Introduction
October’s threat intelligence highlights a growing concern for security teams: vulnerabilities affecting the very infrastructure organizations rely on to protect their networks.
From remote access gateways and email security appliances to network management platforms and enterprise applications, this month’s Velma review identifies 21 priority vulnerability entries, with active exploitation reported across several critical technologies.
The most significant threats affect Ivanti Connect Secure, Fortinet FortiMail, F5 BIG-IP APM, Citrix NetScaler and VeloCloud Orchestrator, where vulnerabilities could enable unauthenticated access, remote code execution or administrative compromise.
This month’s findings reinforce the importance of moving beyond vulnerability severity alone and prioritizing exposures based on exploitation intelligence, accessibility and potential business impact.
Jump to:
Velma Threat Prioritization Matrix - October 26
The following matrix summarizes October’s 21 priority vulnerabilities, based on reported exploitation, potential impact, authentication requirements and exposure.
| Priority | Vulnerability / Product | CVE | Exploit Status | Risk |
|---|---|---|---|---|
| 1 – Critical | Ivanti Connect Secure | CVE-2026-104935 | Active exploitation reported | 9.9 |
| 2 – Critical | Fortinet FortiMail | CVE-2026-104286 | Active exploitation reported | 9.9 |
| 3 – Critical | F5 BIG-IP APM | CVE-2026-94127 | Active exploitation reported | 9.8 |
| 4 – Critical | Citrix NetScaler | CVE-2026-88772 | Active exploitation reported | 9.8 |
| 5 – Critical | VeloCloud Orchestrator | CVE-2026-93952 | Active exploitation reported | 9.8 |
| 6 – Critical | SonicWall SMA1000 | CVE-2026-102255 | Honeypot activity reported | 9.7 |
| 7 – Critical | Bricksforge WordPress | CVE-2026-85097 | Active exploitation reported | 9.7 |
| 8 – Critical | MikroTik RouterOS | CVE-2026-67279 | Active exploitation reported | 9.7 |
| 9 – Critical | Atlassian Data Center | CVE-2026-21589 | Active exploitation reported | 9.6 |
| 10 – Critical | Cisco Secure Email | CVE-2026-76519 | Exploitation unconfirmed | 9.5 |
| 11 – Critical | Check Point | CVE-2026-91843 | No exploitation indicated | 9.5 |
| 12 – Critical | Next.js | CVE-2026-94545 | Exploitation unconfirmed | 9.4 |
| 13 – High | AhsayCBS | CVE-2026-105133 | Exploitation unconfirmed | 9.2 |
| 14 – High | Veeam Agent | CVE-2026-32996 | Active exploitation reported | 9.2 |
| 15 – High | Roundcube Webmail | CVE-2026-48842 | Exploitation unconfirmed | 9.1 |
| 16 – High | Adobe Commerce | CVE-2026-71362 | Exploitation unconfirmed | 9.0 |
| 17 – High | Microsoft SharePoint | CVE-2026-65660 | Exploitation unconfirmed | 8.9 |
| 18 – High | Microsoft Windows Shell | CVE-2026-96951 | Exploitation unconfirmed | 8.8 |
| 19 – High | Palo Alto PAN-OS | CVE-2026-0322 | Exploitation unconfirmed | 8.7 |
| 20 – High | WordPress Core | CVE-2026-93485 | No known exploitation | 8.4 |
| 21 – High | CardDAV / cPanel | CVE-2026-87899 | Exploitation unconfirmed | 8.2 |
Note: These risk scores are editorial estimates from the October master report, not confirmed Velma platform scores or vendor CVSS ratings. The MikroTik entry also involves CVE-2026-86060. Exploitation status reflects the supplied intelligence and requires validation against primary sources before publication.
Executive Summary
October’s Velma threat intelligence review identifies 21 primary vulnerability entries across security appliances, enterprise applications, web platforms and management infrastructure.
Several vulnerabilities have been associated with reported active exploitation, including authentication bypass, arbitrary file access and remote code execution.
The most urgent priorities involve internet-facing infrastructure, particularly systems responsible for remote access, authentication and network management.
Key findings include:
Security infrastructure under attack: Ivanti, Fortinet, F5, Citrix and VeloCloud feature among the highest-priority threats, with active exploitation reported in the supplied intelligence.
SonicWall honeypot observations: Rootshell’s supplied intelligence references honeypot activity associated with CVE-2026-102255, despite the vendor reporting no known exploitation.
Web application compromise: Critical vulnerabilities in Bricksforge WordPress and Atlassian Data Center highlight risks beyond traditional perimeter devices.
Chained exploitation: Two MikroTik RouterOS vulnerabilities, CVE-2026-67279 and CVE-2026-86060, can reportedly be combined to compromise exposed routers.
Remediation validation: Where exploitation has been reported, security teams should assess potential compromise alongside patch deployment.
Overall Velma Threat Assessment: CRITICAL (provisional)
Threat Actor & Active Exploitation Intelligence
October’s intelligence reports exploitation affecting several critical technologies. However, no named threat actor groups have been reliably attributed to the vulnerabilities in the supplied report.
