CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →
‹Wed · 14 Oct 2026
All daily briefs →
Daily brief · UTC day

Wednesday, 14 October 2026

5 verified findings from 1 run · 3 updates to prior coverage · the settled record for this UTC day, in the classic brief order.

CriticalPatch Ivanti Connect Secure now, then check the appliance and its AD account for compromiseCVE-2026-104935 · exploited · 14 Oct 03:38Z
Criticality
Kind
Topic
Region
TL;DR · the day in one read
  1. 01Ivanti Connect Secure zero-day chain is exploited; its root step has no fix and it evades the Integrity Checker. Ivanti disclosed CVE-2026-104935 on 2026-10-13, an authentication bypass in Connect Secure that lets a remote unauthenticated attacker run commands, and says it is aware of limited exploitation; CISA listed it in KEV the same day. Volexity found a cluster it calls UTA0576 chaining it with a root escalation that Ivanti has not yet fixed, patching library code in memory only so Ivanti's Integrity Checker Tool sees no file change, and going after the appliance's Active Directory service account, LAPS passwords and BitLocker recovery keys. Fixed builds are 25.1.1.2, 25.1.3.0 and 25.1.3.1, and 22.8R2.5; a patched appliance that was exposed still needs a compromise check. →
  2. 02Microsoft patches an exploited Windows Shell zero-day that evades Mark of the Web protections on files and links. Microsoft's 2026-10-13 updates fix CVE-2026-96951, a Windows Shell flaw that lets an attacker evade Mark of the Web defenses once a user opens a crafted file or link sent by email or instant message, so Windows does not show the dialog the tag normally triggers. Microsoft marks it exploited and CISA added it to KEV the same day; no source names the actor, the payload or the victims. Rapid7 says Windows Server 2012 gets no patch, while Microsoft lists fixes for Server 2012 R2 and every later supported release. →
  3. 03German portal vendor reports an exploited zero-day and calls it AI-driven; police neither confirm nor deny that. Innocon, the Tangermünde developer of the "digitales Rathaus" citizen portal, said in an MDR report of 2026-10-13 that attackers found and exploited a vulnerability it did not know of in its software, run for Tangerhütte on systems of the state municipal IT provider KID; the portal was taken offline in September and four more communes pulled theirs as a precaution. Innocon says the attackers reached only test accounts and took no real data, and classifies the intrusion as AI-driven because of command speed and on-host tool development, which is the vendor's reading: the state criminal police can neither confirm nor deny it. No CVE, product version or fix is named. →

01Active threats, incidents & disclosures1 item

NOTABLENATOB3

Tangerhütte (Saxony-Anhalt): the vendor of the municipal citizen-portal software says attackers exploited a zero-day in it, classifies the intrusion as AI-driven, and four other communes took their portals offline

MDR AKTUELL reports on 2026-10-13 that the vendor of Tangerhütte's "digitales Rathaus" citizen portal says attackers found and exploited a vulnerability in its software that the vendor did not know of and for which no security update existed (MDR AKTUELL, 2026-10-13). The portal, an app-based service that went online in 2020, was taken offline in September, and MDR Sachsen-Anhalt reported on 2026-09-16 that the municipality said it had repelled an attack and gave no technical detail (MDR Sachsen-Anhalt, 2026-09-16). The software runs on systems that the state municipal IT provider KID operates for Tangerhütte; an IT employee noticed irregularities in the morning after the attack began at night, the server was isolated and cut from the internet, and the vendor analysed the secured logs on an offline notebook (MDR AKTUELL, 2026-10-13). Innocon told other affected communes, four of which also took their portals offline as a precaution although there was no sign of an attack on them, and says the attackers reached only test accounts and took no real data (MDR AKTUELL, 2026-10-13). Citizens could use the services only on paper for weeks (MDR AKTUELL, 2026-10-13).

The vendor classifies the intrusion as AI-driven for two reasons: commands were executed faster than copy-and-paste would allow, and the follow-on steps were not prepared in advance but developed on the city's server during the attack, whereas human attackers normally upload their own code and do not change it (MDR AKTUELL, 2026-10-13). That is the vendor's reading of its own logs. The state criminal police are investigating data espionage and can neither confirm nor deny an AI attack, and two professors told MDR the reading is plausible without having seen the logs (MDR AKTUELL, 2026-10-13). No CVE, product version, fixed release or entry vector is named.

