Comparing 22 October 2026 with the previous day 15 October 2026.
Microsoft attributes the ConnectWise supply-chain attack to a Chinese state actor using automated AI agents (ARTEX) and applying the same techniques globally against other organizations.
The collaboration of two state-backed groups in a purely destructive attack on a grain logistics company shows that Sandworm shares its wiper capabilities with partners and deliberately targets food-industry supply chains.
The use of an AI agent framework in a state-sponsored supply chain attack on ConnectWise Cloud Backup demonstrates the increasing automation of state cyber operations.
APT41 is reviving a known UEFI bootkit technique through a Secure Boot flaw that has been patched for years, demonstrating that boot-level persistence still works without an updated Secure Boot database (Windows UEFI CA 2023).
The incident shows that compromised credentials from a backup/MSP provider can serve as an entry point into Microsoft 365 tenants, demonstrating supply-chain risks beyond classic software vulnerabilities.
CISA publishes an ICS advisory on a Siemens SIMATIC S7-1500 CPU without listing CVE IDs, so the concrete scope of the vulnerability remains unclear.
The advisory highlights the attack surface of the integrated web servers in SIMATIC S7 controllers without providing specific CVE or patch information.
The CISA advisory on Siemens WinCC does not list any CVE IDs, so severity and exploitability remain unclear.
No changes in this category.
The report describes PEERSTITCH, a newly uncovered stealthy implant that persists on FortiGate devices via the management layer (FortiManager) rather than a plain firmware flaw, so patch information alone is not sufficient.
The report describes a deserialization vulnerability in .NET Framework but provides no information on active exploitation, affected versions, or patch availability.
The alert provides no details beyond patch information, such as active exploitation, exploit code, or threat actor groups.
Pure NVD report with no indication of active exploitation, PoC, or attacker TTPs; it therefore provides no strategic assessment beyond patch information.
The NVD report provides no information beyond patch information; no active exploitation or attack campaign is documented.
The report contains no evidence of active exploitation or attacker TTPs, only a description of the vulnerability.
The report contains no information beyond the pure CVE description, in particular no indications of active exploitation, affected sectors, or attacker TTPs.
The advisory contains no information beyond the pure CVE description, in particular no indication of active exploitation, affected versions, or attacker TTPs.
The report contains no information on active exploitation, PoC, or patch availability and thus does not go beyond the plain CVE description.
The report contains no information about active exploitation, exploit code, or attack campaigns and is limited to the NVD description of the vulnerability.
The report contains no indication of active exploitation, attacker TTPs, or affected sectors, and therefore does not go beyond pure patch information.
The report provides no indication of active exploitation, a public exploit, or an attack campaign and therefore does not go beyond patch information.
The report only provides the CVE description without details on active exploitation, exploit availability, or patch status.
The report provides no details beyond the pure patch information regarding exploitation or active attacks.
The alert contains no information beyond the pure CVE description about active exploitation, attacker TTPs, or affected sectors.
The report contains no information on active exploitation, attacker TTPs, or affected sectors, and thus does not go beyond pure patch information.
The report provides no information beyond patch details about active exploitation, affected sectors, or strategic campaigns.
The alert contains no information beyond the pure CVE description, in particular no indication of active exploitation or TTPs.
The report provides no indication of active exploitation, public exploits, or attacker TTPs and therefore adds nothing beyond basic patch information.
A pure CVE report with no information on active exploitation, public PoC, attacker TTPs, or affected sectors , it therefore provides no insight beyond the patch information.
Beyond pure patch information, the advisory provides no evidence of active exploitation, attacker TTPs or targeted sectors; the core issue is an unauthenticated network RCE in a standard Windows library.
No additional information beyond the pure patch information.
The report contains no information about active exploitation or attack campaigns; it is a pure vulnerability description.
The vulnerability requires social engineering of an authorized user and allows JavaScript execution in the browser, which can lead to unauthorized PLC operations.
Beyond a pure patch note, this vulnerability shows that a social-engineering vector via crafted trace files can lead directly to unauthorized PLC operations within the logged-in operator's privileges.
The NVD entry provides nothing beyond bare patch information , there are no indications of active exploitation, a public exploit, affected sectors, or attacker TTPs.
