Analyst Guidance
This week is dominated by a critical authentication bypass in BeyondTrust Remote Support (CVE-2026-102764), Organizations should prioritize patching BeyondTrust immediately and verify they are running supported versions (24.3.1 or later); those on older versions must upgrade before patches can be applied.
CVE Details & Remediation
How to read this report
🛡️Verified facts — NVD & CISA KEV
⏳Partially verified — awaiting NVD enrichment
🧠AI analysis — synthesis, verify before acting
🛡️Actionable · Verified facts
NVD-published · CISA KEV cross-checked🛡️CVE-2026-105134 – Ahsay AhsayCBS ✓ NVD
CVSS10 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS5% · P92
ActionPatch immediately
AffectedGovernment Technology
Remediation Steps
- Apply the vendor security update for Ahsay AhsayCBS as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2015-3306 – Proftpd (also: Fedoraproject, Debian) ✓ NVD
CVSS10 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS99% · P100
ActionPatch immediately
AffectedGovernment Energy
Remediation Steps
- Apply ProFTPD security patch immediately
- Review access logs for unauthorized administrative access attempts
- Restrict network access to FTP services to trusted networks only
- Monitor for Flax Typhoon indicators of compromise
References:
🛡️CVE-2026-5430 – WSO2 Multiple Products ✓ NVD
CVSS10 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P47
ActionPatch immediately
Remediation Steps
- Apply available patches from GitHub
- Review GitHub repository access logs for unauthorized activity
- Audit repository permissions and access controls
- Monitor for credential compromise or token abuse
References:
🛡️CVE-2026-93952 – Arista VeloCloud Orchestrator ✓ NVD
CVSS10 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P64
ActionPatch immediately
Remediation Steps
- Review VeloCloud Orchestrator instances configured with certificate-based Edge authentication
- Restrict network access to the VCO management interface to trusted administrative networks
- Monitor authentication logs for unauthorized privilege escalation attempts
References:
🛡️CVE-2026-102764 – BeyondTrust Remote Support ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV
EPSS1% · P67
ActionPatch immediately
AffectedTechnology
Remediation Steps
- Verify your BeyondTrust Remote Support version is 24.3.1 or later (supported versions eligible for patching)
- For versions 26.2.3 and earlier that are unsupported, plan an immediate upgrade before applying patches
- Apply the latest security patch from BeyondTrust as soon as it is available for your supported version
- Monitor for signs of unauthorized access and review authentication logs for anomalous activity
- Restrict network access to BeyondTrust Remote Support to trusted administrative networks only
References:
🛡️CVE-2026-76519 – Cisco Secure Email Gateway ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS2% · P75
ActionPatch immediately
AffectedTechnology Government Finance
Remediation Steps
- Apply the vendor security update for Cisco Secure Email Gateway as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-102489 – Zammad GmbH Zammad ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P69
ActionPatch immediately
Remediation Steps
- Check CISA Known Exploited Vulnerabilities Catalog for detailed product and version information
- Apply vendor-supplied patches or mitigations
- Review internal systems for compromise indicators
References:
🛡️CVE-2026-104286 – Fortinet FortiMail ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS2% · P82
ActionPatch immediately
Remediation Steps
- Apply vendor patch for Fortrix to remediate known exploited vulnerability
- Verify patch deployment across all affected instances
- Monitor security logs for exploitation attempts post-patching
References:
🛡️CVE-2026-76504 – Cisco Catalyst SD-WAN Manager ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS2% · P78
ActionPatch immediately
AffectedTechnology Government Finance
Remediation Steps
- Apply the vendor security update for Cisco Catalyst Sd-Wan Manager as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-88771 – Citrix NetScaler ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P65
ActionPatch immediately
AffectedTechnology Finance
Remediation Steps
- Apply the vendor security update for Citrix Netscaler Application Delivery Controller as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-94127 – F5 BIG-IP APM ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS2% · P82
ActionPatch immediately
AffectedTechnology Retail
Remediation Steps
- Apply the vendor security update for F5 BIG-IP APM as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-85102 – Check Point Multiple Products ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS50% · P99
ActionPatch immediately
AffectedGovernment Finance Technology
Remediation Steps
- Apply the vendor security update for Check Point Security Gateway, Check Point Spark Firewall as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-93616 – Check Point Multiple Products ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS76% · P100
ActionPatch immediately
AffectedGovernment Technology
Remediation Steps
- Apply the vendor security update for Check Point Security Management Server as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2021-3199 – ONLYOFFICE Docs ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS20% · P97
ActionPatch immediately
Remediation Steps
- Apply the vendor security update for ONLYOFFICE Docs as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-71362 – Adobe Commerce And Magento ✓ NVD
CVSS9.1 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS88% · P100
ActionPatch immediately
AffectedTechnology Finance
Remediation Steps
- Apply the vendor security update for Adobe Commerce as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-96951 – Microsoft Windows ✓ NVD
CVSS8.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS2% · P74
ActionPatch immediately
AffectedTechnology
Remediation Steps
- Apply the vendor security update for Microsoft Windows as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-86950 – Apple Multiple Products ✓ NVD
CVSS8.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P69
ActionPatch immediately
AffectedTechnology Finance
Remediation Steps
