You are reading a previous issue. Go to the latest edition →

The situation

SD‑WAN Controller Bypass Exposes Admin Access

Unauthenticated bypass grants admin access; eMudhra distrust adds risk.

3 sources

Cisco PSIRT Security Advisories, Palo Alto Networks Security Advisories, Microsoft Security Update Guide

Cisco reports an unauthenticated bypass that can grant administrative privileges and NETCONF access on Catalyst SD‑WAN Controller, Manager, and Validator across On‑Prem and Cisco Hosted SD‑WAN deployments. Cisco states no workaround exists and fixed releases are required.

Context

Network management surfaces with elevated risk this period, increasing exposure for internet‑facing control planes and trust anchors. Organizations operating internet‑exposed SD‑WAN controllers or inline management components should anticipate potential administrative takeover and trust validation failures.

“Prioritize upgrades for internet‑facing controllers, review trust stores, and harden inspection points now.”

From the analysis

Contrarian view

SitRep’s judgement from the cited reporting, not reported fact. Written by AI.

eMudhra Distrust Not a Pki-only Issue

The emergency distrust impacts certificate trust and application behavior; joint operations across PKI, network, and endpoint teams are required to avoid outages and false positives.

Cisco PSIRT Security Advisories

By the numbers

2 vulnerabilities added to CISA’s catalogue of flaws exploited in the wild, on 28 Oct
Source: CISA KEV catalogue, version 2026.11.10
1 CVE ID named in the stories on the wire
Source: On the wire

Analysis

SitRep’s judgement from the cited reporting, not reported fact. Written by AI.

A cluster of high‑severity flaws and a certificate trust issue highlight that control planes, certificate trust, and runtime decoders can enable administrative takeover and validation problems.

Cisco PSIRT Security Advisories · Palo Alto Networks Security Advisories

About this edition

AI-generated from cited reporting. Review the linked sources before acting on a claim.

Sources cited: 3
Composed: Oct 29 · 05:39 UTC

Editorial standards

Free to read. No personal details in the link.

Email it

The move

5 things to do today

Upgrade Catalyst SD‑WAN Controller, Manager, and Validator to fixed releases that address the authentication bypass and apply changes during an emergency window on internet‑facing management endpoints.
Follow vendor guidance to distrust eMudhra roots and intermediates, remove or block the affected intermediates from trust stores, and review application certificate pinning and TLS validation logs for errors or unexpected issuances.
Apply Palo Alto Networks Brotli updates to PAN‑OS components or disable Brotli inspection where immediate updates are not available; prioritize gateways that inspect internet traffic.
Track Cisco‑published fixes for Node.js issues affecting Brotli, DNS, and TLS validation; increase telemetry on internet‑facing devices and hunt for PoC exploit indicators.
Install Microsoft security updates addressing CVE-2026-62740 for affected Windows Imaging Component and Office editions, and monitor for data‑leakage indicators in affected clients.

On the wire

1critical
2elevated
1moderate
1low

P0Exploit

Catalyst SD‑WAN Controller Authentication Bypass

High‑severity bypass across SD‑WAN controllers

Cisco notes an unauthenticated bypass that can grant administrative privileges and NETCONF access on Catalyst SD‑WAN Controller, Manager, and Validator; On‑Prem and Cisco Hosted SD‑WAN deployments are affected.

CISCO PSIRT SECURITY ADVISORIES · Cisco Catalyst SD-WAN Controller Authentication Bypass Advisories

Copy link to “Catalyst SD‑WAN Controller Authentication Bypass”

P1Trust

eMudhra Certificate Distrust Prompted Emergency Action

Emergency distrust of eight intermediate certificates issued between Oct 17–20

According to Cisco PSIRT, a researcher demonstrated private keys for eight eMudhra intermediates, prompting distrust actions and TLS validation monitoring.