We did not know about this vulnerability and it is quite tricky to find it. (translated from German)

We classify this as an AI attack. (translated from German)

MDR AKTUELL (Innocon managing director Hagen Woecht)
incident14 Oct 03:42Zsingle-sourceOpen finding →
Sources: MDR AKTUELL · MDR Sachsen-Anhalt
CRITICALCVE-2026-104935exploitedNATOA1

CVE-2026-104935, Ivanti Connect Secure: an authentication bypass chained to code execution is exploited as a zero-day, and the root-escalation step of the chain is still unpatched (CVSS 8.6)

Ivanti disclosed a vulnerability in limited versions of Connect Secure on 2026-10-13 and says it is aware of limited exploitation in the wild (Ivanti, 2026-10-13). Rapid7 describes CVE-2026-104935 as an authentication bypass by spoofing that lets a remote unauthenticated attacker run commands, and scores it CVSS 8.6 (Rapid7, 2026-10-13). CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog the same day (CISA, 2026-10-13). Volexity found the activity on 2026-10-05, tracks the operator as UTA0576, a previously unknown cluster it assesses with low confidence as criminal, and dates exploitation of a fully patched 22.8R2.4 appliance to 2026-10-03 (Volexity, 2026-10-13).

The chain has three steps. A request to the public login script welcome.cgi names a protected script in an X-DSCGI-PATH header, so the URL passes the authentication check while the header picks the destination. The upload script wu.cgi writes a file to disk before checking that it is a ZIP, and parallel requests run a Perl script before it is deleted. A root escalation then abuses the dsinvoked service's trust in the shared DSCache configuration store (Volexity, 2026-10-13). Ivanti tracks the first two steps under CVE-2026-104935 and has not fixed the root escalation, which it says will ship in a future release in the coming weeks (Volexity, 2026-10-13). Every command re-runs the whole chain over HTTPS with no web shell or backdoor, and the exploit patches library code in memory only, so Ivanti's Integrity Checker Tool, which looks for file changes, does not detect it; Volexity also found entries removed from the debug and audit logs (Volexity, 2026-10-13). The operator then went after the Active Directory service account stored on the appliance: LDAP queries for LAPS passwords, BitLocker recovery keys and password attributes, a Kerberoast-capable tool, password spraying, and packet capture of plaintext LDAP, HTTP Basic and NTLM traffic (Volexity, 2026-10-13).

At the time of disclosure, Ivanti is aware of limited exploitation in the wild.

Ivanti 2026-10-13

In the first week of October 2026, Volexity discovered an unknown threat actor, UTA0576, abusing a zero-day exploit chain to compromise a fully patched (at the time, version 22.8R2.4) Ivanti Connect Secure (ICS) VPN appliance.

because this exploit chain patches library code in memory only and restores configuration store data, the tool does not detect any modifications.

Ivanti is working on a fix for the privilege escalation vulnerability, and it will be included in a future release in the coming weeks.

Volexity 2026-10-13

apply the appropriate update on an emergency basis outside of normal patching cycles

Rapid7 2026-10-13
vulnerability14 Oct 03:38Zmulti-sourceOpen finding →
Sources: Ivanti · Volexity · Rapid7 · CISA · Canadian Centre for Cyber Security
HIGHCVE-2026-96951exploitedNATOA2

CVE-2026-96951, Windows Shell: a Mark of the Web bypass exploited as a zero-day, fixed in the 2026-10-13 cumulative updates and listed in CISA KEV (CVSS 8.8)

Microsoft's 2026-10-13 release fixes CVE-2026-96951, a Windows Shell security feature bypass that Microsoft marks as exploited and not publicly disclosed (Microsoft Security Response Center, 2026-10-13); CISA added it to its Known Exploited Vulnerabilities catalog the same day, citing evidence of active exploitation (CISA, 2026-10-13). Microsoft says an attacker who exploits it could evade Mark of the Web defenses, by sending a crafted file by email or instant message or enticing the user to click a link or open an attachment (Microsoft Security Response Center, 2026-10-13). Microsoft's record gives the root cause as improper neutralization of special elements in a command (command injection, CWE-77) (Microsoft Security Response Center, 2026-10-13). Rapid7 describes the effect as Windows not showing the dialog that says it protected the PC, because the tag that triggers it is bypassed, calls this the second exploited Windows Shell zero-day this year, and says the flaw also affected Outlook.com, patched in a build several weeks ago (Rapid7, 2026-10-13). Rapid7 says Windows Server 2012 receives no patch while Server 2012 R2 does (Rapid7, 2026-10-13), and Microsoft's record lists no Windows Server 2012 product for this flaw (Microsoft Security Response Center, 2026-10-13).

Triage: a file a user created or received from a trusted local source also carries no tag; the discriminator is an internet origin (mail, chat or web download) together with the absence of the tag on the opened item.

An attacker who successfully exploited the vulnerability could evade Mark of the Web (MOTW) defenses.

Microsoft Security Response Center 2026-10-13

Once again, the immediate prize for an attacker is a Mark of the Web (MOTW) bypass.

Windows Server 2012 doesn’t receive a patch, although Server 2012 R2 does.