Pure CVE report with no information on exploitation in the wild, proof of concept, or attacker campaign , the added value is limited to the patch information itself.
The report contains no information about active exploitation, exploit code, or affected sectors and therefore does not go beyond pure CVE/patch information.
The report goes no further than the bare patch information: there are no details on active exploitation, threat actors, TTPs or affected sectors.
This report contains no details beyond the pure patch information.
The report only provides the NVD entry for the Word vulnerability; it lacks any information on active exploitation, PoC availability, or attacker TTPs, so it offers no value beyond the bare patch information.
The alert contains no indications of active exploitation, attacker TTPs, or affected sectors and therefore does not go beyond pure CVE/patch information.
The report contains no information beyond the pure CVE description, in particular no indication of active exploitation or specific attack methods.
The NVD entry describes a network-based RCE in Microsoft Word but names neither active exploitation nor a PoC or KEV listing.
This report adds no information beyond the pure CVE description, as neither active exploitation nor patch details are mentioned.
Pure patch information with no indication of active exploitation, PoC, or KEV listing.
The report provides no information beyond the pure CVE description; no active exploitation or attacker TTPs are mentioned.
The report describes a path traversal vulnerability in Microsoft SharePoint that allows an authorized attacker to execute code over the network; there are no indications of active exploitation.
The report describes an RCE vulnerability in Microsoft Word, but without evidence of active exploitation or exploit code.
The alert describes only the vulnerability itself; neither a proof-of-concept nor active exploitation or attacker TTPs are mentioned.
The report describes a vulnerability in Microsoft NDES but provides no indication of active exploitation, affected versions, or attacker TTPs.
The report describes only the vulnerability itself; there is no indication of active exploitation, public proof-of-concept code, or specific attacker TTPs, so it provides no information beyond the plain patch advisory.
The attack vector is not memory corruption but social engineering: anyone holding the "Read diagnostics" function right who imports a crafted trace file executes foreign JavaScript in their browser that can trigger PLC operations within the scope of their own authorization , importing diagnostic artefacts must therefore be treated as a privileged, tamperable channel.
Pure CVE report with no indication of active exploitation, exploit code, or threat actors.
Beyond the pure CVE description, the report contains no indications of active exploitation, attackers, TTPs, or affected sectors.
The report contains no details beyond patch information; there are no indications of active exploitation, an exploit, or KEV inclusion.
This alert contains no information beyond the plain CVE description, particularly no indication of active exploitation, exploit code, or affected victims.
Beyond the basic NVD description, the item contains no indication of active exploitation, exploit code, or attacker TTPs and therefore adds no insight beyond plain patch information.
The report describes a denial-of-service vulnerability in the Windows DNS service but provides no indication of active exploitation or technical details.
The report contains no information beyond the pure vulnerability description: no active exploitation, no victim sectors, no attacker TTPs.
There is no indication of active exploitation, an exploit, or KEV inclusion , the report is a pure NVD advisory.
Beyond the bare patch information, the entry names no attacker TTPs, no proof-of-concept code and no indication of active exploitation , the exploit status remains open.
The report contains no information beyond the pure CVE description, in particular no indication of active exploitation, exploit code, or specific threat actors.
The report contains no details beyond the pure CVE information, such as exploitability, active campaigns, or affected sectors.
The NVD entry only provides a brief description of a use-after-free flaw in the Remote Desktop Client , details on in-the-wild exploitation, proof-of-concept code, affected versions, or CVSS score are missing.
The report only provides the NVD description of a use-after-free vulnerability in the Remote Desktop Client; there are no indications of active exploitation, victim groups, or TTPs.
The report contains no information beyond the NVD description; no indication of active exploitation, PoC, or attacker TTPs.
Beyond the bare patch information, the NVD entry provides no indication of active exploitation, proof-of-concept code, or attribution to a threat actor.
The report is a plain CVE publication with no indication of active exploitation, proof-of-concept code, or CISA KEV listing, and therefore adds nothing beyond the patch information.
The report merely describes a use-after-free vulnerability in Remote Desktop Client with possible RCE; it provides no evidence of active exploitation, affected versions, or attacker TTPs.
The NVD entry contains no evidence of exploitation in the wild, no public exploit code and no KEV listing, so it does not go beyond plain patch information.
