The Pro CISO Newsletter

The security news our team thinks matters, about once a month · choose your topics · unsubscribe at any time

Vulnerabilities CVE-2025-61624: Fortinet Multiple Products - Fortinet Multiple Products Path Traversal Vulnerability CISA Known Exploited Vulnerabilities · 16 Oct 2026 FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write per...
Vulnerabilities CVE-2026-102764: BeyondTrust Remote Support - BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability CISA Known Exploited Vulnerabilities · 16 Oct 2026 BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance. Required acti...
Vulnerabilities USN-8933-1: RabbitMQ Server vulnerabilities Ubuntu Security Notices · 15 Oct 2026 It was discovered that RabbitMQ Server incorrectly handled CORS wildcard origin configuration. An attacker could possibly use this issue to cause a cross-site request forgery attac...
Vulnerabilities USN-8922-2: Linux kernel (Azure) vulnerabilities Ubuntu Security Notices · 15 Oct 2026 Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:...
Vulnerabilities 2026-017: Critical Vulnerability in Cisco Secure Email Gateway CERT-EU Security Advisories · 15 Oct 2026 On 14 October 2026, Cisco published a security advisory addressing a critical vulnerability affecting the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway. T...
Vulnerabilities More Critical Bugs in Adobe Experience Manager: Pre-Auth RCE Searchlight Cyber Research · 15 Oct 2026 Chaining an unauthenticated bulk import, an in-band XXE, leaked IMS credentials and Groovy execution into full pre-auth RCE on Adobe Experience Manager Cloud.
Vulnerabilities CVE-2026-21589: Atlassian Multiple Products - Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability CISA Known Exploited Vulnerabilities · 15 Oct 2026 Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, C...
Vulnerabilities USN-8932-1: curl vulnerabilities Ubuntu Security Notices · 14 Oct 2026 Stanislav Fort discovered that curl did not properly clear AWS SigV4 authentication state when CURLOPT_AWS_SIGV4 was set to NULL. An attacker could possibly use this issue to obtai...
Vulnerabilities USN-8931-1: Apache HTTP Server vulnerabilities Ubuntu Security Notices · 14 Oct 2026 이지웅 discovered that Apache HTTP Server exposed WebDAV property information. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-58415) Zhe...
Vulnerabilities USN-8930-1: U-Boot vulnerabilities Ubuntu Security Notices · 14 Oct 2026 Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot incorrectly handled certain NFS READ and NFS READLINK responses. An attacker could possibly use this issue to trigger...
Vulnerabilities VU#410595: Google BoringSSL Name Constraints Bypass in SAN Validation Logic CERT/CC Vulnerability Notes · 14 Oct 2026 Overview Five Name Constraints findings in BoringSSL (VU#410595.8–.12) describe cases where certificate names may not be constrained as intended. Records .8, .9, .10 and .12 concer...
Vulnerabilities VU#948176: Multiple TLS Libraries can Bypass Delegation Enforcement CERT/CC Vulnerability Notes · 14 Oct 2026 Overview This note covers thirteen library-specific records (VU#948176.6, .8–.19) of how widely used TLS libraries apply X.509 Name Constraints. The records describe cases where a...
Vulnerabilities USN-8929-1: Bind vulnerabilities Ubuntu Security Notices · 14 Oct 2026 Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain malformed DNSKEY records. A remote attacker could possibly use this issue to cause Bind to consume resources,...
Vulnerabilities VU#166125: Bisheng has authentication bypass vulnerabilities CERT/CC Vulnerability Notes · 14 Oct 2026 Overview Bisheng contains three vulnerabilities: a pre-authentication account takeover mechanism via a legacy single sign-on (SSO) endpoint; an Insecure Direct Object Reference (ID...
Vulnerabilities USN-8928-1: OpenSSH vulnerabilities Ubuntu Security Notices · 14 Oct 2026 It was discovered that OpenSSH's sftp client incorrectly handled paths returned by the server during a recursive copy operation. A remote attacker controlling the server could poss...