2026-10-14T0255Z-intel

Verification & coverage notes

Standard 26 h window (2026-10-13T00:55Z to 2026-10-14T02:55Z), 24.0 h after the 2026-10-13 fire. The container clock agreed with the network date header (skew 0 s) and the first fetch saw the 2026-10-13 run record, so the gap is real. The four sub-agents returned 37 candidate items (S1 12, S2 5, S3 8, S4 12; the Ivanti chain came back from S1 and S3, the refrigeration-controller revision from S2 and S4); five ship as new entries, three become changelog records and the rest are dropped below. This is the first fire to see the 2026-10-13 Patch Tuesday set, which the previous fire flagged as unread: S1 read the MSRC CVRF, Adobe's three server bulletins, Fortinet, Ivanti and SAP from the vendors' own tables. The mechanical KEV diff listed two NOT COVERED additions dated 2026-10-13 (CVE-2026-104935 Ivanti Connect Secure, CVE-2026-96951 Windows Shell) and both are new entries; no RANSOMWARE row. No deep dive. One critical: the Ivanti Connect Secure chain meets every element of the bar (newly disclosed, exploited, an unpatched companion step, defender action to the day).

Published (5):

• 2026-10-14/cve-2026-104935-ivanti-connect-secure-zero-day-chain-kev (vulnerability, critical): exploited VPN-edge zero-day chain (Ivanti and CISA confirm, Volexity forensics), root step unfixed, invisible to the vendor's integrity tool; PD-11(b). No Swiss victim or deployment is reported, so the relevance ground is the product class on the perimeter of public-sector networks. S1 and S3 both returned it; S1's vendor metadata and S3's Volexity depth were merged. The hub advisory page is unreadable on every transport, so the build table is read through Rapid7 and the entry says so; the Canadian bulletin's different 25.x line label is carried as a stated discrepancy. NCSC.ch had no advisory yet at 03:10Z, so an NCSC.ch post is likely at the next fire.
• 2026-10-14/cve-2026-96951-windows-shell-motw-bypass-zero-day-kev (vulnerability, high): Microsoft-flagged exploited zero-day on every supported Windows release, KEV-listed; PD-11(b). No actor, payload or victim is public. References the September Windows zero-day entry.
• 2026-10-14/exchange-oct-2026-su-cve-2026-70571-last-2016-2019-update (vulnerability, notable): unauthenticated crafted-email RCE rated Exploitation More Likely, plus the last Exchange 2016 and 2019 update for ESU customers; PD-11(b) on the mechanics (internet-reachable mail path) and (a) for the ESU cut-off. Not exploited, AC:H, so notable and not high. The four Less-Likely elevation flaws and the earlier CVE-2026-96940 are left out of the entry.
• 2026-10-14/adobe-october-2026-coldfusion-aem-commerce-unauth-critical (vulnerability, notable): ten unauthenticated network flaws at CVSS 9.0 to 10.0 across ColdFusion, Experience Manager and Commerce or Magento, Adobe aware of no exploitation; PD-11(b) on the mechanics (no account needed, internet-facing web platforms), same shape as the Campaign Classic and August ColdFusion entries. S1 listed four ColdFusion CVEs; the raw bulletin shows a fifth unauthenticated one (CVE-2026-106621, 9.1), which the entry carries. Magento Open Source 2.4.6 has no listed fix.
• 2026-10-14/tangerhuette-digitales-rathaus-zero-day-municipal-portal (incident, notable): the vendor of a municipal citizen portal says a zero-day in its software was exploited and four other communes pulled their portals. PD-11(c) on the shared target profile (communal e-government portals hosted by a shared municipal IT provider); single source (MDR), vendor's own account, the AI classification is carried as the vendor's reading with the state criminal police neither confirming nor denying. S2 found the lead through Golem but could not read it; S4 read MDR.