- Apply the vendor security update for Apple iOS, iPadOS, macOS as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-65660 – Microsoft SharePoint ✓ NVD
CVSS8.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS2% · P81
ActionPatch immediately
Remediation Steps
- Apply the latest Microsoft security patch
- Prioritize patching across all affected systems
- Monitor email systems and document processing for suspicious activity
- Review recent file access and document modification logs
References:
🛡️CVE-2026-7273 – Zyxel GS1900 Series Switches ✓ NVD
CVSS8.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS3% · P84
ActionPatch immediately
AffectedGovernment Technology
Remediation Steps
- Apply the vendor security update for Zyxel GS1900 Smart Managed Switches as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-104935 – Ivanti Connect Secure ✓ NVD
CVSS8.6 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS26% · P98
ActionPatch immediately
AffectedTechnology
Remediation Steps
- Apply the vendor security update for Ivanti Connect Secure as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2016-3081 – Apache Struts ✓ NVD
CVSS8.1 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS96% · P100
ActionPatch immediately
AffectedTechnology Finance
Remediation Steps
- Apply the vendor security update for Huawei Agile Controller-Campus Firmware as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-88772 – Citrix NetScaler ✓ NVD
CVSS8.1 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P70
ActionPatch immediately
AffectedTechnology Government
Remediation Steps
- Apply the vendor security update for Citrix NetScaler ADC/Gateway as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
- https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88771_CVE_2026_88772_CVE_2026_88773_CVE_2026_88774_CVE_2026_88775_CVE_2026_88776_CVE_2026_88777_and_CVE_2026_88778
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88772
🛡️CVE-2026-87902 – WordPress Core ✓ NVD
CVSS8.1 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS40% · P99
ActionPatch immediately
Remediation Steps
- Apply the vendor security update for WordPress Core as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-102490 – Zammad GmbH Zammad ✓ NVD
CVSS7.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P45
ActionPatch immediately
AffectedTechnology Government Finance
Remediation Steps
- Apply the vendor security update for Zammad Ticketing System as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-21589 – Atlassian Multiple Products ✓ NVD
CVSS7.5 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS13% · P96
ActionPatch immediately
Remediation Steps
- Locate CISA Known Exploited Vulnerabilities Catalog entry for CVE-2026-21589
- Identify affected products in your environment
- Apply vendor-supplied patches or workarounds as directed
- Monitor for exploitation attempts
References:
🛡️CVE-2015-5477 – ISC BIND ✓ NVD
CVSS7.5 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS99% · P100
ActionPatch immediately
AffectedTechnology Finance
Remediation Steps
- Apply the vendor security update for Juniper Junos as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-88779 – Citrix NetScaler ✓ NVD
CVSS7.5 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P47
ActionPatch immediately
AffectedHealthcare Education
Remediation Steps
- Apply the vendor security update for Citrix Netscaler Application Delivery Controller as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-105133 – Ahsay AhsayCBS ✓ NVD
CVSS7.3 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P58
ActionPatch immediately
Remediation Steps
- Apply the vendor security update for Ahsay AhsayCBS as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-0322 – Palo Alto Networks PAN-OS ✓ NVD
CVSS7.2 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P68
ActionPatch immediately
AffectedGovernment Technology
Remediation Steps
- Apply the vendor security update for Palo Alto Networks PAN-OS as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2025-61624 – Fortinet Multiple Products ✓ NVD
CVSS6.5 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV
EPSS1% · P65
ActionPatch immediately
Remediation Steps
- Determine if your organization uses the affected product by consulting CISA's Known Exploited Vulnerabilities catalog
- Contact the vendor for patch availability and deployment guidance
- Apply patches as soon as they become available from the vendor
- Monitor security alerts and threat intelligence feeds for additional exploitation reports
References:
🛡️CVE-2026-67279 – MikroTik RouterOS ✓ NVD
CVSS6.5 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P63
ActionPatch immediately
Remediation Steps
- Apply the vendor security update for MikroTik RouterOS as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2023-22894 – Strapi ✓ NVD
CVSS4.9 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS4% · P89
ActionPatch immediately
Remediation Steps
- Apply the vendor security update for Strapi Strapi as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-103849 – Magento and Adobe Commerce (BlockStrap extension) ✓ NVD
CVSS10 NVD 3.1
Triage statusNo Known Exploit
ExploitationNo exploitation reported
EPSS1% · P55
ActionPatch within 48 hours
AffectedTechnology
Remediation Steps
- Identify instances of the BlockStrap extension in your Magento and Adobe Commerce deployments
- Apply the vendor's security patch for CVE-2026-103849 as soon as it is released
- Disable the BlockStrap extension if patches are not immediately available
- Review server logs for signs of arbitrary PHP code execution attempts
- Validate file integrity and permissions on affected e-commerce instances
References:
🛡️CVE-2026-106931 – SiteGuard WAF Server Edition ✓ NVD
CVSS7.8 NVD 3.0
Triage statusNo Known Exploit
ExploitationNo exploitation reported ● New this week
EPSS1% · P51
ActionPatch this week
AffectedTechnology Government
Remediation Steps
- Apply the vendor security update for SiteGuard WAF Server Edition as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🤖 This vulnerability report was compiled by defend.network using AI-powered analysis of vulnerability databases, vendor advisories, and threat intelligence feeds. Always verify remediation steps through official vendor channels before implementing changes in production environments.