Rapid7 2026-10-13

Builds on: Microsoft names two exploited Windows privilege-escalation zero-days, splitting the newest and…

vulnerability14 Oct 03:39Zmulti-sourceOpen finding →
Sources: Microsoft Security Response Center · Rapid7 · CISA
NOTABLECVE-2026-105899 +9NATOA2

Adobe October 2026 bulletins: unauthenticated CVSS 9.0 to 10.0 flaws, most leading to code execution, in ColdFusion (APSB26-144), Experience Manager (APSB26-152) and Commerce and Magento (APSB26-153), none reported exploited

Adobe's 2026-10-13 bulletins put critical fixes into three server products: ColdFusion, Experience Manager and Commerce. Adobe says it is not aware of any exploits in the wild for the ColdFusion issues (Adobe ColdFusion APSB26-144, 2026-10-13). ColdFusion 2025 up to 2025.0.13 and 2023 up to 2023.0.25 are affected and 2025.0.14 and 2023.0.26 fix them; the bulletin lists five network flaws that need no privileges at CVSS 9.0 or above: an unrestricted file upload leading to arbitrary code execution (CVE-2026-105899, 10.0), a server-side request forgery rated privilege escalation (CVE-2026-106622, 10.0), an input-validation flaw leading to code execution (CVE-2026-106624, 9.8), a code injection rated privilege escalation (CVE-2026-106621, 9.1) and a further input-validation code-execution flaw (CVE-2026-106619, 9.0, high complexity), besides code-execution flaws that need a low-privileged account at 9.9 (Adobe ColdFusion APSB26-144, 2026-10-13).

Experience Manager APSB26-152 covers Cloud Service 2026.9.28187 and earlier, 6.5 up to Service Pack 25 and 6.5 LTS up to Service Pack 3: three incorrect-authorization flaws that lead to arbitrary code execution are scored 10.0 with no privileges required (CVE-2026-90532, CVE-2026-48383, CVE-2026-48382), fixed by Cloud Service 2026.9.28386 and, on 6.5 and 6.5 LTS, by per-issue hotfixes, and Adobe is not aware of exploits of these either (Adobe Experience Manager APSB26-152, 2026-10-13). Commerce and Magento APSB26-153 fixes a template-engine injection leading to code execution (CVE-2026-103849, 10.0, which Adobe marks as needing no authentication) and an incorrect-authorization code-execution flaw (CVE-2026-92909, 9.8, which Adobe's note tags B2B) in builds up to the 2026-sep release; the fixes are the 2026-oct builds, Adobe Commerce B2B has its own 2026-oct builds, Magento Open Source gets them for 2.4.9, 2.4.8 and 2.4.7, and Adobe asks customers to apply the CVE-2026-75650 hotfix from its September APSB26-146 update as well, and Adobe is likewise not aware of exploits (Adobe Commerce APSB26-153, 2026-10-13).

Builds on: Adobe's August bulletins carry three separate unauthenticated, maximum-severity code-execution… · Adobe rates its own emergency hotfix priority 1 for a flaw stores were already being…

vulnerability14 Oct 03:41Zsingle-sourceOpen finding →
Sources: Adobe
NOTABLECVE-2026-70571 +1NATOA2

CVE-2026-70571, Microsoft Exchange Server: an unauthenticated crafted-email code-execution flaw in the October 2026 security updates, the last Exchange 2016 and 2019 updates under the paid ESU (CVSS 8.1)

Microsoft's October 2026 Exchange security updates, released on 2026-10-13, fix CVE-2026-70571, a stack-based buffer overflow in Exchange Server: an unauthenticated attacker could send a specially crafted email to an affected server, triggering an internal content-conversion process, with no user interaction (Microsoft Security Response Center, 2026-10-13). Microsoft rates it Critical (CVSS 8.1, high attack complexity) and Exploitation More Likely, and says exploitation requires a deep understanding of the target environment and is not guaranteed to succeed (Microsoft Security Response Center, 2026-10-13). CVE-2026-70279 is a cross-site scripting spoofing flaw (CVSS 9.3, also Exploitation More Likely): an attacker who persuades an administrator to click a crafted link could act with that administrator's privileges (Microsoft Security Response Center, 2026-10-13). Microsoft lists neither as exploited or publicly disclosed, and no other source reports exploitation.