Updated (3), each one record on the existing entry:

• 2026-10-13/cve-2026-97229-gitlab-ci-regex-compiler-unauthenticated-rce (update, priority stays high): Rapid7 reproduced the code execution on 19.4.1 and published a proof of concept on 2026-10-13 and found no confirmed exploitation; the demonstrated path needs push access to a public project plus an unauthenticated CI lint request. Status moves to poc-public, title and headline drop the unqualified "unauthenticated", the exposure paragraph states the conditions Rapid7 found, and the action now carries Rapid7's interim controls. The sentence that no source reported a proof of concept was rewritten where it stood.
• 2026-10-13/danfoss-ak-sm-ak-sc-french-supermarket-refrigeration-attack (update, priority stays high): CERT-FR revised its alert on 2026-10-13 to add Copeland xweb and Dixell xweb, say campaigns are probably still running and that a factory reset alone is insufficient on an unpatched end-of-life unit; NCSC Switzerland's advisory 13054 rates it actively exploited and names AK-SM 800A on outdated firmware. The revision rewrote CERT-FR's guidance (filtering to contractor addresses is now an emergency stop-gap, VPN or protected network is the target), so the two CERT-FR evidence quotes that the live page no longer carries were replaced and the title, summary, exposure, detection and takeaway were rewritten to today's text. S2 and S4 both returned it. The iteration-3 verifier found Blick's French edition, which reports that Migros uses the same Danfoss systems in a limited number of Swiss stores; the entry now says so and carries the switzerland region, and S2's earlier reading that no Swiss deployment was reported is superseded.
• 2026-08-28/claroty-copeland-xweb-pro-refrigeration-unauth-root-rce (update, priority stays high): its "no exploitation reported" no longer describes the product family now that CERT-FR reports compromises of Copeland xweb controllers; the record says CERT-FR names no models, flaws or vector and does not tie the compromises to Claroty's findings, so no CVE status moved.

KEV dispositions: CVE-2026-104935 and CVE-2026-96951, new entries above. The CISA catalog page cannot be cited; the per-alert pages were used.

borderline-drop lines:

• borderline-drop: Microsoft Patch Tuesday rollup beyond the exploited zero-day and Exchange (S1); the October release is the largest yet, but every other unauthenticated network flaw at CVSS 9.0 or above (DNS Server, DHCP Server, IIS, RRAS, Network Policy Server, Message Queuing, QUIC, LSASS, RPC Runtime, iSCSI, Failover Cluster, OpenSSH for Windows, PowerShell, Text Shaping, Windows Error Reporting and the others in S1's table) is rated Exploitation Less Likely or Unlikely, none is exploited or publicly disclosed; five zero-interaction Outlook preview-pane RCEs (CVE-2026-70242, CVE-2026-97749, CVE-2026-97016, CVE-2026-88156, CVE-2026-70291) are also Less Likely and none is exploited, so they ride the regular cycle. The publicly disclosed .NET Framework WDAC bypass CVE-2026-108398 needs a local foothold and the MessagePack-CSharp denial of service (5.3) is a library flaw. The lifecycle facts (Server 2012 and 2012 R2 ESU year 3 ends 2026-10-14, Office 2021 end of support 2026-10-14, Windows 10 commercial ESU year 1 ends 2026-10-13) were not published; the Windows entry states that Server 2012 gets no update.
• borderline-drop: Cisco Nexus 3000 and 9000 NGOAM and MPLS OAM unauthenticated root RCE (CVE-2026-76485, CVE-2026-76486, CVE-2026-76501, CVE-2026-76465, CVSS 9.8) and License On-Prem (CVE-2026-20328, CVE-2026-76454, 9.1) (S1, lookback; Cisco 2026-10-07, NCSC.ch 2026-10-09), found in internal testing, no exploitation, reachable only through an OAM-enabled interface on the switch rather than the internet, and NCSC.ch already advised the Swiss constituency on 2026-10-09; regular patch cycle with Cisco's disable-the-feature mitigation.
• borderline-drop: Fortinet October bundle (S1; FortiSIEM 7.5.0 CVE-2026-106173 9.4 on TCP 27918, FortiSandbox authentication bypass), vendor-only, not exploited, narrow affected builds (FortiSIEM 7.5.0 only), Fortinet's workaround restricts the port; the FortiMail zero-day entry is unchanged since 2026-10-07.
• borderline-drop: Esri Portal for ArcGIS CVE-2026-69227 (S1; 9.8, patched 2026-09-24, CVE published 2026-10-13), a 20-day-old patch, the flaw needs a specific New Member default user type configuration, Esri states no exploitation although its vector carries exploit-code maturity High; no source puts a constituency deployment on the internet.
• borderline-drop: OTRS CE 6 and Znuny CVE-2026-93582 (S1; 9.4), needs an HTTP Basic Authentication backend, 6.x is end of life, Znuny fixed it on 2026-09-16, no exploitation; AnyDesk CVE-2026-109390 (S1), fixed in 8.0.3 on 2026-06-23, only the CVE id is new; IBM WebSphere Liberty CVE-2026-93909 and CVE-2026-93895 (S1; 9.1), need the samlWeb-2.0 or grpc-1.0 feature, not exploited, interim fix available.
• borderline-drop: S1's other drops, SAP Patch Day (no pre-auth RCE; the 9.9 flaws need authentication and the 10.0 is a developer library), Siemens and Schneider bundles, Chrome 155 and Firefox 158 (no exploitation statement), Docker Hub CVE-2026-105445, Ghostscript CVE-2026-39919, Commvault CVE-2026-77099, Metabase CVE-2026-103928, Ivanti Xtraction and Neurons Patch for Intune (authenticated).
• borderline-drop: NCSC.ch advisories 13043 (Veeam Backup & Replication CVE-2025-64393, low-privileged to SYSTEM), 13035 (ILIAS) and 13022 (Zimbra CVE-2026-66911 and CVE-2026-66912, unauthenticated account takeover paths) (S1 catch-up leads; 2026-10-01 to 2026-10-09), all rated exploitation UNKNOWN by NCSC.ch, vendor pages not read this fire, no entry in the store; judged regular cycle on the hub text alone. The next audit should read the Veeam and Zimbra vendor pages, since both products are common in public administrations.
• borderline-drop: BSI WID-SEC-2026-3757 revision 3 marking the SonicWall SMA1000 flaw exploited (S2); a third national authority restating the status the entry already carries from NCSC.ch; no new fact.
• borderline-drop: Stadt Olten forged QR stickers on parking meters (S2), fraud against citizens with no SOC decision. Beyond Gravity (S2), no new detail, held in the backlog.
• borderline-drop: North Korean IT workers, FBI PSA261013 and the CrowdStrike laptop-farm disruption (S3), US employer guidance and a US law-enforcement action, no constituency nexus, existing entries cover the cluster. MITRE ATT&CK v20 (S3), a framework release, not threat activity; the pin is stale (below). Luna Moth Files (S3), an unauthenticated leak of chat logs published about 2026-10-05, SRG calls it fake, no new technique. Fox-IT Cobalt Strike beacon corpus, Check Point LiteLLM CVE-2026-35029 and CVE-2026-59823 (authenticated), Barracuda hidden prompt injection in mail, the Dubrovsky arrest in the ShinyHunters case (S3), marginal for the constituency.
• borderline-drop: Arcadia SpeeCAN RAIDEN municipal mass-notification breach in Japan (S4), out of region, no vector, no actor; the only lesson (suppliers concentrate contact lists) is generic. Stadt Eichstätt (S4), a Bavarian city with copied data and intact backups but no vector, no actor and no behavior (incident floor). HSZ-BW, Kreiskliniken Kassel, UK Housing Ombudsman, Amadeus heap dump, Ahold Delhaize and U.S.NEXT (S4), no vector or actor, out of nexus, or a single-source misconfiguration note. FTAPI dataset publication (S4; heise 2026-10-12, before the window), mostly marketing material plus an apparent customer list, the entry stays routine. Anthropic's report on unintended model actions with the Philadelphia police statement (S4), awareness only.

Backlog (state/coverage_backlog.md): three of the four open rows reached their 2026-10-14 expiry with the condition unmet and are struck: IBM Guardium CVE-2026-85542 (not in KEV catalog 2026.10.13, ACN alert unchanged, IBM's bulletins do not mention it, authenticated), and the SafePay and Payload claims on ARA-Region Lyss-Limpachtal and Netech (no press link on Ransomware.live, no victim statement). Beyond Gravity stays held on its named condition (a vector, an actor or the data class), expiry 2026-10-20, with nothing new from S2 and S4.