CISCO PSIRT SECURITY ADVISORIES · Cisco Informational on Emergency Distrust of eMudhra CAs

Copy link to “eMudhra Certificate Distrust Prompted Emergency Action”

P1Exploit

Brotli Buffer Overflow in PAN‑OS

CVE‑2026‑111497 affects Brotli decoder; memory corruption risk

Palo Alto Networks details a Brotli decoder overflow that could enable memory corruption, data disclosure, DoS, or code execution; some mitigations exist via updates or disabling Brotli inspection.

PALO ALTO NETWORKS SECURITY ADVISORIES · CVE-2026-111497 Brotli Vulnerability Impact on Palo Alto Networks

Copy link to “Brotli Buffer Overflow in PAN‑OS”

P2Runtime

Node.js Vulnerabilities in Cisco Context

Multiple Node.js issues with PoC exploits; Cisco investigating fixes

Cisco warns of Node.js vulnerabilities affecting Brotli, DNS, and TLS validation across 22.x, 24.x, and 26.x releases; PoC exploits exist; fixes to be published in stages.

CISCO PSIRT SECURITY ADVISORIES · Cisco Advises on Node.js Vulnerabilities in October 2026

Copy link to “Node.js Vulnerabilities in Cisco Context”

P3Exploit

Office Imaging Component Flaw Affects Editions

CVE-2026-62740 information disclosure in Office‑related components

Microsoft notes additional Office editions affected by CVE-2026-62740; latest security updates address information disclosure risks.

CVE-2026-62740: EPSS <0.01 (FIRST)

MICROSOFT SECURITY UPDATE GUIDE · CVE-2026-62740 Windows Imaging Component Information Disclosure Vulnerability

Copy link to “Office Imaging Component Flaw Affects Editions”

Known exploited

Added 28 Oct2 vulnerabilities added to CISA’s catalogue of flaws exploited in the wild

CVE	Vendor and product	Added	Due
CVE-2026-41709	Broadcom VMware ESX	28 Oct	11 Nov
CVE-2026-46300	Linux Kernel	28 Oct	31 Oct

Source: CISA KEV catalogue, version 2026.11.10 (released 10 Nov 2026; read by SitRep 10 Nov 2026).

Due dates are CISA’s deadlines for US federal civilian agencies (BOD 22-01).

The full catalogue at cisa.gov

The wire, last 30 days

This edition has 3 stories rated critical or elevated (P0 or P1); the 21 daily editions from 29 Sep to 27 Oct averaged 3.8. 8 of the 29 earlier days have no bar: no daily edition with rated stories.

The figures as a table

Edition	P0	P1	P2	P3
28 Oct (this edition)	1	2	1	1
27 Oct	1	3	1	0
26 Oct	1	1	1	1
23 Oct	0	3	2	0
22 Oct	1	4	0	0
21 Oct	2	2	0	0
20 Oct	2	2	1	0
19 Oct	2	3	0	0
16 Oct	1	2	1	0
15 Oct	1	3	1	0
14 Oct	2	1	1	1
13 Oct	1	3	0	0
12 Oct	2	2	0	0
9 Oct	1	3	1	0
8 Oct	2	3	0	0
7 Oct	1	3	1	0
6 Oct	1	3	1	0
5 Oct	2	2	1	0
2 Oct	1	2	2	0
1 Oct	2	2	0	1
30 Sep	1	3	0	0
29 Sep	1	1	2	1

Source: SitRep’s daily editions; stories without a severity are not counted.

Elsewhere in the edition

Chromium Information Leak in Animation CVE-2026-79293 Security Advisory

Chromium vulnerability causes an information leak in the Animation component. Microsoft Security Response Center advisory page confirms the CVE; no patch details or timelines are provided in the text.

