cybr.cx — Daily Digest | October 12, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-88779 | Citrix NetScaler ADC / Gateway | CVSS: N/A
Citrix NetScaler ADC and NetScaler Gateway are being actively exploited via an out-of-bounds memory operation that can crash affected appliances. Given how widely these gateway products are deployed as network perimeters, a DoS condition here can effectively take down remote access for entire organisations. CISA's due date for remediation has already passed — if you haven't patched, you're behind.

⚠️ Actively exploited — CVE-2016-3081 | Apache Struts | CVSS: Critical
Yes, this one is back. Apache Struts' Dynamic Method Invocation remote code execution flaw from 2016 is seeing fresh exploitation in the wild. If you have legacy Java applications running on unpatched Struts instances — and more organisations than care to admit still do — attackers can execute arbitrary OS commands with no authentication required. Patch or disable DMI immediately.

⚠️ Actively exploited — CVE-2021-3199 | ONLYOFFICE Docs | CVSS: N/A
A path traversal flaw in ONLYOFFICE Docs allows attackers to achieve remote code execution by manipulating image upload parameters with /.. sequences, even in JWT-protected deployments. Active exploitation means threat actors are already targeting self-hosted document collaboration platforms. Upgrade or isolate instances with no internet exposure.

⚠️ Actively exploited — CVE-2023-22894 | Strapi | CVSS: N/A
Strapi's admin panel leaks sensitive user data — including API tokens and credentials — through unsanitised query filters. Attackers with any admin panel access can harvest details that may allow lateral movement into connected systems. Strapi versions affected may be end-of-life; migration to a supported release is strongly recommended over patching alone.

⚠️ Actively exploited — CVE-2015-5477 | ISC BIND | CVSS: High
A decade-old TKEY query processing bug in ISC BIND is once again being used to remotely crash DNS resolvers. A single malformed packet is sufficient — no authentication needed. Any internet-facing BIND instance that hasn't been updated since 2015 is a trivially exploitable target for DNS infrastructure disruption.

⚠️ Actively exploited — CVE-2015-3306 | ProFTPD | CVSS: High
ProFTPD's SITE CPFR / SITE CPTO commands can be abused by unauthenticated remote attackers to read and write arbitrary files on the server. This eleven-year-old vulnerability is still producing hits, almost certainly against legacy embedded systems and appliances shipping outdated FTP daemons. If ProFTPD is in your environment, verify the version immediately.

CVE-2026-108708 | Wukong HRM | CVSS: 8.8
A missing authorisation flaw in Wukong HRM means any authenticated employee can read payslips, salary records, and bank card data for the entire company — and also delete employees, departments, and contracts. The EmployeeAspect component silently elevates every caller to HR administrator. Organisations using this HR platform should restrict access and apply the fix at commit 186115e.

CVE-2026-108746 | Vearch 3.5.2–3.5.9 | CVSS: 8.8
Vearch's vector database cluster ignores stored read-only permission levels entirely, allowing authenticated non-root users to write or delete documents and escalate themselves toward cluster administrator via a crafted PUT /roles request. Any multi-tenant or shared Vearch deployment should be treated as compromised until upgraded beyond 3.5.9.

CVE-2026-108522 | Studio-Saelix Sencho ≤0.94.1 | CVSS: 8.3
The login endpoint in Sencho trusts the X-Forwarded-For header for authentication decisions, enabling remote attackers to spoof their identity and bypass authentication entirely. A public exploit already exists. Patch to the named commit (79b86dd) or remove internet exposure immediately.

CVE-2026-108865 | AmoyLab Unla ≤0.10.0 | CVSS: 8.2
Unla's OAuth2 server never actually authenticates resource owners during the authorisation code flow, meaning anyone can register a client, obtain a code, and exchange it for a valid token granting access to protected APIs and injected upstream credentials. A complete authentication control bypass in an OAuth gateway is about as bad as it gets architecturally.

CVE-2026-108758 | Easy!Appointments ≤1.6.0 | CVSS: 8.2
Unauthenticated attackers can modify any appointment in Easy!Appointments by supplying a sequential appointment ID without the expected hash, using a self-asserted manage_mode flag. This allows appointment hijacking, customer rebinding, and exposure of management tokens across the entire booking system.

Headline News

Cash App breach settlement surfaces eight-figure user exposure
A $15 million settlement is being distributed to up to 8.2 million current and former Cash App Investing customers following a data breach that exposed personal financial information. Eligible users may claim up to $2,500, but the more significant issue for practitioners is what the breach reveals about insider risk: the incident involved a former employee downloading reports containing customer data after their access should have been revoked. This is a textbook offboarding failure — terminated users retaining live access to production data exports. Financial services firms should treat this as a prompt to audit data access controls and ensure access revocation is automated and verified at offboarding, not left to manual processes.

Old CVEs, active attacks: CISA's KEV list goes vintage
This week's CISA Known Exploited Vulnerabilities additions include flaws from 2015 and 2016 — ISC BIND, ProFTPD, and Apache Struts — sitting alongside more recent entries. The persistence of decade-old CVEs in active exploitation campaigns is a reliable indicator of two things: attacker infrastructure scanning for unpatched legacy systems at scale, and the stubborn reality that patch coverage degrades over time in complex environments. Embedded systems, legacy application stacks, and long-lived virtual appliances are the usual suspects. Practitioners running vulnerability management programmes should specifically query their asset inventory for software versions associated with pre-2020 CVEs — the results are frequently surprising and the exposure is real.

Schrödinger's Feed

The quantum data feed is in a superposition of empty and incoming this cycle — no new items resolved to a definite state before publication. This is, fittingly, the most quantum thing that could have happened. We'll resume coverage when the waveform collapses into something with a CVSS score. Practitioners should keep an eye on post-quantum cryptography migration timelines regardless — NIST's PQC standards are now final, and the clock is running whether or not the news feed cooperates.

/dev/random

A researcher published a detailed teardown of a commercial spatial audio effect, reverse engineering it purely through signal analysis — feeding in test tones, measuring the output, and working backwards to reconstruct the underlying algorithm without ever touching the source code. What makes this relevant beyond audio nerd territory is the methodology: it's essentially a black-box cryptanalysis approach applied to DSP, the same pattern used to reverse engineer proprietary protocol implementations and obfuscated firmware. The original vendor presumably considered their algorithm protected by obscurity. They were wrong, and it took one determined person with a loopback cable and a spectrum analyser to prove it. Security through obscurity: not even safe from audio hobbyists in 2026.