Weekly Exploit Roundup

Generated 2026-10-13T08:00:11.313021+00:00 (UTC)

1. Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE
   Source: The Hacker News | Published: 2026-10-12T09:02:14+00:00 | Score: 27.416
   A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack.

   The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE). The

2. Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data
   Source: CISA Cybersecurity Advisories | Published: 2026-10-06T16:22:53+00:00 | Score: 27.349
   Advisory at a Glance Title Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data Original Publication October 8, 2026 Executive Summary Chinese government-linked cyber threat actors, enabled by the Integrity Technology Group, are combining automated scanning tools, large-scale botnets, and hands-on exploitation techniques to target and steal sensitive data from organizations worldwide, including US critical infrastructure sectors. These actors exploit vulnerabilities by using scanning tools, cross-site scripting attacks, and password spraying on Microsoft Exchange servers, while establishing persistence through VPN software and exfiltrating emails and credentials using scripts. To help mitigate against this activity, organizations should prioritize disabling unused services and ports, sanitizing web application inputs to prevent injection attacks, implementing multifactor authentication for all services, and applying timely p
3. Citrix Patches Critical NetScaler Flaw That Could Enable RCE in SAML Deployments
   Source: The Hacker News | Published: 2026-10-09T08:11:33+00:00 | Score: 20.248
   Citrix has released patches for yet another critical security flaw impacting NetScaler ADC and NetScaler Gateway that could result in remote code execution or denial-of-service (DoS) under certain conditions.

   "CVE-2026-107406 is a memory overflow vulnerability that may lead to remote code execution or denial-of-service under specific configuration conditions," Citrix said.

   The vulnerability

4. Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch
   Source: The Hacker News | Published: 2026-10-12T10:36:56+00:00 | Score: 16.963
   Threat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of public disclosure.

   The vulnerability, tracked as CVE-2026-102255 (CVSS score: 10.0), is a case of pre-authenticated server-side request forgery (SSRF) that could allow a remote attacker "to direct the appliance to issue requests on their

5. Critical SonicWall Vulnerability Exploited Days After Disclosure
   Source: SecurityWeek | Published: 2026-10-12T08:36:01+00:00 | Score: 16.303
   CVE-2026-102255 is a pre-authenticated SSRF flaw that could allow attackers to perform unauthorized operations. The post Critical SonicWall Vulnerability Exploited Days After Disclosure appeared first on SecurityWeek .
6. CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products
   Source: Rapid7 Cybersecurity Blog | Published: 2026-10-07T12:11:26+00:00 | Score: 15.839
   Overview On October 5, 2026, Atlassian published a security advisory for CVE-2026-21589 , a critical arbitrary file access vulnerability affecting eight products: Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. Atlassian assigned the vulnerability a CVSSv4 score of 9.3 . An unauthenticated remote attacker who knows a target file's exact name and path can access it within the application's web root; the vulnerability does not provide directory listing or enumeration. Atlassian's advisory treats all versions before the applicable fixed releases as affected, including unsupported versions. Affected Atlassian Cloud products have already been patched, and no action is required from Cloud customers. Detailed technical analysis and file-read proof-of-concept scripts are public, so Rapid7 recommends patching on an emergency basis, outside of normal patch cycles, and revi
7. Bricksforge WordPress Plugin Vulnerability Exploited in the Wild
   Source: SecurityWeek | Published: 2026-10-12T13:14:37+00:00 | Score: 14.442
   The vulnerability tracked as CVE-2026-85097 can allow threat actors to take control of the targeted WordPress websites. The post Bricksforge WordPress Plugin Vulnerability Exploited in the Wild appeared first on SecurityWeek .
8. Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge
   Source: The Hacker News | Published: 2026-10-09T12:47:26+00:00 | Score: 12.885
   Threat actors have been observed exploiting two recently disclosed flaws in the AhsayCBS backup utility to seize control of affected devices and deploy web shells and XMRig cryptocurrency miners.

   Details of the flaws are below –

   CVE-2026-105133 (CVSS v4 score: 5.5) – An improper authentication vulnerability in the checkSysPwd() function in the "com/ahsay/obs/api/ApiStructsAction.java"

9. Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies
   Source: The Hacker News | Published: 2026-10-09T12:21:51+00:00 | Score: 12.873
   The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added five security flaws to its Known Exploited Vulnerabilities (KEV) catalog, following their abuse by a China-linked threat actor known as Flax Typhoon.

   The vulnerabilities in question are listed below –

   CVE-2015-3306 (CVSS score: 10.0) – An improper access control vulnerability in ProFTPD that could allow

10. Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details
    Source: The Hacker News | Published: 2026-10-07T11:49:26+00:00 | Score: 11.428
    Threat actors have begun to exploit a newly disclosed critical security flaw impacting Atlassian Data Center products that could allow access to sensitive files under certain conditions.

    The arbitrary file access flaw, tracked as CVE-2026-21589 (CVSS score: 9.3) affects multiple products, including Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software

End of report.