No information beyond the patch itself; there is no indication of active exploitation, exploit code, or strategic implications.
The report adds beyond patch information that missing filename validation in the SIMATIC S7 webserver API client library can lead to arbitrary file writes and overwriting of existing files.
Beyond the bare CVE description, the report contains no indication of active exploitation, attacker TTPs, or affected sectors.
The report contains no details beyond the patch information, such as exploit code, exploitation status, or attacker TTPs.
The item is a bare NVD entry for the vulnerability and provides no indication of active exploitation, proof-of-concept code, or an attributable threat actor.
The report provides no information beyond the CVE description, in particular no indication of active exploitation or exploit code.
The alert provides only the NVD short description of the vulnerability and no indications of active exploitation, exploit code, or threat actors.
The report provides no insights beyond patch information: no active exploitation, TTPs, or affected sectors are mentioned.
The report contains no information beyond the pure CVE description; there are no indications of active exploitation, exploit code, or affected sectors.
The report describes a vulnerability in Microsoft Excel without providing evidence of active exploitation or attacker TTPs; it therefore does not go beyond patch information.
The report contains no information beyond the CVE description, particularly no indication of active exploitation or threat actors.
The report contains no information beyond the pure vulnerability description; there are no indications of active exploitation or attack tactics.
This report provides no insights beyond pure patch information, as no active exploitation or attack campaign is known.
Unlike a plain patch notice, the risk here is not a network attack but the combination of social engineering and the "Read diagnostics" function right: anyone allowed to import trace files from external sources can load scriptable content into their own browser session via the Trace page error message.
Beyond patch information, the report describes a social engineering attack vector via crafted CSV trace files that leads to JavaScript execution in the browser within an industrial diagnostics environment.
The flaw combines classic social engineering with an XSS issue in an engineering component: importing a crafted CSV trace file allows attacker-controlled JavaScript to perform PLC operations within the victim's browser session, bypassing network perimeter and authentication controls.
The attack path does not run over the network but through an authorised user importing a crafted CSV trace file , classic perimeter controls do not apply here.
The alert contains no details beyond patch information, such as active exploitation, affected sectors, or TTPs.
The report provides no indication of active exploitation or strategic relevance; it merely describes a local vulnerability in Microsoft Windows.
The report contains no information beyond the bare CVE description, in particular no indications of active exploitation, PoC code, or specific attack tactics.
The report provides no information beyond the plain CVE description; there are no indications of active exploitation or a public exploit.
The report contains no indication of active exploitation, a PoC, or strategic attacker links and merely describes a local privilege escalation in Windows Update.
No insights beyond patch information; the report describes only a local privilege escalation in Windows OLE with no indication of active exploitation.
No additional information beyond the bare CVE description; no active exploitation or attack campaign known.
The report describes a local privilege escalation in Windows MDM; beyond the patch information, no active exploitation or strategic impact is currently known.
The alert contains no details beyond the pure CVE/patch information, in particular no indication of active exploitation.
A bare CVE publication with no information on active exploitation, PoC, or attacker TTPs , no added insight beyond the patch information.
A BIOS test key left in the UEFI Secure Boot key database points to inadequate key hygiene in the firmware supply chain and allows Secure Boot to be fully bypassed with local access.
The report merely describes a local privilege escalation in WSUS due to incorrect default permissions; there is no indication of active exploitation, specific victims, or attacker TTPs.
Beyond patch information, the alert adds little: it is a DoS flaw in Netlogon that per the description is only exploitable by an already authorized attacker, so the risk becomes relevant mainly in combination with prior compromise or abuse of valid accounts.
Pure CVE advisory with no indication of active exploitation, exploit code, or attacker TTPs; the added value is limited to patch information.
The alert contains no evidence of active exploitation or attacker TTPs and does not go beyond the plain CVE description.
The report contains only the NVD description of the vulnerability without evidence of active exploitation, an exploit, or an attacker campaign.
The report contains no information beyond the patch details indicating active exploitation or attacker TTPs.
This report contains no indication of active exploitation or an attack campaign and merely describes a local privilege escalation in Windows Storage.
The report contains no information about active exploitation, affected attack vectors, or TTPs and does not go beyond the pure CVE description.
This report contains no details beyond patch information, such as active exploitation, exploit code, or threat actor groups.