Contradictions and discrepancies carried in the entries: (1) Ivanti: the Canadian Centre for Cyber Security lists the 25.x affected line as 25.2.2 and prior, Rapid7's table of Ivanti's advisory says 25.1.2.2 and prior, and the advisory itself was unreadable. (2) GitLab: GitLab's CVSS carries no privilege requirement while Rapid7's reproduction needs push access to a public project. (3) Danfoss: NCSC Switzerland relays six CERT-FR remediation steps that the revised CERT-FR page no longer lists (it now has a different two-path guidance); the entry follows the live CERT-FR text. (4) Adobe: the ColdFusion summary says priority 2, its solution table priority 1; stated in the sourcing note.

Coverage gaps: hub-ivanti-advisory (JS-only on every transport; read through Rapid7 and Volexity); golem-security (consent wall on article bodies); justice-gov (Akamai and HTTP 401); swissinfo-ger (no feed or search route, jina credit spent); databreaches-net (article pages 403); tenable-research (undated feed served through the reader); vaud-soc-cyber-threat-review (no September edition posted); news-web-nhk (JS-rendered body); hsz-offline-de (HTTP 404 with the notice in the body); kreisklinikenkassel-de (stale snapshot).

Rotation and sources: slices were ranked on the derived rotation cursor (S1 14 standard or candidate records beyond 6 essential, S2 14 beyond 15, S3 14, S4 12); every essential record was attempted. S1 reported that ivanti-psirt, adobe-psirt, cisco-psirt, sap-security-notes and siemens-productcert were not in its slice yet carried the day's primaries; the notes on those records ask to rotate them into S1 on scheduled-release days. Metered reader calls: about six (S2 one, S3 two, S4 three), all fallbacks from extract or a speculative URL. One new candidate source, blick-ch; S3 proposed mitre-attack-updates and S4 scannetsecurity, left for a later fire. The source health sweep probed 242 of 242 records (240 relevant, one stale, one shell), no UNSOLVED item.

For the operator and the next audit, not acted on this fire: (1) the ATT&CK pin is v19.2 while v20 was released 2026-10-13 with nine new Enterprise technique ids and no revocations or deprecations, so existing mappings stay valid but v20 ids cannot be used until python3 tools/attack_data.py --update runs; (2) the Microsoft Digital Defense Report 2026 (published 2026-10-01) has no entry in the store; (3) the three NCSC.ch catch-up advisories above.

Verification: five cti-verification iterations, each walking the full claim ledger (176 to 183 claims, every one answered). Iteration 1 returned NEEDS_FIXES (25 findings: 14 truth, 5 editorial, 6 advisory), iteration 2 NEEDS_FIXES (10), iteration 3 NEEDS_FIXES (4 truth), iteration 4 NEEDS_FIXES (3 truth, 1 advisory) and iteration 5 NEEDS_FIXES with two low-confidence F3 findings. Every finding was tested against the cited page and fixed except two declined with reasons: the older Claroty entry's em dashes (pre-existing, normalised at render, outside this fire's own sections) and the out-of-cycle reading of the Adobe priority (the takeaway no longer claims urgency, the entry stays notable). The loop ends on the low-residual early exit of Phase 5.7 rule 5: iteration 5 returned truth plus editorial of 2 with no F1 or F4, both findings were fixed after the return, and no confirmation pass followed, so those two fixes were checked by the gate and the main agent only; verification_residual_count is 2. No double-CLEAN was reached. The defects that kept recurring were statements dated or attributed more precisely than their source (a reproduction date, an interview date, a citation closing the wrong claim), per-CVE bindings the vendor page does not make, and run notes claiming the entries carry something an earlier fix had removed. The Blick finding of iteration 3 (Migros uses the same Danfoss systems in a limited number of Swiss stores) corrected an earlier "no Swiss deployment" statement. A container restart lost the first iteration-5 spawn and it was respawned once; the working tree survived. Entries from this fire that the next quality audit should read independently: the five new entries and the Danfoss update, since no pass confirmed the final text.