This brief covers October 15–17, 2026. Items are drawn from vendor advisories and primary reporting, with dates checked against the source pages. The window was quiet: one new, verified development, followed by a few still-active campaigns.
BeyondTrust discloses Remote Support authentication bypass exploited as a zero-day since August (CVE-2026-102764)
BeyondTrust · October 15, 2026
BeyondTrust published advisory BT26-05 for CVE-2026-102764, a critical (CVSS 9.3) authentication bypass in Remote Support (RS) that lets an unprivileged remote attacker perform file operations on an appliance. RS 26.2.3 and earlier are affected, and Privileged Remote Access shares the code and was patched as a precaution. BeyondTrust says first exploitation was August 29 and was contained September 28; patches shipped October 8 (SaaS and self-hosted). Google’s Mandiant/GTIG attributes the activity to Armory Castle (formerly UNC5221), a suspected China-nexus espionage group. Observed post-exploitation included web shells, a tunneler and log wiping. Shadowserver counts more than 1,400 exposed instances. KEV listing was not confirmed in the sources reviewed.
“We are aware of only a small number of impacted organizations at this time.” — Kelli Vanderlee, Google Threat Intelligence Group, via CyberScoop
Source: BeyondTrust advisory BT26-05 · BleepingComputer · CyberScoop
Still developing
Cisco Secure Email Gateway path traversal exploited for root (CVE-2026-76519)
Cisco · October 14, 2026
CVSS 9.8. A crafted attachment can let an attacker write files and run commands as root when File Reputation is enabled and Content Scanner Tools is older than 25.3.0.5525. Cisco says there are no workarounds; fixes are AsyncOS 16.5.0-780 or Content Scanner Tools 25.3.0.5525+. Added to CISA KEV on October 14 (federal deadline October 17).
“In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.” — Cisco, via SecurityWeek
Source: SecurityWeek · Help Net Security
Palo Alto PAN-OS management interface RCE exploited (CVE-2026-0322)
Palo Alto Networks · October 14, 2026
CVSS 8.6. An authenticated attacker with network access to the management interface can execute code as root on PA-Series, VM-Series and Panorama; Cloud NGFW and Prisma Access are not affected. Fixes are available across supported PAN-OS branches, and there is no full workaround, so restrict management access to trusted internal IPs. Added to KEV October 14.
“Very limited exploitation has been observed targeting the Palo Alto Networks management interface” — Palo Alto Networks advisory, via BleepingComputer
Source: BleepingComputer
Windows Shell Mark-of-the-Web bypass exploited before patch (CVE-2026-96951)
Microsoft · October 13, 2026
CVSS 8.8. A Windows Shell security feature bypass that lets a crafted file evade Mark of the Web protections; exploited as a zero-day and fixed in October Patch Tuesday. Added to KEV October 13 (federal deadline October 16). No public PoC was documented.
Source: SOC Prime analysis · BleepingComputer
This brief covers the trailing ~48 hours (October 15–17, 2026).
Primary sources: