lee1981 (@lee1981b) on X

What it is

CyberForge Weekly CVE Rundown #006 (posted on X, covering 12-17 October 2026, with status checked through 18 October 09:24 UTC) is a six-CVE digest. Each entry names the CVE, the defender action and the exploitation status. Its main point is that applying a patch and investigating earlier compromise are separate questions needing separate evidence.

Affected and status

• CVE-2026-108860, BotSharp: WebStarter API instances that still trust the published default signing key can accept forged identities, including known administrators. No verified fixed release was found. The advisory lists versions through 5.2.0.
• CVE-2026-97229, GitLab CE/EE: unauthenticated code execution on the server through crafted CI/CD expressions "under certain conditions". CVSS v3.1 is 10.0. The exact public trigger is unverified, and no CISA KEV entry was found.
• CVE-2026-104935, Ivanti Connect Secure: unauthenticated authentication bypass leading to command execution. Root escalation is reported as a separate stage. Exploitation is confirmed and the CVE is in KEV. The vendor page was unavailable during the check.
• CVE-2026-76519, Cisco Secure Email Gateway: unauthenticated root commands through attachment processing. It needs vulnerable AsyncOS, a policy-assigned File Reputation and outdated scanner tools. No recipient click is needed. Exploitation is known and the CVE is in KEV.
• CVE-2026-102764, BeyondTrust Remote Support: improper message-origin validation allows appliance file operations, with observed escalation to root. CISA added it to KEV on 16 October with a 19 October due date. NVD scores it CVSS v3.1 9.8, and BeyondTrust scores it v4.0 9.3.
• CVE-2026-99999, Linux kernel "PwnEscape": guest-controlled virtual-network metadata passes through the VMM into host networking. Deferred checksum work then invalidates earlier header validation. Vercel reports production host-memory disclosure. Host crash and administrator execution were shown only on researcher-owned matching hosts. No field campaign was found, and the CVE is not in KEV.

What to do

• GitLab: patch the affected branch to 19.2.8, 19.3.5 or 19.4.2 respectively. Confirm the version actually serving. When hunting, look at the application server as well as runners, and treat unexplained application-process activity as a lead to correlate.
• BotSharp: retire the default signing-key trust on every verifier and fallback, not only the primary.
• Ivanti: preserve memory and external logs before repair, because disk checks cannot clear memory-only activity. Follow the model-specific guidance.
• Cisco: confirm Content Scanner Tools 25.3.0.5525 or later, and check AsyncOS version and File Reputation policy together. Preserve evidence before any disruptive recovery.
• BeyondTrust: verify patch BT26-05-RS on eligible versions 24.3.1 to 26.2.3. Older versions must be upgraded first.
• Linux/virtualisation hosts: apply the distribution's supported host-kernel backport, reboot and verify the running kernel. Guest updates and a newer VMM alone do not establish host coverage. The page cites AWS guidance for this.
• Appliances generally: assess historical credential exposure when evidence of compromise warrants it.

Caveats

• A passing version check shows repair coverage only. It does not show the appliance was not compromised earlier.
• Absence from KEV does not show safety. EPSS scores (all six returned by FIRST, dated 16 October) are predictions, not observations.
• CVSS v3.1 and v4.0 scores should not be compared directly.
• The page cites its sources only as truncated links (VulnCheck, GitLab, Ivanti, Volexity, Cisco, BeyondTrust, Vercel, Openwall). The post carries no exploit detail, indicators or detection queries. The page ends with "Made with AI".