# Newly exploited vulnerabilities: week of 12 to 18 October 2026 (week 42)

Source: https://junglewise.ai/threats/exploited/2026-10-12  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 20 October 2026, 00:07 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/exploited/2026-10-12.json  
License: CC BY 4.0 with a link back

In the week of 12 to 18 October 2026, 9 vulnerabilities were newly recorded as exploited in the wild, 9 of them critical. The technology hit most was AhsayCBS (2), followed by Atlassian Bamboo Data Center (1) and Atlassian Bitbucket Data Center (1).

## Newly exploited this week

- [CVE-2026-102764: BeyondTrust Remote Support authentication bypass by spoofing](https://junglewise.ai/threats/cve-2026-102764-beyondtrust-remote-support-authentication-bypass-by-spoofing) (critical, exploited in the wild, CVSS 9.8, exploited since 16 Oct 2026, published 15 Oct 2026)
- [CVE-2025-61624: Fortinet multiple products path traversal in CLI](https://junglewise.ai/threats/cve-2025-61624-fortinet-multiple-products-path-traversal-in-cli) (critical, exploited in the wild, CVSS 6, exploited since 16 Oct 2026, published 14 Apr 2026)
- [CVE-2026-21589: Atlassian Data Center arbitrary file access without authentication](https://junglewise.ai/threats/cve-2026-21589-h3-summary-this-is-a-vulnerability-in-bitbucket-data-center) (critical, exploited in the wild, exploited since 15 Oct 2026, published 5 Oct 2026)
- [CVE-2026-76519: Cisco Secure Email Gateway relative path traversal](https://junglewise.ai/threats/cve-2026-76519-cisco-secure-email-gateway-relative-path-traversal-vulnerability) (critical, exploited in the wild, exploited since 14 Oct 2026, published 14 Oct 2026)
- [CVE-2026-0322: Palo Alto Networks PAN-OS code injection vulnerability](https://junglewise.ai/threats/cve-2026-0322-palo-alto-networks-pan-os-code-injection-vulnerability) (critical, exploited in the wild, exploited since 14 Oct 2026, published 14 Oct 2026)
- [CVE-2026-105133: Ahsay AhsayCBS authentication bypass in API](https://junglewise.ai/threats/cve-2026-105133-a-vulnerability-was-detected-in-ahsay-ahsaycbs-up-to-10-3-2-this) (critical, exploited in the wild, CVSS 7.3, exploited since 14 Oct 2026, published 4 Oct 2026)
- [CVE-2026-105134: Ahsay AhsayCBS OS command injection in UpdateReceivers](https://junglewise.ai/threats/cve-2026-105134-a-flaw-has-been-found-in-ahsay-ahsaycbs-up-to-10-3-2-this) (critical, exploited in the wild, CVSS 10, exploited since 14 Oct 2026, published 4 Oct 2026)
- [CVE-2026-96951: Microsoft Windows command injection in Shell](https://junglewise.ai/threats/cve-2026-96951-microsoft-windows-command-injection-vulnerability) (critical, exploited in the wild, CVSS 8.8, exploited since 13 Oct 2026, published 13 Oct 2026)
- [CVE-2026-104935: Ivanti Connect Secure authentication bypass by spoofing](https://junglewise.ai/threats/cve-2026-104935-ivanti-connect-secure-authentication-bypass-by-spoofing) (critical, exploited in the wild, CVSS 8.6, exploited since 13 Oct 2026, published 13 Oct 2026)

## Technologies hit most

1. AhsayCBS: 2 vulnerabilities
2. Atlassian Bamboo Data Center: 1 vulnerability
3. Atlassian Bitbucket Data Center: 1 vulnerability
4. [Atlassian Confluence Data Center](https://junglewise.ai/threats/technologies/confluence-data-center): 1 vulnerability
5. Atlassian Crowd Data Center: 1 vulnerability
6. Atlassian Crucible: 1 vulnerability
7. Atlassian Fisheye: 1 vulnerability
8. Atlassian Jira Service Management Data Center: 1 vulnerability
9. Atlassian Jira Software Data Center: 1 vulnerability
10. Atlassian Multiple Products: 1 vulnerability
11. [BeyondTrust Remote Support](https://junglewise.ai/threats/technologies/remote-support): 1 vulnerability
12. [Cisco Secure Email Gateway](https://junglewise.ai/threats/technologies/secure-email-gateway): 1 vulnerability
13. [Fortinet FortiOS](https://junglewise.ai/threats/technologies/fortios): 1 vulnerability
14. [Fortinet FortiPAM](https://junglewise.ai/threats/technologies/fortipam): 1 vulnerability
15. [Fortinet FortiProxy](https://junglewise.ai/threats/technologies/fortiproxy): 1 vulnerability

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 12 to 18 October 2026 (week 42)", https://junglewise.ai/threats/exploited/2026-10-12, 20 October 2026.