5 reports

MICROSOFT SECURITY UPDATE GUIDEChromium Information Leak in Animation CVE-2026-79293 Security Advisory
MICROSOFT SECURITY UPDATE GUIDEChromium CSS Information Leak Vulnerability CVE-2026-79291 Impact Summary
MICROSOFT SECURITY UPDATE GUIDEChromium CVE-2026-79290 Use After Free in Aura
MICROSOFT SECURITY UPDATE GUIDEChromium CVE-2026-79289 flaw in Workers resource lifetime
MICROSOFT SECURITY UPDATE GUIDEChromium CVE-2026-79287: Observable Discrepancy in Forms

Ukrainian Hive and Nefilim Ransomware Affiliate Sentenced to 70 Months

Artem Stryzhak, a Ukrainian national, was sentenced to 70 months for conspiracy to commit computer fraud after joining Nefilim as an affiliate in June 2021 and later affiliating with Hive. He targeted US and international victims, including seven Hive and an oil and gas firm, sharing 20% of ransom with Nefilim admins. FBI cites over $100 million in losses.

4 reports

SECURITYWEEKUkrainian Hive and Nefilim Ransomware Affiliate Sentenced to 70 Months
BLEEPINGCOMPUTERNefilim and Hive Affiliate Sentenced to 70 Months in Prison
NEWSAPI CYBER INSIGHTSHive and Nefilim Affiliate Sentenced to 70 Months in Prison
BREACHES.NETUkrainian National Sentenced in Ransomware Conspiracy Schemes

Hackers Exploit Critical CVE-2026-101767 in Oracle E-Business Suite

Attackers probe a just-patched critical flaw in Oracle E-Business Suite (EBS). CVE-2026-101767 carries a 9.8 CVSS. It is an unauthenticated SQL injection in the Thin Client Framework servlet enabling remote code execution via the APPS user. Data such as financial, payroll, HR, and procurement may be affected. Patch released in the last Critical Patch Update; exploitation observed Oct 27, 2026.

3 reports

THE HACKER NEWSHackers Exploit Critical CVE-2026-101767 in Oracle E-Business Suite
BLEEPINGCOMPUTERHackers Scan Systems for Recently Patched Oracle Flaw
SECURITYWEEKHackers Probe Fresh Oracle EBS Vulnerability CVE-2026-101767

GMO Internet Urges Disconnect after Onamae.com Breach

GMO Internet's Onamae[.]com service was breached and suspended on Oct 21 after malicious programs were found in some customers' server environments. Up to 26,739 servers may have been impacted and hackers may have accessed trading accounts. An extortion email demanded about eight billion yen. GMO refused to pay; attackers warned of ransomware on Oct 27.

3 reports

NEWSAPI CYBER INSIGHTSGMO Internet Urges Disconnect after Onamae.com Breach
BREACHES.NETGMO Tells Customers to Disconnect PCs After Data Breach
NEWSAPI CYBER INSIGHTSGMO Onamae Data Breach, Ransomware Threat Warn Customers

Also reported

BLEEPINGCOMPUTERPolice seize Virtualine bulletproof service tied to ransomware
CISCO PSIRT SECURITY ADVISORIESCisco ASA/FTD SSL VPN Tunnel DoS Vulnerability
BLEEPINGCOMPUTERDiscord to Let Search Engines Index Public Server Messages
THE HACKER NEWSVolt Typhoon Uses Silent Train for Four Zero-Day Campaigns
UNIT 42Retail Peak-Season Cyber Threats and Mitigation Strategies 2026
THE HACKER NEWSGoogle Expands One-Tap Android Installs to Approved Third-Party Stores
CISCO PSIRT SECURITY ADVISORIESVulnerabilities in PHP Affecting Cisco Products, October 2026
BLEEPINGCOMPUTERSony ISP Subsidiary Data Breach Exposes 2.5 Million Records
THE HACKER NEWSLogic-Bug Chain Breaks Edge in $175k Pwn2Own Win
SANS INTERNET STORM CENTERClickFix Campaign Deploys Fake Cloudflare Verification Page

End of the Wednesday, October 28, 2026 edition.

Get a free cybersecurity brief by email on weekdays. Get the brief →

Colophon

SitRep · Vol. 1, No. 36

Publisher: Published and funded by its independent maintainer. No advertising or sponsors.
AI disclosure: SitRep uses AI to prepare its editions from cited reporting; editions are not reviewed by a person before they are published.
Editorial standards: Read our editorial standards.
Corrections: brief@sitrepit.com or the contact page.