auth RCE Reaches Near-Certain Exploitation: CVE-2026-109618 and CVE-2026-109619 — both targeting PHP global state and OOM longjmp handling for remote code execution — reached EPSS scores of 0.99999 (99.998th and 99.999th percentile), indicating near-certain active exploitation within 30 days.
Vulnerability Trends in October
| Metric | Jul ’26 | Aug ’26 | Sep ’26 | Oct ’26 | MoM |
|---|---|---|---|---|---|
| New CVEs | 10,842 | 11,456 | 12,007 | 13,077 | ▲ 8.9% |
| Modified CVEs | 3,612 | 3,845 | 3,978 | 4,121 | ▲ 3.6% |
| Critical (CVSS 9.0+) | 782 | 865 | 948 | 1,064 | ▲ 12.2% |
| Perfect 10.0 scores | 51 | 63 | 72 | 84 | ▲ 16.7% |
| CVSS4 scores recorded | 1,842 | 2,117 | 2,386 | 2,718 | ▲ 13.9% |
| EPSS > 50th percentile | 4,215 | 4,588 | 4,834 | 5,247 | ▲ 8.5% |
Three signals stand out this month. First, the volume of perfect 10.0 scores grew 16.7% MoM — far outpacing total CVE growth — driven by Oracle’s quarterly CPU, Adobe’s monthly release, and a flood of scope-changing unauthenticated RCE issues. Second, the critical-to-total ratio climbed to 8.1%, the highest observed this year, suggesting researchers and vendors are increasingly focused on high-impact classes (auth bypass, OS command injection, deserialization). Third, CVSS4 adoption continued its structural climb (+13.9% MoM), now covering roughly one in five new disclosures — a clear signal that vendor CNAs are migrating scoring workflows ahead of NIST’s final CVSS 3.1 sunset.
Vulnerability Landscape
vFeed’s threat intelligence dataset now tracks over 218,400 known exploits reported from sources including GitHub, Metasploit, ExploitDB, and PacketStorm. In October, 1,962 unique CVEs out of 13,077 (~15.0%) were published with one or more exploit proof-of-concepts available.
The top exploit sources for October:
| Exploit Source | Unique CVEs Covered |
|---|---|
| ExploitDB | 487 |
| GitHub PoC | 1,614 |
| Metasploit | 42 |
| Talos | 11 |
| Saint | 6 |
GitHub PoCs remain the dominant exploit publication channel — accounting for more than 82% of this month’s exploit-tagged CVEs — reflecting the continued “disclosure-plus-PoC” cadence used by independent researchers against SOHO/IoT targets. The appearance of a Collabora Online CODE Server OS command injection (CVE-2026-110447) actively exploited in the wild in September–October, combined with the Talos-tracked TOTOLINK X2000R chain, confirms that commodity edge devices and Nextcloud-adjacent self-hosted stacks remain the preferred mass-exploitation surface.
Platform Impacts
Microsoft — 112 CVEs
| Severity | Count |
|---|---|
| Critical | 24 |
| High | 61 |
| Medium | 25 |
| Low | 2 |
October Patch Tuesday (October 14, 2026) delivered a sizable release emphasizing network-reachable code execution and DoS primitives in Windows core networking services. Microsoft also issued coordinated Exchange and Office fixes.
Top Microsoft disclosures this month:
- CVE-2026-96207 (CVSS 10.0) — Microsoft Partner Center improper certificate validation enabling unauthenticated privilege elevation over the network.
- CVE-2026-83938 (CVSS 10.0) — Azure Kubernetes Configuration Service missing authentication for critical function; unauthenticated remote privilege elevation.
- CVE-2026-110063 (CVSS 10.0) — VM Inspector for Azure Virtual Machines link-following vulnerability leading to network-based EoP.
- CVE-2026-97785 (CVSS 10.0) — AAD App Proxy improper authentication, unauthenticated privilege elevation.
- CVE-2026-100219 (CVSS 9.8) — Use-after-free in Microsoft QUIC enabling remote code execution.
- CVE-2026-105016 (CVSS 9.8) — Heap-based buffer overflow in Microsoft QUIC, unauthenticated RCE.
- CVE-2026-70300 / 70291 / 70242 / 97016 / 88156 / 97749 — a cluster of Office Outlook heap overflow, double-free, and untrusted-pointer-dereference RCEs (all CVSS 9.8).
- CVE-2026-70279 (CVSS 9.3) — Exchange Server stored XSS enabling network spoofing.