The report describes a local privilege escalation in Windows Kerberos; there is no indication of active exploitation or an attack campaign.
The report contains no indication of active exploitation, a public PoC, or KEV listing; it merely describes the vulnerability.
The report contains no indications of active exploitation, public exploits, or threat actors; it solely describes a local privilege escalation in the Windows kernel.
The NVD entry contains no indication of active exploitation, public exploit code, or CISA KEV inclusion; it solely describes the vulnerability itself.
The vulnerability allows cross-channel plaintext recovery via chosen-plaintext lengths when compression is negotiated, which requires an assessment of compression usage beyond a simple patch.
This is a purely local privilege escalation that already requires the ability to execute low-privileged code, making it primarily dangerous in combination with an initial foothold.
The vulnerability allows unauthenticated RCE in Windows IKEv2, but only affects systems with specific IPsec configuration; a CVSS of 8.1 underlines the urgency.
Beyond the bare patch information, the report provides no indication of active exploitation, exploit code, or a threat actor.
The NVD entry provides no details beyond patch information, particularly no evidence of active exploitation, affected sectors, or attacker TTPs.
The report contains no insights beyond pure patch information; there are no indications of active exploitation or strategic relevance.
The report merely describes a local information disclosure in the Windows CD-ROM driver without indications of active exploitation or additional TTPs.
It is not the controller itself but the .NET client library of the S7 webserver API that is affected: it writes restore passwords unfiltered into HTTP error messages, turning centrally collected diagnostic and log data into a credential source for PLC backups.
The report merely describes a local information disclosure in the Windows kernel with no indication of active exploitation or a threat campaign.
The report describes a critical, remotely exploitable memory corruption in the Linux kernel (RACK/TCP) published without active exploitation or a PoC.
The flaw requires pre-existing local code execution with elevated privileges, which limits the attack vector; no CVE has been assigned.
The BSI report contains no CVE IDs, CVSS scores, or evidence of active exploitation, and therefore provides no details beyond general patch information.
The report contains no information beyond the patch details regarding active exploitation, attack tactics, or affected sectors.
The report summarizes the October patches and highlights an already exploited Windows Shell bypass as well as critical DHCP and Exchange flaws as priorities.
The report highlights that the PaperCut flaws are already actively exploited and the UniFi vulnerabilities affect numerous products, increasing urgency for affected environments.
The report describes a new defense-evasion technique that blocks Defender updates without stopping the service , enabling detection gaps without triggering the usual service-down alarm.
Check Point shows that BTR.sys, a driver built into Windows Defender, can be abused as a living-off-the-land driver for kernel operations when SeLoadDriverPrivilege is held, and is tracked neither by the Microsoft Vulnerable Driver Blocklist nor by the LOLDrivers project.
The report summarizes multiple unspecified Linux kernel vulnerabilities without providing CVE IDs or CVSS scores, complicating prioritization.
Without a CVE reference, the vulnerability cannot be clearly identified, which complicates prioritization for administrators.
The BSI advisory bundles multiple local denial-of-service vulnerabilities in the Linux kernel without naming specific CVE IDs or active exploitation.
This is an updated aggregate advisory without CVE details or signs of active exploitation; exposure depends solely on the installed Adobe Creative Cloud version.
The BSI has updated its warning about multiple OpenSSH vulnerabilities that allow remote attackers to bypass security measures, cause denial of service, or escalate privileges.
The vulnerability resides in the processing of SquashFS archives and requires opening a specially crafted file in order to disclose information.
The report updates a previous BSI warning about GNU libc without providing new CVE IDs or details, leaving unclear which specific vulnerabilities have been added.
The BSI advisory summarises multiple vulnerabilities in Chrome and Edge without naming CVE IDs or exploitation details.
BSI reports multiple vulnerabilities in Synology DSM without CVE IDs, which complicates timely prioritization and patch planning.
The BSI is widening its warning: not only large industrial plants but also operators of small networked systems are targets of OT attacks comparable to the one on the cooling-system controls of French supermarkets.
This attack is not extortion but silent monetisation: compromised routers and NAS devices are enrolled as exit nodes in a commercial residential proxy network, which ruins the organisation's own IP reputation and triggers third-party abuse reports without any visible ransom demand.