Daily Briefing

CISA adds actively-exploited BeyondTrust Remote Support auth bypass to its KEV catalog

By The IT Security Desk

Good morning. CISA said on 16 October that it is aware of a critical authentication bypass vulnerability in BeyondTrust Remote Support (formerly Bomgar), versions 26.2.3 and earlier, and added it to the Known Exploited Vulnerabilities catalog the same day. CISA states that threat actors are actively exploiting it to gain initial access, then establishing persistence, escalating privileges and moving laterally. CISA urges organisations with affected self-hosted Remote Support appliances to apply the BT26-05-RS patch as outlined in BeyondTrust's Security Advisory BT26-05. CISA says patches are available for supported versions 24.3.1 and later; organisations on older versions must upgrade first. Treat any self-hosted appliance as a priority for patching and for compromise assessment given the active exploitation CISA describes.

Three further flaws carry active-exploitation status on CISA's KEV catalog. CISA lists CVE-2026-0322 in Palo Alto Networks PAN-OS (versions before the fix in 10.2.0) as known exploited; its CVSS vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base score 7.2. CISA lists CVE-2026-96951 in Microsoft Windows Server, with Microsoft's advisory naming the fix in build 10.0.14393.9612; vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base score 8.8. CISA lists CVE-2026-104935 in Ivanti Connect Secure 22.8; vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, base score 8.6. Apply each vendor's fixed release per its advisory.

Google's Chrome advisory lists the fix in 155.0.8059.79 for three flaws — CVE-2026-110165, CVE-2026-110161 and CVE-2026-110159 — each carrying vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base score 9.6. Update Chrome and confirm the version. Separately, SecurityWeek reported a $250,000 Chrome exploit among its roundup.

Read the full briefing →

Zoom out: The day's exploited flaws cluster on remote-access and edge products — BeyondTrust, Ivanti Connect Secure and Palo Alto PAN-OS — the kind an attacker uses to get in before moving laterally.

Vulnerability in focus

CVE-2026-0322 — Palo Alto Networks. CVSS 7.2 CISA lists it as known to be exploited.

Affected: panos.

What to do: Follow the vendor advisory for the fixed release and any interim mitigation.

Elsewhere

CISA: CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support Read it
BleepingComputer: Critical BlockStrap flaw lets hackers run code on Magento servers Read it
The Hacker News: Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug Read it
CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog Read it
The Hacker News: Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor Read it
BleepingComputer: Zero-click attacks used targeted ads to deliver Candiru spyware Read it
CISA: Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation Read it
The Hacker News: OpenAI Research Model Spent 3rd-Party Test ETH Without Permission to Deploy Smart Contract Read it
The Record: Proofpoint lines up $6.3 billion deal for Varonis’ data security Read it
SecurityWeek: In Other News: ICS-Sniper Attack, Hacking XWorm Malware Operators, $250k Chrome Exploit Read it
The Register: Attack on BAE-managed system disrupts US bankruptcy courts Read it
The Record: Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day Read it

Sources

Critical BlockStrap flaw lets hackers run code on Magento servers BleepingComputer
Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug The Hacker News
Proofpoint lines up $6.3 billion deal for Varonis’ data security The Record
In Other News: ICS-Sniper Attack, Hacking XWorm Malware Operators, $250k Chrome Exploit SecurityWeek
Attack on BAE-managed system disrupts US bankruptcy courts The Register
Hackers disguise phishing as promising business opportunities Help Net Security
CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support CISA
Backdooring Open-Weight AI Models Schneier on Security
Zero-click attacks used targeted ads to deliver Candiru spyware BleepingComputer
Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor The Hacker News
UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing The Hacker News
OpenAI Research Model Spent 3rd-Party Test ETH Without Permission to Deploy Smart Contract The Hacker News
Moscow detains suspected DataSuckers hackers linked to breaches in Ukraine and Russia The Record
Baltimore suburb confirms August data breach after ransomware claims The Record

Share this issue

Facebook · X · Reddit · LinkedIn · WhatsApp · Email · Bluesky

Every briefing is on the site, with the advisory record behind it. All briefings