The fixed builds are Exchange Server Subscription Edition RTM 15.02.2562.056, 2019 CU15 15.02.1748.055, 2019 CU14 15.02.1544.050 and 2016 CU23 15.01.2507.077 (Microsoft Security Response Center, 2026-10-13). The 2016 and 2019 updates are available only to organisations enrolled in the Period 2 ESU program, and October 2026 is the last month those customers receive newly released updates (Microsoft Exchange Team, 2026-10-13). After October, updates ship for Subscription Edition only, Microsoft's announcements and CVEs stop mentioning 2016 and 2019, and Microsoft says that does not mean those versions are not vulnerable and that it will stop testing them for vulnerabilities (Microsoft Exchange Team, 2026-10-13); buying Period 2 ESU later only gets an organisation current through this release (Microsoft Exchange Team, 2026-10-13). Exchange Online customers are already protected (Microsoft Exchange Team, 2026-10-13).

vulnerability14 Oct 03:40Zsingle-sourceOpen finding →
Sources: Microsoft Security Response Center · Microsoft Exchange Team

03Updates to prior coverage3 items

HIGHCVE-2026-25085 +19updatedNATOB2

Claroty Team82: 23 vulnerabilities in Copeland XWEB Pro supervisory refrigeration controllers chain to unauthenticated root RCE; a deterministic admin password derived from the device's own MAC address is one of THREE independent pre-auth paths

First published 2026-08-28 · open finding →

Updaterun 2026-10-14T0255Z-intelsummaryentitiessourcesevidencesourcing_notereferencesbody

CERT-FR revised its refrigeration-controller alert on 2026-10-13 to say it knows of numerous compromises of Copeland xweb controllers, in addition to Danfoss and Dixell units; it names no models, flaws or entry vector, so the earlier 'no exploitation reported' no longer describes the product family.

CERT-FR revised its alert on refrigeration-controller compromises on 2026-10-13: it now says it knows of numerous compromises of the remote controllers Danfoss AK-SM and AK-SC as well as Copeland xweb and Dixell xweb, that attack campaigns are probably still ongoing, and that access should come back only through a secure VPN or protected network, with filtering to the refrigeration contractors' source addresses accepted only as an emergency measure (CERT-FR, 2026-10-13). The alert names no Copeland models, no vulnerability and no entry vector, and does not tie the compromises to Claroty's findings, so it is not established that CVE-2026-25085 or any other flaw above was used.

Sources: Claroty Team82 · CERT-FR (alert CERTFR-2026-ALE-012, revised version)
HIGHexploitedupdatedNATOA2

Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb refrigeration controllers compromised, with forced defrost reported at hundreds of French supermarkets; CERT-FR and NCSC Switzerland say to remove internet exposure

First published 2026-10-13 · open finding →

Updaterun 2026-10-14T0255Z-inteltitleheadlinesummaryregionsentitiesaffected_productssourcesevidencesourcing_notereferencesactionsbody

CERT-FR revised its alert on 2026-10-13 to add Copeland xweb and Dixell xweb to the compromised controllers, says campaigns are probably still running, and says a factory reset alone is insufficient on an unpatched end-of-life unit. NCSC Switzerland published an advisory rating the activity actively exploited and naming the current AK-SM 800A on outdated firmware, and Danfoss says that is the case for the affected current units. Blick reports that Migros uses the same Danfoss systems in a limited number of Swiss stores and sees no sign they were targeted.

CERT-FR revised its alert on 2026-10-13: the list of compromised remote controllers now includes Copeland xweb and Dixell xweb besides Danfoss AK-SM and AK-SC, campaigns against these devices are probably still ongoing, and an unpatched end-of-life unit kept on the internet is very likely to be compromised, so a factory reset alone is insufficient (CERT-FR, 2026-10-13). NCSC Switzerland published advisory 13054 on 2026-10-13 with the exploitation status Actively Exploited. It lists the Danfoss AK-SM 800 (end of life, no longer patched), the AK-SC 355 (phased out, no longer patched) and the current AK-SM 800A series when it runs outdated firmware, says no fixes exist for the two older models and that Danfoss urges replacing them, and says the attack could affect other sectors, such as healthcare for specialized cooling equipment, so organisations should check whether affected devices are in use (NCSC Switzerland, 2026-10-13). Danfoss told Cooling Post that the AK-SM800 was declared end of life in 2021, that the AK-SC355 was phased out in 2016, and that the affected AK-SM800A systems ran outdated firmware (Cooling Post, 2026-10-12). Blick reports that Migros uses the same Danfoss refrigeration systems in a limited number of Swiss stores and sees no sign they were targeted, and that Aldi, Lidl and Coop say they are not affected (Blick, 2026-10-13); no source reports a Swiss victim. The advisory relays a six-step CERT-FR sequence (limit access to trusted addresses, factory reset, apply all fixes, rotate passwords and secrets, review accounts, reconfigure) and lists filtering to trusted addresses as a temporary measure (NCSC Switzerland, 2026-10-13), whereas the revised CERT-FR page puts removal of internet exposure first, accepts source-address filtering only as an emergency stop-gap and lists no secret rotation or account review (CERT-FR, 2026-10-13).