Rather than assigning speculative attribution, this month’s analysis focuses on observed or reported activity and the potential implications for affected organizations.
1. Unattributed Exploitation of Perimeter Security Infrastructure
Affected technologies: Ivanti Connect Secure, Fortinet FortiMail, F5 BIG-IP APM and Citrix NetScaler.
These platforms provide critical security functions, including remote access, authentication, traffic management and application delivery.
Reported exploitation is particularly concerning because successful compromise could provide attackers with access to sensitive credentials, internal applications and network resources.
Velma Assessment: ACTIVE EXPLOITATION REPORTED – ACTOR UNKNOWN
2. MikroTik RouterOS – MikroTrick Attack Chain
CVE-2026-67279 and CVE-2026-86060
October’s intelligence describes a two-stage attack chain involving MikroTik RouterOS SSH functionality.
The chain reportedly combines an SSH state-machine vulnerability with an argument-injection flaw, potentially enabling attackers to gain administrative access to exposed routers without completing authentication.
Attack activity is reported as dating back to September 2, 2026.
Organizations should review exposed SSH services, investigate suspicious authentication activity and confirm that fixed RouterOS releases have been installed.
Velma Assessment: ACTIVE EXPLOITATION REPORTED – ATTRIBUTION UNKNOWN
3. Bricksforge WordPress – Active Exploitation
CVE-2026-85097
The October report references exploitation attempts observed by Patchstack beginning October 7, 2026.
The vulnerability could allow unauthenticated attackers to upload and execute arbitrary PHP code, potentially resulting in complete compromise of affected WordPress websites.
Affected organizations should upgrade to Bricksforge version 3.1.8.10 or later and investigate unexpected PHP files, administrator accounts and plugin changes.
Velma Assessment: ACTIVE EXPLOITATION REPORTED – ATTRIBUTION UNKNOWN
Key Threat Analysis
Ivanti Connect Secure – CVE-2026-104935
CVSS: 8.6 | Velma Assessment: CRITICAL – EXPLOITATION REPORTED
An authentication bypass vulnerability affecting Ivanti Connect Secure could allow unauthenticated remote attackers to execute arbitrary commands.
The supplied intelligence reports active exploitation associated with credential theft and data exfiltration.
Organizations running affected versions should immediately review vendor guidance, apply updates and investigate potential signs of compromise.
Fortinet FortiMail – CVE-2026-104286
CVSS: 9.8 | Velma Assessment: CRITICAL – EXPLOITATION REPORTED
A critical path traversal and NULL character handling vulnerability could allow unauthenticated attackers to write arbitrary files to the underlying FortiMail system.
The supplied intelligence reports active exploitation and references the vulnerability’s addition to CISA’s Known Exploited Vulnerabilities catalog.
Organizations should validate affected versions, apply vendor fixes and review potentially exposed appliances.
F5 BIG-IP APM – CVE-2026-94127
Velma Assessment: CRITICAL – EXPLOITATION REPORTED
A critical vulnerability affecting F5 BIG-IP Access Policy Manager could allow unauthenticated remote code execution under specific OAuth authorization server configurations.
Affected deployments require an APM access policy and OAuth authorization server profile configured on the same virtual server.
Organizations should assess their configuration and apply the relevant engineering hotfixes.
Citrix NetScaler – CVE-2026-88772
CVSS: 9.5 | Velma Assessment: CRITICAL – EXPLOITATION REPORTED
A memory overflow vulnerability in Citrix NetScaler ADC and Gateway could allow remote code execution or denial of service.
The issue affects Datagram Transport Layer Security processing within the NetScaler Packet Processing Engine.
Security teams should prioritize internet-facing deployments and validate that appropriate remediation has been applied.
VeloCloud Orchestrator – CVE-2026-93952
CVSS: 10.0 | Velma Assessment: CRITICAL – EXPLOITATION REPORTED
A critical vulnerability affecting certain on-premises VeloCloud Orchestrator deployments could allow unauthenticated attackers to access privileged internal functionality.
The reported exposure affects orchestrators configured to authenticate Edge devices using certificates.
Organizations should identify affected deployments, review vendor remediation guidance and investigate potential unauthorized access.
SonicWall SMA1000 – CVE-2026-102255
CVSS: 10.0 | Velma Assessment: CRITICAL – INVESTIGATE HONEYPOT INDICATORS
A server-side request forgery vulnerability affecting SonicWall SMA1000 WorkPlace could allow unauthenticated attackers to reach internal functionality.
Although SonicWall reported no known exploitation, Rootshell’s supplied threat intelligence references honeypot activity.
This distinction highlights the importance of evaluating multiple intelligence sources when determining remediation priorities.
Organizations should apply available hotfixes and review appliance telemetry for suspicious activity.
Bricksforge WordPress – CVE-2026-85097
CVSS: 10.0 | Velma Assessment: CRITICAL – EXPLOITATION REPORTED
A critical vulnerability affecting Bricksforge versions up to and including 3.1.8.9 could allow unauthenticated PHP upload and execution.
Successful exploitation could result in remote code execution and compromise of affected WordPress websites.
A fix is available in version 3.1.8.10.