- CVE-2026-70571 (CVSS 8.1) — Exchange Server stack-based buffer overflow RCE.
Linux Kernel
vFeed tracked 396 Linux kernel CVEs in October. Three named vulnerabilities stood out this month:
| Name | CVE | Subsystem | Type | Key Risk |
|---|---|---|---|---|
| — | CVE-2026-94603 | Podman OCI runtime | Checkpoint annotation bypass | Image-controlled checkpoint silently ignores --cap-drop=ALL, enabling container breakout |
| — | CVE-2026-110264 | GitLab regex compiler (shared with GitLab Rails/Linux hosts) | Integer overflow | Unauthenticated RCE on GitLab server via crafted regex |
| — | CVE-2026-65162 | NVIDIA AIStore for Linux | PodSpec init RCE | Remote attacker supplies host-namespace Kubernetes PodSpec, achieving code execution and EoP |
Linux-adjacent container and orchestration tooling drove this month’s highest-severity ecosystem risk. The Podman checkpoint-annotation issue (CVE-2026-94603, CVSS 10.0) is particularly concerning for multi-tenant runners and CI/CD environments where attacker-supplied images are routinely executed — the vulnerability silently discards the operator’s capability-drop policy. Operators should audit any podman run invocation of untrusted images and upgrade to 5.8.8 or 6.1.3 immediately.
WordPress — Authentication Bypass Dominates
317 CVEs in October, with 188 carrying known exploits — an exploit-to-disclosure ratio of 59.3%. Critical highlights:
- CVE-2026-101148 (CVSS 10.0) — BackupSheep WordPress Backup Plugin ≤ 1.8: unauthenticated full-site backup download including password hashes, plus arbitrary file deletion. Plugin is abandoned since July 2024 — no fix; uninstall immediately.
- CVE-2026-32579 (CVSS 10.0) — Kognetiks Chatbot for WordPress ≤ 2.4.9: unauthenticated arbitrary file upload.
- CVE-2026-39770 / 39773 (CVSS 10.0) — Doctreat ≤ 1.7.0: unauthenticated arbitrary file upload and unauthenticated privilege escalation (sold heavily on ThemeForest).
- CVE-2026-94503 (CVSS 10.0) — PX-lab Zombify ≤ 1.7.7: webshell upload.
- CVE-2026-42696 (CVSS 10.0) — Royal Plugins SiteVault Backup ≤ 1.5.19: remote code injection.
- CVE-2026-94169 (CVSS 10.0, EPSS 0.914) — Theme-one “The Grid” ≤ 2.8.1: command injection.
- CVE-2026-85097 (CVSS 9.8) — Bricksforge ≤ 3.1.8.9: unauthenticated arbitrary file upload with validated-path-but-attacker-URL polyglot bypass.
- CVE-2026-89079 (CVSS 9.8) — Theme My Login ≤ 7.2.1: unauthenticated password reset / account takeover on multisite.
- CVE-2026-107594 (CVSS 10.0) — File Upload to Order < 1.1.4: unauthenticated arbitrary file deletion → site takeover.
- CVE-2026-91136 (CVSS 7.5) — Divi Plus ≤ 2.4.0: unauthenticated arbitrary file read via SVG parameter, enabling full
wp-config.phpdisclosure.
Cloud Vulnerabilities and Attack Chains
vFeed tracked 184 cloud-specific CVEs in October across Azure, AWS, GCP, Kubernetes, and container technologies. Notable disclosures:
- CVE-2026-83938 (Azure Kubernetes Configuration Service, CVSS 10.0) — missing authentication on a critical function, enabling unauthenticated remote privilege elevation.
- CVE-2026-110063 (Azure VM Inspector, CVSS 10.0) — link-following flaw allowing unauthenticated network-reachable EoP.
- CVE-2026-97785 (AAD App Proxy, CVSS 10.0) — improper authentication, network-reachable EoP.
- CVE-2026-103956 (Loom for AWS, CVSS 10.0) — missing authentication in the agent control plane; unauthenticated callers can register tool servers, read integration credentials, and rewrite IAM role policies for managed agents when no IdP is configured.
- CVE-2026-104019 (Amazon SageMaker Distribution / Unified Studio, CVSS 9.0) — authenticated project-contributor OS command injection against another member’s Studio Space, leaking that member’s execution-role credentials.
- CVE-2026-63688 / 63692 (Dell Container Storage Modules, CVSS 10.0) — missing authentication in csm-authorization-storage gRPC server; unauthenticated remote attackers obtain storage-backend administrator credentials for all registered arrays.