Sources: CERT-FR (alert CERTFR-2026-ALE-012) · AFP · BFMTV · Infosecurity Magazine · BleepingComputer · CERT-FR (alert CERTFR-2026-ALE-012, revised version) · NCSC Switzerland (Security Hub advisory 13054) · Cooling Post · Blick · Censys
HIGHCVE-2026-97229updatedNATOA2

CVE-2026-97229, GitLab CE/EE: an integer overflow in the CI/CD regular-expression compiler allows code execution on self-managed servers and now has a public proof of concept; fixed in 19.4.2, 19.3.5 and 19.2.8, and 19.4.1 does not close it (CVSS 10.0)

First published 2026-10-13 · open finding →

Updaterun 2026-10-14T0255Z-inteltitleheadlinesummarytagscvessourcesevidencesourcing_noteactionsbody

Rapid7 reported on 2026-10-13 that it reproduced arbitrary code execution on GitLab CE 19.4.1, published a proof of concept, and found no confirmed exploitation in the wild. The demonstrated path needs push access to a public project and then an unauthenticated CI lint request, so instances with open sign-up or public projects that untrusted users can write to are the exposed case.

Rapid7 reports that it independently reproduced arbitrary code execution on the official GitLab CE 19.4.1 image with address space layout randomization enabled, that the same input did not execute on the patched 19.4.2 image, and that it found no confirmed exploitation in the wild (Rapid7, 2026-10-13). Its testing shows the unauthenticated label needs a qualifier: the attacker must first push a malicious CI/CD configuration and a UTF-8 repository path to a branch in a public project, which an ordinary account can do where users may create public projects (Rapid7, 2026-10-13); the proof of concept then triggers it with a request without credentials (Rapid7 proof-of-concept README, 2026-10-13). A proof of concept went public the same day; its README says the included offsets were tested only against the 19.4.1 CE Linux amd64 image, that other builds need adjusted offsets, and that the generated payload is slightly larger than 2 GiB, needing about 9 GiB of memory on the test host (Rapid7 proof-of-concept README, 2026-10-13). The affected and fixed versions are unchanged.

Sources: GitLab (Critical Patch Release 19.4.2, 19.3.5, 19.2.8) · CERT-EU · NCSC Switzerland (Security Hub advisory) · BleepingComputer · GitLab (Critical Patch Release 19.4.1, 19.3.3, 19.2.7) · Rapid7 · Rapid7 researcher repository (proof-of-concept README)

04Action items7 items

Verification & coverage notes1 run

2026-10-14T0255Z-intel · Sonnet 5.5 · window 26 h · 5 entries published

Verification & coverage notes

Standard 26 h window (2026-10-13T00:55Z to 2026-10-14T02:55Z), 24.0 h after the 2026-10-13 fire. The container clock agreed with the network date header (skew 0 s) and the first fetch saw the 2026-10-13 run record, so the gap is real. The four sub-agents returned 37 candidate items (S1 12, S2 5, S3 8, S4 12; the Ivanti chain came back from S1 and S3, the refrigeration-controller revision from S2 and S4); five ship as new entries, three become changelog records and the rest are dropped below. This is the first fire to see the 2026-10-13 Patch Tuesday set, which the previous fire flagged as unread: S1 read the MSRC CVRF, Adobe's three server bulletins, Fortinet, Ivanti and SAP from the vendors' own tables. The mechanical KEV diff listed two NOT COVERED additions dated 2026-10-13 (CVE-2026-104935 Ivanti Connect Secure, CVE-2026-96951 Windows Shell) and both are new entries; no RANSOMWARE row. No deep dive. One critical: the Ivanti Connect Secure chain meets every element of the bar (newly disclosed, exploited, an unpatched companion step, defender action to the day).

Published (5):

