Daily brief · 2026-10-12

7 Critical Security Fixes You Need Today

▶

SonicWall SMA1000 Series appliances

SonicWall SMA1000 Series appliances contain a pre-authentication server-side request forgery vulnerability in the WorkPlace interface caused by an unintended alternate access path. A remote unauthenticated attacker can force the appliance to send requests to reach internal functionality and perform unauthorized actions, or chain the flaw with a post-authentication command injection issue to achieve remote code execution. The vulnerability affects SMA1000 models 6210, 7210, and 8200v running versions 12.4.3-03526, 12.5.0-02952, and earlier. There are currently no reports of these SMA1000 vulnerabilities being exploited in the wild.

Why it matters: An unauthenticated attacker can interact with internal appliance functionality or chain the issue with post-authentication command injection to achieve remote code execution.

What to do: Apply the appropriate security updates and platform hotfixes provided by SonicWall to affected SMA1000 appliances.

CVEs: CVE-2026-102255

Bricksforge WordPress plugin

The Bricksforge WordPress plugin contains an unauthenticated arbitrary file upload vulnerability that is currently undergoing active exploitation attempts in the wild. CVE-2026-85097 allows unauthenticated attackers to upload and run arbitrary PHP code, resulting in remote code execution. Telemetry first recorded active exploitation attempts on October 7, 2026. The vulnerability impacts Bricksforge versions up to and including 3.1.8.9, with a fix available in 3.1.8.10.

Why it matters: Unauthenticated attackers can upload web shells and execute arbitrary code on the underlying web server.

What to do: Update the Bricksforge WordPress plugin to version 3.1.8.10 or later immediately.

CVEs: CVE-2026-85097

Atlassian Data Center products

Atlassian Data Center products are affected by an arbitrary file access flaw that is reportedly undergoing active exploitation in the wild. An unauthenticated attacker can exploit the vulnerability to view specific files within the web application root directory. Exploitation requires knowing the exact file path and does not allow directory enumeration or listing. Impacted software includes Bitbucket Data Center prior to versions 9.4.26, 10.2.8, and 10.5.1.

Why it matters: An unauthenticated attacker can read sensitive configuration or application files if the exact target path is known.

What to do: Apply the vendor security updates to affected Atlassian Data Center installations immediately.

CVEs: CVE-2026-21589

Citrix NetScaler ADC and NetScaler Gateway

Critical vulnerabilities impacting Citrix NetScaler ADC and NetScaler Gateway have been added to the CISA Known Exploited Vulnerabilities catalog. The appliances contain an improper input validation flaw tracked as CVE-2026-88771 that could allow an unauthenticated attacker to execute arbitrary commands. The catalog also lists CVE-2026-88772, a memory buffer restriction flaw allowing remote code execution or denial of service, and CVE-2026-88779, a memory buffer vulnerability enabling denial of service.

Why it matters: Unauthenticated network attackers can compromise the appliance or crash ADC and Gateway networking services.

What to do: Apply the firmware updates specified in Citrix security bulletin CTX697174 and related vendor advisories.

CVEs: CVE-2026-88771, CVE-2026-88772, CVE-2026-88779, CVE-2026-107406

Palo Alto Networks PAN-OS GlobalProtect

An authentication bypass flaw in Palo Alto Networks PAN-OS GlobalProtect is facing active exploitation attempts in the wild and has been used in ransomware attacks. Palo Alto Networks confirmed awareness of limited exploit attempts against unpatched devices that lack mitigations. The vulnerability impacts firewalls configured with a GlobalProtect portal or gateway when authentication override cookies are enabled, allowing attackers to bypass authentication controls and establish unauthorized VPN connections. CISA cataloged CVE-2026-0257 on its Known Exploited Vulnerabilities catalog as an actively exploited flaw leveraged in ransomware campaigns.

Why it matters: Attackers can bypass VPN authentication controls and establish unauthorized network access into protected enterprise environments.

What to do: Upgrade PAN-OS to patched maintenance releases such as 10.2.18-h6, 11.1.15, 11.2.12, or 12.1.7, or disable authentication override cookies.

CVEs: CVE-2026-0257

Unisoc Modem OTA Stack (chipsets T8100, T9100, UDX710)

A stack-based buffer overflow in the Unisoc Modem OTA Stack (chipsets T8100, T9100, UDX710) allows remote code execution or denial of service without requiring additional execution privileges. In the modem over-the-air stack, improper validation of scheduling information in SIB1 messages triggers the condition. The flaw carries a CVSS 3.1 score of 8.3 with a network access vector and affects chipsets including Unisoc T8100, T9100, and UDX710.

Why it matters: A remote attacker transmitting crafted radio frames can cause a denial of service or execute arbitrary code on the modem baseband.

What to do: Deploy device OEM firmware updates that incorporate Unisoc’s October 2026 security bulletin patches.

CVEs: CVE-2026-66086

Also today

Federal Bureau of Investigation (FBI) / ShinyHunters

Regarding an incident involving Federal Bureau of Investigation (FBI) / ShinyHunters, the FBI arrested a suspected co-conspirator linked to the ShinyHunters cybercrime group in connection with an incident affecting an FBI platform hosted by a third party.

What to do: Enforce strict third-party vendor access controls and conduct comprehensive supply chain risk reviews.

Tags: sonicwall-sma1000-series-appliances, bricksforge-wordpress-plugin, atlassian-data-center-products, citrix-netscaler-adc-and-netscaler-gateway, palo-alto-networks-pan-os-globalprotect, unisoc-modem-ota-stack, federal-bureau-of-investigation