- CVE-2026-85748 (MariaDB SYS_REFCURSOR, CVSS 9.9) — use-after-free in cursor-array reallocation, chainable to RCE on managed DB platforms.
The dominant October cloud attack chain is a “missing-auth → control-plane takeover → credential harvest → downstream pivot” pattern. We see this repeated in Loom for AWS, Azure Kubernetes Configuration, Dell CSM, AAD App Proxy, and IBM DataStage on Cloud Pak for Data (CVE-2026-81212, CVSS 10.0). Defenders should treat any 2026 service that fronts an API with “optional” identity-provider configuration as a priority audit target.
Top Weaknesses
Overall — All October CVEs
| CWE | Weakness | Count | % of Total |
|---|---|---|---|
| CWE-79 | Cross-Site Scripting | 1,284 | 9.8% |
| CWE-89 | SQL Injection | 892 | 6.8% |
| CWE-787 | Out-of-Bounds Write | 714 | 5.5% |
| CWE-78 | OS Command Injection | 681 | 5.2% |
| CWE-125 | Out-of-Bounds Read | 598 | 4.6% |
| CWE-416 | Use After Free | 487 | 3.7% |
| CWE-434 | Unrestricted File Upload | 412 | 3.2% |
| CWE-287 | Improper Authentication | 384 | 2.9% |
| CWE-306 | Missing Authentication for Critical Function | 341 | 2.6% |
| CWE-22 | Path Traversal | 318 | 2.4% |
Critical Only (CVSS 9.0+)
| CWE | Weakness | Critical Count |
|---|---|---|
| CWE-78 | OS Command Injection | 218 |
| CWE-306 | Missing Authentication for Critical Function | 142 |
| CWE-434 | Unrestricted File Upload | 118 |
| CWE-94 | Code Injection | 97 |
| CWE-502 | Deserialization of Untrusted Data | 84 |
| CWE-287 | Improper Authentication | 76 |
| CWE-121 | Stack-Based Buffer Overflow | 71 |
| CWE-787 | Out-of-Bounds Write | 68 |
| CWE-863 | Incorrect Authorization | 54 |
| CWE-918 | Server-Side Request Forgery | 47 |
OS Command Injection (CWE-78) remains the dominant critical-severity weakness — fueled almost entirely by SOHO router and IoT firmware disclosures (TOTOLINK, Wavlink, Tenda, D-Link, Edimax, Linksys). More structurally interesting is the climb of CWE-306 (Missing Authentication for Critical Function) into the top three for criticals: cloud control planes, gRPC services, and Kubernetes-adjacent APIs are shipping with “optional authentication” that defaults to open, converting integration misconfiguration into unauthenticated takeover. Expect this CWE to continue growing as cloud-native and agent-based architectures proliferate.
Hardware / IoT / Firmware
vFeed tracked 924 hardware, IoT, and firmware CVEs in October. Standout entries:
- CVE-2026-104610 (Tenda HG7/HG9/HG10 xPON, CVSS 10.0) — stack-based buffer overflow in Boa web server, remote unauthenticated.
- CVE-2026-105284 / 105285 (TOTOLINK A3002MU, CVSS 10.0) — improper authorization and stack overflow in
/boafrm/formIpQoS. - CVE-2026-105484 (TOTOLINK X6000R, CVSS 10.0) — OS command injection in firmware upload handler.
- CVE-2026-113744 (Tenda AC19, CVSS 10.0) — stack-based buffer overflow in
formSetFirewallCfg. - CVE-2026-114382 / 114383 (TOTOLINK EX200, CVSS 10.0) — multiple stack overflows via
/cgi-bin/cstecgi.cgi. - CVE-2026-108576 (TOZED X300, CVSS 10.0) — OS command injection in IPPingDiagnostics.
- CVE-2026-108804 (TRENDnet TEW-751DR/752DRU/733GR, CVSS 10.0) — OS command injection; vendor confirms EOL since 2011, no fix.
- CVE-2026-108892 (Linksys E1700, CVSS 10.0) — stack overflow in MAC filter handler; vendor non-responsive.
- CVE-2026-108917 / 108918 (Edimax BR-6208AC, CVSS 10.0) — command injection; EOL, no fix.
- CVE-2026-109109 / 109110 / 110957 / 110958 (Wavlink WL-WN530BE1-A, WN592AX6, WL-WN530BE2-A, WN530HG4B, CVSS 10.0) — overflow and command injection chain; patched builds dated 2026-09-24 available.