  • 2026-10-14/cve-2026-104935-ivanti-connect-secure-zero-day-chain-kev (vulnerability, critical): exploited VPN-edge zero-day chain (Ivanti and CISA confirm, Volexity forensics), root step unfixed, invisible to the vendor's integrity tool; PD-11(b). No Swiss victim or deployment is reported, so the relevance ground is the product class on the perimeter of public-sector networks. S1 and S3 both returned it; S1's vendor metadata and S3's Volexity depth were merged. The hub advisory page is unreadable on every transport, so the build table is read through Rapid7 and the entry says so; the Canadian bulletin's different 25.x line label is carried as a stated discrepancy. NCSC.ch had no advisory yet at 03:10Z, so an NCSC.ch post is likely at the next fire.
  • 2026-10-14/cve-2026-96951-windows-shell-motw-bypass-zero-day-kev (vulnerability, high): Microsoft-flagged exploited zero-day on every supported Windows release, KEV-listed; PD-11(b). No actor, payload or victim is public. References the September Windows zero-day entry.
  • 2026-10-14/exchange-oct-2026-su-cve-2026-70571-last-2016-2019-update (vulnerability, notable): unauthenticated crafted-email RCE rated Exploitation More Likely, plus the last Exchange 2016 and 2019 update for ESU customers; PD-11(b) on the mechanics (internet-reachable mail path) and (a) for the ESU cut-off. Not exploited, AC:H, so notable and not high. The four Less-Likely elevation flaws and the earlier CVE-2026-96940 are left out of the entry.
  • 2026-10-14/adobe-october-2026-coldfusion-aem-commerce-unauth-critical (vulnerability, notable): ten unauthenticated network flaws at CVSS 9.0 to 10.0 across ColdFusion, Experience Manager and Commerce or Magento, Adobe aware of no exploitation; PD-11(b) on the mechanics (no account needed, internet-facing web platforms), same shape as the Campaign Classic and August ColdFusion entries. S1 listed four ColdFusion CVEs; the raw bulletin shows a fifth unauthenticated one (CVE-2026-106621, 9.1), which the entry carries. Magento Open Source 2.4.6 has no listed fix.
  • 2026-10-14/tangerhuette-digitales-rathaus-zero-day-municipal-portal (incident, notable): the vendor of a municipal citizen portal says a zero-day in its software was exploited and four other communes pulled their portals. PD-11(c) on the shared target profile (communal e-government portals hosted by a shared municipal IT provider); single source (MDR), vendor's own account, the AI classification is carried as the vendor's reading with the state criminal police neither confirming nor denying. S2 found the lead through Golem but could not read it; S4 read MDR.

Updated (3), each one record on the existing entry:

  • 2026-10-13/cve-2026-97229-gitlab-ci-regex-compiler-unauthenticated-rce (update, priority stays high): Rapid7 reproduced the code execution on 19.4.1 and published a proof of concept on 2026-10-13 and found no confirmed exploitation; the demonstrated path needs push access to a public project plus an unauthenticated CI lint request. Status moves to poc-public, title and headline drop the unqualified "unauthenticated", the exposure paragraph states the conditions Rapid7 found, and the action now carries Rapid7's interim controls. The sentence that no source reported a proof of concept was rewritten where it stood.
  • 2026-10-13/danfoss-ak-sm-ak-sc-french-supermarket-refrigeration-attack (update, priority stays high): CERT-FR revised its alert on 2026-10-13 to add Copeland xweb and Dixell xweb, say campaigns are probably still running and that a factory reset alone is insufficient on an unpatched end-of-life unit; NCSC Switzerland's advisory 13054 rates it actively exploited and names AK-SM 800A on outdated firmware. The revision rewrote CERT-FR's guidance (filtering to contractor addresses is now an emergency stop-gap, VPN or protected network is the target), so the two CERT-FR evidence quotes that the live page no longer carries were replaced and the title, summary, exposure, detection and takeaway were rewritten to today's text. S2 and S4 both returned it. The iteration-3 verifier found Blick's French edition, which reports that Migros uses the same Danfoss systems in a limited number of Swiss stores; the entry now says so and carries the switzerland region, and S2's earlier reading that no Swiss deployment was reported is superseded.
  • 2026-08-28/claroty-copeland-xweb-pro-refrigeration-unauth-root-rce (update, priority stays high): its "no exploitation reported" no longer describes the product family now that CERT-FR reports compromises of Copeland xweb controllers; the record says CERT-FR names no models, flaws or vector and does not tie the compromises to Claroty's findings, so no CVE status moved.

KEV dispositions: CVE-2026-104935 and CVE-2026-96951, new entries above. The CISA catalog page cannot be cited; the per-alert pages were used.

borderline-drop lines:

  • borderline-drop: Microsoft Patch Tuesday rollup beyond the exploited zero-day and Exchange (S1); the October release is the largest yet, but every other unauthenticated network flaw at CVSS 9.0 or above (DNS Server, DHCP Server, IIS, RRAS, Network Policy Server, Message Queuing, QUIC, LSASS, RPC Runtime, iSCSI, Failover Cluster, OpenSSH for Windows, PowerShell, Text Shaping, Windows Error Reporting and the others in S1's table) is rated Exploitation Less Likely or Unlikely, none is exploited or publicly disclosed; five zero-interaction Outlook preview-pane RCEs (CVE-2026-70242, CVE-2026-97749, CVE-2026-97016, CVE-2026-88156, CVE-2026-70291) are also Less Likely and none is exploited, so they ride the regular cycle. The publicly disclosed .NET Framework WDAC bypass CVE-2026-108398 needs a local foothold and the MessagePack-CSharp denial of service (5.3) is a library flaw. The lifecycle facts (Server 2012 and 2012 R2 ESU year 3 ends 2026-10-14, Office 2021 end of support 2026-10-14, Windows 10 commercial ESU year 1 ends 2026-10-13) were not published; the Windows entry states that Server 2012 gets no update.
  • borderline-drop: Cisco Nexus 3000 and 9000 NGOAM and MPLS OAM unauthenticated root RCE (CVE-2026-76485, CVE-2026-76486, CVE-2026-76501, CVE-2026-76465, CVSS 9.8) and License On-Prem (CVE-2026-20328, CVE-2026-76454, 9.1) (S1, lookback; Cisco 2026-10-07, NCSC.ch 2026-10-09), found in internal testing, no exploitation, reachable only through an OAM-enabled interface on the switch rather than the internet, and NCSC.ch already advised the Swiss constituency on 2026-10-09; regular patch cycle with Cisco's disable-the-feature mitigation.
  • borderline-drop: Fortinet October bundle (S1; FortiSIEM 7.5.0 CVE-2026-106173 9.4 on TCP 27918, FortiSandbox authentication bypass), vendor-only, not exploited, narrow affected builds (FortiSIEM 7.5.0 only), Fortinet's workaround restricts the port; the FortiMail zero-day entry is unchanged since 2026-10-07.
  • borderline-drop: Esri Portal for ArcGIS CVE-2026-69227 (S1; 9.8, patched 2026-09-24, CVE published 2026-10-13), a 20-day-old patch, the flaw needs a specific New Member default user type configuration, Esri states no exploitation although its vector carries exploit-code maturity High; no source puts a constituency deployment on the internet.
  • borderline-drop: OTRS CE 6 and Znuny CVE-2026-93582 (S1; 9.4), needs an HTTP Basic Authentication backend, 6.x is end of life, Znuny fixed it on 2026-09-16, no exploitation; AnyDesk CVE-2026-109390 (S1), fixed in 8.0.3 on 2026-06-23, only the CVE id is new; IBM WebSphere Liberty CVE-2026-93909 and CVE-2026-93895 (S1; 9.1), need the samlWeb-2.0 or grpc-1.0 feature, not exploited, interim fix available.
  • borderline-drop: S1's other drops, SAP Patch Day (no pre-auth RCE; the 9.9 flaws need authentication and the 10.0 is a developer library), Siemens and Schneider bundles, Chrome 155 and Firefox 158 (no exploitation statement), Docker Hub CVE-2026-105445, Ghostscript CVE-2026-39919, Commvault CVE-2026-77099, Metabase CVE-2026-103928, Ivanti Xtraction and Neurons Patch for Intune (authenticated).
  • borderline-drop: NCSC.ch advisories 13043 (Veeam Backup & Replication CVE-2025-64393, low-privileged to SYSTEM), 13035 (ILIAS) and 13022 (Zimbra CVE-2026-66911 and CVE-2026-66912, unauthenticated account takeover paths) (S1 catch-up leads; 2026-10-01 to 2026-10-09), all rated exploitation UNKNOWN by NCSC.ch, vendor pages not read this fire, no entry in the store; judged regular cycle on the hub text alone. The next audit should read the Veeam and Zimbra vendor pages, since both products are common in public administrations.
  • borderline-drop: BSI WID-SEC-2026-3757 revision 3 marking the SonicWall SMA1000 flaw exploited (S2); a third national authority restating the status the entry already carries from NCSC.ch; no new fact.
  • borderline-drop: Stadt Olten forged QR stickers on parking meters (S2), fraud against citizens with no SOC decision. Beyond Gravity (S2), no new detail, held in the backlog.
  • borderline-drop: North Korean IT workers, FBI PSA261013 and the CrowdStrike laptop-farm disruption (S3), US employer guidance and a US law-enforcement action, no constituency nexus, existing entries cover the cluster. MITRE ATT&CK v20 (S3), a framework release, not threat activity; the pin is stale (below). Luna Moth Files (S3), an unauthenticated leak of chat logs published about 2026-10-05, SRG calls it fake, no new technique. Fox-IT Cobalt Strike beacon corpus, Check Point LiteLLM CVE-2026-35029 and CVE-2026-59823 (authenticated), Barracuda hidden prompt injection in mail, the Dubrovsky arrest in the ShinyHunters case (S3), marginal for the constituency.
  • borderline-drop: Arcadia SpeeCAN RAIDEN municipal mass-notification breach in Japan (S4), out of region, no vector, no actor; the only lesson (suppliers concentrate contact lists) is generic. Stadt Eichstätt (S4), a Bavarian city with copied data and intact backups but no vector, no actor and no behavior (incident floor). HSZ-BW, Kreiskliniken Kassel, UK Housing Ombudsman, Amadeus heap dump, Ahold Delhaize and U.S.NEXT (S4), no vector or actor, out of nexus, or a single-source misconfiguration note. FTAPI dataset publication (S4; heise 2026-10-12, before the window), mostly marketing material plus an apparent customer list, the entry stays routine. Anthropic's report on unintended model actions with the Philadelphia police statement (S4), awareness only.