MikroTik RouterOS – CVE-2026-67279 and CVE-2026-86060
Velma Assessment: CRITICAL – EXPLOITATION REPORTED
The MikroTrick vulnerability chain could allow attackers to gain administrative control of internet-exposed MikroTik routers without a password or completed authentication.
The supplied intelligence reports patches in RouterOS versions 6.49.21, 7.23.4 and 7.24.2.
Organizations should assess both vulnerabilities together, restrict SSH exposure and confirm installation of a fixed release.
Atlassian Data Center – CVE-2026-21589
CVSS: 9.3 | Velma Assessment: CRITICAL – EXPLOITATION REPORTED
An arbitrary file access vulnerability affects several Atlassian Data Center products, including Confluence, Jira, Bitbucket and Bamboo.
Under certain conditions, unauthenticated attackers could access sensitive files within affected applications.
Organizations should review affected products, apply vendor fixes and investigate unauthorized file access.
October’s Key Threat Trends
1. Security Infrastructure Remains a High-Value Target
Several of October’s highest-priority vulnerabilities affect remote access, email security, application delivery and network management infrastructure.
These technologies often sit at critical trust boundaries, making successful exploitation potentially significant.
2. Web Applications Continue to Present Exposure
Bricksforge, WordPress Core, Next.js, Roundcube, Atlassian Data Center and Adobe Commerce demonstrate the range of vulnerabilities affecting application environments.
Potential impacts include remote code execution, SQL injection, sensitive data access and unauthorized privilege escalation.
3. Management and Recovery Systems Require Greater Attention
VeloCloud Orchestrator, Veeam Agent and AhsayCBS highlight the importance of securing systems with privileged management or recovery functions.
These platforms can be particularly sensitive because of their administrative capabilities and access to critical infrastructure.
4. Exploitation Evidence Must Be Evaluated Carefully
October’s report contains several exploitation claims without confirmed threat actor attribution.
Security teams should distinguish between confirmed exploitation, third-party reports, honeypot observations and vulnerabilities for which exploitation remains unconfirmed.
Velma’s Recommended Actions
Based on October’s intelligence, organizations should prioritize the following:
Identify exposed security infrastructure. Review Ivanti Connect Secure, FortiMail, F5 BIG-IP APM, Citrix NetScaler and VeloCloud Orchestrator deployments.
Validate SonicWall remediation. Confirm SMA1000 hotfix deployment and investigate relevant honeypot indicators against appliance telemetry.
Secure vulnerable web applications. Upgrade affected Bricksforge and WordPress installations and investigate unexpected files, accounts and configuration changes.
Review MikroTik SSH exposure. Assess both vulnerabilities in the MikroTrick chain and upgrade affected RouterOS deployments.
Review enterprise application exposure. Assess Atlassian Data Center, Cisco Secure Email, Check Point, Next.js, Roundcube and backup infrastructure against vendor guidance.
Investigate potential compromise. Where exploitation has been reported, review credentials, access tokens, administrator accounts, outbound connections and unexpected processes.
Validate remediation effectiveness. Confirm that vulnerable services are no longer exploitable and that relevant exposure has been reduced.
October 2026 Risk Outlook
Overall Velma Threat Assessment: CRITICAL (provisional)
October’s threat intelligence reflects a particularly concerning concentration of vulnerabilities affecting security infrastructure and privileged enterprise systems.
The reported exploitation of vulnerabilities in remote access gateways, email security platforms, application delivery controllers and network management systems highlights the potential consequences of weaknesses in technologies that sit at critical trust boundaries.
Three factors are shaping October’s threat outlook:
1. Internet-facing infrastructure remains a priority
Systems responsible for remote access, authentication and network management present valuable opportunities for attackers, particularly where vulnerabilities can be exploited without authentication.
2. Exploitation activity increases remediation urgency
Reported exploitation affecting several of October’s highest-priority vulnerabilities reinforces the need to consider threat intelligence alongside vulnerability severity.
Where systems may already have been exposed, remediation should include compromise assessment rather than patching alone.
3. Continuous validation is increasingly important
As enterprise attack surfaces evolve, organizations need ongoing visibility into vulnerabilities, exposure and remediation effectiveness.
Continuous Threat Exposure Management (CTEM), supported by human-led testing and threat intelligence, provides a framework for identifying and prioritizing weaknesses based on their real-world impact.
Final Velma Assessment
October’s findings demonstrate that vulnerabilities affecting security infrastructure deserve particular attention because of the access and privileges these systems control.
Organizations should prioritize affected internet-facing assets, validate remediation and investigate potential compromise where exploitation has been reported.
The priority isn’t simply to identify critical vulnerabilities. It’s to understand which exposures are exploitable and take action before attackers can capitalize on them.
Strengthen Your Exposure Management with Rootshell
The Rootshell Platform helps organizations operationalize CTEM by bringing vulnerability intelligence, continuous visibility and human-led security testing together.
By understanding which vulnerabilities matter most and validating remediation effectiveness, security teams can focus resources on reducing exploitable risk.
Learn more about the Rootshell Platform and our continuous security testing services.