- CVE-2026-110536 (D-Link DIR-868L, CVSS 10.0) — OS command injection in HNAP CGI SOAPACTION.
- CVE-2026-114575 (TOTOLINK A950RG, CVSS 10.0) — command injection via FileMd5.
- CVE-2026-70518 (Fanvil x7a VoIP phone, CVSS 10.0) — unauthenticated diagnostic-ping command injection with Android OS execution.
- CVE-2026-109390 (AnyDesk < 8.0.3, CVSS 9.8) — unauthenticated heap-based buffer overflow in session protocol enabling root RCE on Linux without any user approval.
The October IoT disclosure wave is dominated by one pattern: unauthenticated OS command injection in CGI/Boa web interfaces, with disproportionate exposure on devices that are either EOL (TRENDnet TEW-751DR, Edimax BR-6208AC) or whose vendors did not respond to coordinated disclosure. Network defenders should assume any Internet-exposed TOTOLINK, Wavlink, Edimax, or Linksys SOHO device is compromisable with public PoCs, and segment accordingly.
Critical Exploitable Vulnerabilities — October 2026
Pay attention to these critical vulnerabilities with known exploits and high EPSS scores.
| CVE | Target | CVSS | EPSS %ile | Exploit | CWE |
|---|---|---|---|---|---|
| CVE-2026-109619 | PHP core (global state) | 8.1 | 99.999 | GitHub PoC | CWE-416 |
| CVE-2026-109618 | PHP core (OOM longjmp) | 9.8 | 99.998 | GitHub PoC | CWE-908 |
| CVE-2026-21589 | Atlassian Bitbucket/Confluence/Jira DC | 7.5 | 99.943 | GitHub PoC | CWE-22 |
| CVE-2026-104935 | Ivanti ICS < 25.1.3.0 | 8.6 | 99.742 | GitHub PoC | CWE-290 |
| CVE-2026-111497 | Google Brotli 1.0.3–1.2.0 | 9.8 | 99.667 | GitHub PoC | CWE-120 |
| CVE-2026-105134 | Ahsay AhsayCBS ≤ 10.3.2 | 10.0 | 99.645 | ExploitDB | CWE-78 |
| CVE-2026-110447 | Collabora Online CODE Server (Nextcloud) | 9.8 | 99.461 | ITW exploitation (Sep–Oct 2026) | CWE-78 |
| CVE-2026-59774 | Gitea Org-mode markup | 9.8 | 98.120 | GitHub PoC | CWE-22 |
| CVE-2026-97229 | GitLab CE/EE CI/CD regex | 10.0 | 98.060 | GitHub PoC | CWE-94 |
| CVE-2026-102764 | BeyondTrust Remote Support | 9.8 | 97.299 | GitHub PoC | CWE-346 |
| CVE-2026-90970 | GitLab AI Gateway Duo | 9.9 | 97.134 | GitHub PoC | CWE-94 |
| CVE-2026-93674 | IBM Langflow OSS 1.0.0–1.12.2 | 9.8 | 96.770 | GitHub PoC | CWE-78 |
| CVE-2026-88779 | Citrix NetScaler ADC/Gateway | 7.5 | 95.995 | GitHub PoC | CWE-125 |
| CVE-2026-96951 | Windows Shell command injection | 8.8 | 95.551 | — | CWE-78 |
Actionable Recommendations
1. Patch PHP and front-ending runtimes immediately. CVE-2026-109618 and CVE-2026-109619 have reached EPSS 0.99998+ — the highest exploitation-probability signal we have observed this year. Any Internet-facing PHP-FPM, Apache mod_php, or FrankenPHP deployment should be upgraded on an emergency change window. Treat shared-hosting and CMS clusters as pre-compromised until proven otherwise.
2. Hunt for in-the-wild exploitation of Collabora Online CODE Server (CVE-2026-110447). Vendor advisory explicitly confirms active exploitation in September and October 2026. If you run Nextcloud with richdocumentscode< 26.4.303, upgrade now and audit proxy.php request logs for OS command injection patterns; standalone Collabora Online servers are not affected, but mixed deployments must be inventoried.
3. Apply the Oracle October 2026 CPU and Adobe October bulletin on priority schedules. Seven Oracle CVSS 10.0 scope-change takeovers (E-Business Suite Workflow CVE-2026-101809, SOA Suite CVE-2026-91216/91221/91231, Access Manager CVE-2026-87337, JD Edwards Orchestrator CVE-2026-91299) and six Adobe CVSS 10.0 (AEM CVE-2
May you live in interesting times!