Backlog (state/coverage_backlog.md): three of the four open rows reached their 2026-10-14 expiry with the condition unmet and are struck: IBM Guardium CVE-2026-85542 (not in KEV catalog 2026.10.13, ACN alert unchanged, IBM's bulletins do not mention it, authenticated), and the SafePay and Payload claims on ARA-Region Lyss-Limpachtal and Netech (no press link on Ransomware.live, no victim statement). Beyond Gravity stays held on its named condition (a vector, an actor or the data class), expiry 2026-10-20, with nothing new from S2 and S4.

Contradictions and discrepancies carried in the entries: (1) Ivanti: the Canadian Centre for Cyber Security lists the 25.x affected line as 25.2.2 and prior, Rapid7's table of Ivanti's advisory says 25.1.2.2 and prior, and the advisory itself was unreadable. (2) GitLab: GitLab's CVSS carries no privilege requirement while Rapid7's reproduction needs push access to a public project. (3) Danfoss: NCSC Switzerland relays six CERT-FR remediation steps that the revised CERT-FR page no longer lists (it now has a different two-path guidance); the entry follows the live CERT-FR text. (4) Adobe: the ColdFusion summary says priority 2, its solution table priority 1; stated in the sourcing note.

Coverage gaps: hub-ivanti-advisory (JS-only on every transport; read through Rapid7 and Volexity); golem-security (consent wall on article bodies); justice-gov (Akamai and HTTP 401); swissinfo-ger (no feed or search route, jina credit spent); databreaches-net (article pages 403); tenable-research (undated feed served through the reader); vaud-soc-cyber-threat-review (no September edition posted); news-web-nhk (JS-rendered body); hsz-offline-de (HTTP 404 with the notice in the body); kreisklinikenkassel-de (stale snapshot).

Rotation and sources: slices were ranked on the derived rotation cursor (S1 14 standard or candidate records beyond 6 essential, S2 14 beyond 15, S3 14, S4 12); every essential record was attempted. S1 reported that ivanti-psirt, adobe-psirt, cisco-psirt, sap-security-notes and siemens-productcert were not in its slice yet carried the day's primaries; the notes on those records ask to rotate them into S1 on scheduled-release days. Metered reader calls: about six (S2 one, S3 two, S4 three), all fallbacks from extract or a speculative URL. One new candidate source, blick-ch; S3 proposed mitre-attack-updates and S4 scannetsecurity, left for a later fire. The source health sweep probed 242 of 242 records (240 relevant, one stale, one shell), no UNSOLVED item.

For the operator and the next audit, not acted on this fire: (1) the ATT&CK pin is v19.2 while v20 was released 2026-10-13 with nine new Enterprise technique ids and no revocations or deprecations, so existing mappings stay valid but v20 ids cannot be used until python3 tools/attack_data.py --update runs; (2) the Microsoft Digital Defense Report 2026 (published 2026-10-01) has no entry in the store; (3) the three NCSC.ch catch-up advisories above.

Verification: five cti-verification iterations, each walking the full claim ledger (176 to 183 claims, every one answered). Iteration 1 returned NEEDS_FIXES (25 findings: 14 truth, 5 editorial, 6 advisory), iteration 2 NEEDS_FIXES (10), iteration 3 NEEDS_FIXES (4 truth), iteration 4 NEEDS_FIXES (3 truth, 1 advisory) and iteration 5 NEEDS_FIXES with two low-confidence F3 findings. Every finding was tested against the cited page and fixed except two declined with reasons: the older Claroty entry's em dashes (pre-existing, normalised at render, outside this fire's own sections) and the out-of-cycle reading of the Adobe priority (the takeaway no longer claims urgency, the entry stays notable). The loop ends on the low-residual early exit of Phase 5.7 rule 5: iteration 5 returned truth plus editorial of 2 with no F1 or F4, both findings were fixed after the return, and no confirmation pass followed, so those two fixes were checked by the gate and the main agent only; verification_residual_count is 2. No double-CLEAN was reached. The defects that kept recurring were statements dated or attributed more precisely than their source (a reproduction date, an interview date, a citation closing the wrong claim), per-CVE bindings the vendor page does not make, and run notes claiming the entries carry something an earlier fix had removed. The Blick finding of iteration 3 (Migros uses the same Danfoss systems in a limited number of Swiss stores) corrected an earlier "no Swiss deployment" statement. A container restart lost the first iteration-5 spawn and it was respawned once; the working tree survived. Entries from this fire that the next quality audit should read independently: the five new entries and the Danfoss update, since no pass confirmed the final text.