BeyondTrust Zero-Day, Ivanti VPN Breach, and New CISOs Lead Oct 17 Briefing

Security leaders should prioritize patching the actively exploited BeyondTrust Remote Support authentication bypass and the three-vulnerability Ivanti Connect Secure chain that gave attackers root access on fully patched VPN appliances. Also this week: a UK fashion retailer disclosed a cyberattack, Microsoft fixed an actively exploited Windows Shell zero-day, CISA pushed agencies to patch newly cataloged Palo Alto, Cisco and Ahsay flaws, and Acronis appointed a new CISO.

CISA Orders Urgent Patching for Exploited BeyondTrust Remote Support Flaw

CISA warned on October 16, 2026 that threat actors are actively exploiting a critical authentication bypass vulnerability, CVE-2026-102764, in BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. Attackers use the flaw for initial access, then establish persistence, escalate privileges, and move laterally. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog the same day and told organizations with self-hosted appliances to apply the BT26-05-RS patch immediately, rotate stored credentials, and conduct forensic investigations for signs of compromise. BeyondTrust-hosted SaaS deployments have already been patched. (CISA)

CISA Catalogs Four More Exploited Flaws in Palo Alto, Cisco, Ahsay Products

On October 14, 2026, CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation: a Palo Alto Networks PAN-OS code injection flaw (CVE-2026-0322), a Cisco Secure Email Gateway relative path traversal bug (CVE-2026-76519), and two Ahsay AhsayCBS flaws, an improper authentication vulnerability (CVE-2026-105133) and a command injection vulnerability (CVE-2026-105134). CISA said these vulnerability types are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise, and it continues to require Federal Civilian Executive Branch agencies to prioritize rapid remediation of high-risk KEV entries under Binding Operational Directive 26-04. (CISA)

Attackers Chain Three Ivanti Zero-Days to Gain Root on Patched VPNs

Volexity disclosed that a threat actor it tracks as UTA0576 used a three-vulnerability exploit chain, authentication bypass, file write, and privilege escalation, to compromise a fully patched Ivanti Connect Secure VPN appliance in the first week of October 2026, extracting credentials, BitLocker keys, and Active Directory metadata while erasing logs. Ivanti has patched the authentication bypass and RCE flaw (CVE-2026-104935) and is finishing a fix for the privilege escalation. CISA added CVE-2026-104935 to its KEV catalog and ordered federal agencies to patch and complete forensic triage by October 16, 2026. (Help Net Security)

Microsoft Patches Exploited Windows Shell Zero-Day Among Record Bug Haul

Microsoft's October 2026 Patch Tuesday fixed more than 1,400 security bugs, including CVE-2026-96951, a Mark of the Web bypass in Windows Shell that attackers are exploiting in the wild to open malicious files without triggering normal warnings. Tenable noted it is the third Windows Shell flaw exploited this year, following two linked to APT28 activity. Microsoft also patched a critical SharePoint signature-verification flaw, CVE-2026-102866, that lets attackers hijack accounts, and 55 wormable, unauthenticated remote-code-execution bugs across DHCP Server, Remote Desktop Gateway, and Network Policy Server, which researchers urged organizations to prioritize. (Help Net Security)

Acronis Names Gerald Caron Chief Information Security Officer

Acronis appointed Gerald Caron as Chief Information Security Officer on October 16, 2026, giving him oversight of security governance, compliance, incident response, and protection across the company's global cyber-protection platform for managed service providers and IT departments. Caron previously served as Program Management Director at SAIC and Vice President of Cybersecurity at RIVA Solutions, and held CIO roles at the US Departments of Commerce and Health and Human Services. He will work with Acronis's R&D teams to strengthen security through the product lifecycle and support growth of its managed detection and response service, Acronis MDR by Acronis TRU. (Global Features)