Back Upwind

CVE-2026-116366

Upwind • October 31, 2026

An out-of-bounds write vulnerability in Fortinet FortiOS SSL VPN allows a remote unauthenticated attacker to execute arbitrary code or commands via specially crafted HTTP requests. Active exploitation has been observed in the wild.

PAN-OS GlobalProtect Command Injection

A command injection vulnerability in Palo Alto Networks PAN-OS GlobalProtect feature allows an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. This vulnerability has a CVSS score of 10.0.

JetBrains TeamCity Authentication Bypass

An authentication bypass vulnerability in JetBrains TeamCity On-Premises allows a remote unauthenticated attacker to gain administrative control of the server, enabling arbitrary code execution and supply chain compromise.

Ivanti Connect Secure Authentication Bypass

An authentication bypass vulnerability in the web component of Ivanti Connect Secure and Ivanti Policy Secure allows a remote attacker to access restricted resources without valid credentials. Chained with CVE-2024-21887 for full remote code execution.

ConnectWise ScreenConnect Authentication Bypass

A critical authentication bypass vulnerability in ConnectWise ScreenConnect allows unauthenticated users to create a new administrator account, granting full access to the server and all managed endpoints.

CVE-2026-116366 – Unauthenticated ClickHouse Server integer overflow allows network RCE

ClickHouse Server has an integer overflow/wraparound in request parsing/validation that can be triggered remotely to corrupt bounds and reach a command injection sink, resulting in unauthenticated remote code execution under the clickhouse-server user. Not exploitable if the vulnerable endpoint is not exposed to untrusted networks.

Affects ClickHouse 26.3 < 26.3.62.3-lts , 26.8 < 26.8.36.3-lts , 26.9 < 26.9.27.3-stable , 26.10 < 26.10.3.7-stable ; Upgrade to 26.3.62.3-lts / 26.8.36.3-lts / 26.9.27.3-stable / 26.10.3.7-stable (or later) to mitigate

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ivanti Connect Secure Vulnerabilities Exploited for Root Access A group identified as UTA0576 has exploited three vulnerabilities in Ivanti Connect Secure VPN gateways, allowing unauthenticated root-level access. The attacks began in early October 2026, affecting devices that were fully patched at the time. The vulnerabilities include CVE-2026-104935 (authentication bypass), CVE-2026-111357 (privilege escalation), and CVE-2026-118527 (file upload). Ivanti has released patches for the vulnerabilities, with the first advisory published on October 13, 2026. CISA added the vulnerabilities to its Known Exploited Vulnerabilities catalog on October 30, 2026. Attackers have been observed extracting credentials and tampering with logs to evade detection. Security firms are urging immediate patching and monitoring for signs of prior compromise. 10 sources 73

Extracted Entities

CVE-2026-116366

The full story

Extracted Entities

Companies (1)

CVEs (2)

CWE Weaknesses (3)

IP Addresses (4)

MITRE ATT&CK (2)

Platforms (5)

Tools (1)