Weekly Vulnerability Report Cyble October

This Cyble Research & Intelligence Labs (CRIL) weekly vulnerability report covers two views of risk: what attackers tried against Cyble’s global honeypot sensors, and what the Cybersecurity and Infrastructure Security Agency (CISA) disclosed for industrial control systems (ICS).

The Cyble Global Sensor Intelligence (CGSI) network observed exploitation attempts against about 20 known vulnerabilities. They range from newly disclosed flaws in WordPress, Apache Solr, and Langflow to years-old bugs in GPON home routers and embedded TCP/IP stacks. 

On the industrial side, CISA issued 14 ICS advisories covering 54 vulnerabilities. Of these, 13 were rated critical, 18 high, 18 medium, and five low. 

Affected vendors include Toptech Systems, Lantronix, VIVOTEK, MikroTik, Armatura, Monta, Anjvision, and, unusually, CISA itself.

Cyble sensors also recorded active malware campaigns, phishing emails, and brute-force attacks against internet-exposed services.

Real-World Attacks Observed by Cyble Sensors 

Attackers moved quickly against newly disclosed flaws in web platforms and AI tooling, while older IoT and embedded-device bugs continued to draw steady traffic. 

Source: Cyble sensor intelligence. The 24 CVEs named in this post, counted by CVE ID year 

CVE-2026-63030 — WordPress REST API 

CVE-2026-63030 is a route-confusion flaw in a WordPress REST API batch endpoint. It affects WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2. 

Attackers can chain it with CVE-2026-60137 to achieve SQL injection and potentially remote code execution (RCE). 

CVE-2026-44825 — Apache Solr 

CVE-2026-44825 is a hardcoded credential in the Basic Authentication setup tool of Apache Solr 9.4.0 through 9.10.1 and 10.0.0. 

Remote attackers can use it to access a Solr cluster with administrative privileges. 

CVE-2026-9198 — Langflow 

CVE-2026-9198 affects IBM Langflow OSS 1.0.0 through 1.10.0. Unauthenticated attackers can chain two API endpoints to obtain superuser tokens and execute arbitrary code. 

Sensors also caught attempts against an older Langflow code injection flaw, CVE-2025-3248. Repeated targeting of the same AI workflow platform signals sustained attacker interest. 

CVE-2025-68613 — n8n 

CVE-2025-68613 is a critical RCE flaw in the n8n workflow automation platform. Expressions supplied by authenticated users can run in an insufficiently isolated context, enabling full system compromise. 

Fixes are available in versions 1.120.4, 1.121.1, and 1.122.0. 

CVE-2026-4020 — Gravity SMTP 

CVE-2026-4020 affects the Gravity SMTP WordPress plugin, versions 2.1.4 and earlier. An exposed REST API endpoint lets unauthenticated users pull system reports containing server details, database metadata, and configured API keys or tokens. 

CVE-2024-6587 — LiteLLM 

CVE-2024-6587 is a server-side request forgery (SSRF) flaw in LiteLLM. Exploitation can expose OpenAI API keys. 

Older Flaws Still in Rotation 

Cyble sensors also logged exploitation attempts against: 

  • CVE-2025-58360, an XML external entity (XXE) flaw in GeoServer’s GetMap operation 

  • CVE-2024-7591, an OS command injection flaw in Progress LoadMaster 

  • CVE-2024-25600, a code injection flaw in Bricks Builder 1.9.6 and earlier 

  • CVE-2025-2010, an unauthenticated SQL injection flaw in the JobWP WordPress plugin 

  • CVE-2025-46565, a file access control bypass in the Vite development server 

  • Command injection flaws in QNAP QTS firmware 

  • Scanning for the Cisco Adaptive Security Appliance (ASA) WebVPN login page 

A Mirai variant is also targeting Dasan GPON home routers by chaining CVE-2018-10561 and CVE-2018-10562. Together, the two flaws let an unauthenticated remote attacker run commands on the device. 

Most-Attempted CVEs 

CVE-2020-11899, an IPv6 out-of-bounds read in the Treck TCP/IP stack, drew far more exploitation attempts than any other CVE this week. The rest of the top five, in order: 

  1. A group of four Wind River VxWorks TCP buffer overflows: CVE-2019-12255, CVE-2019-12260, CVE-2019-12261, and CVE-2019-12263 

  1. CVE-2020-11900, an IPv4 tunneling double-free in the Treck TCP/IP stack 

  1. CVE-2019-0708, a critical unauthenticated RCE in Microsoft Remote Desktop Services 

  1. CVE-2020-11910, an ICMPv4 out-of-bounds read in the Treck TCP/IP stack 

Most of these flaws sit in networking code embedded in IoT and industrial devices, which often go unpatched for years. 

Malware Families Observed 

Files collected from Cyble sensors were linked to several malware families: 

  • CoinMiner: Linux cryptominers that hijack CPU and GPU resources 

  • WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147 

  • Mirai: A botnet that turns IoT devices and Linux servers into remotely controlled bots 

  • IRCBot: Linux malware that uses IRC connections as a backdoor 

CRIL also observed Hajime, Gafgyt, and Wacatac activity. 

MacSync Infostealer Targets Crypto Users 

CRIL is also tracking a new version of MacSync, a macOS infostealer sold as malware-as-a-service. Kaspersky’s Securelist reported that the latest campaign targets cryptocurrency users and developers. 

According to Securelist, attackers distribute MacSync through malicious disk images posing as a fake crypto wallet app. In one case, they abused a public iCloud calendar event to deliver commands. 

The malware steals browser data, saved credentials, crypto wallet data, Keychain files, and SSH, AWS, Kubernetes, and Git configurations. It also installs a backdoor disguised as Finder that persists through a LaunchAgent, shell profile changes, and Git hooks. 

Security teams should watch macOS endpoints for unexpected disk-image apps, removal of quarantine attributes, and new LaunchAgents. 

Phishing and Advance-Fee Scams 

Phishing emails captured by Cyble sensors relied on emotional appeals and promises of money. Common lures this week: 

Subject line  Scam type 
Re: DONATION FOR less-privileged  Charity or donation scam 
GOD BLESS YOU….  Emotional appeal, advance-fee scam 
Re. Compensation funds for your past effort  Compensation fund scam 
MY PROPOSAL  Business proposal, advance-fee scam 
Investment Inquiry, Funding for Your Project  Investment or project funding scam 
Dear Sir/Madam  Advance-fee scam 

Many of these emails use look-alike domains or impersonate known organizations to appear credible. 

Brute-Force Attacks 

Brute-force traffic focused on remote access and database ports, including VNC (5900), RDP (3389), SSH (22), Telnet (23), HTTP (80), Microsoft SQL Server (1433), and PPTP (1723). 

Targets included Elasticsearch, Hadoop, Oracle, GitLab, MySQL, and PostgreSQL. Attackers leaned on default and weak credentials such as “sa,” “root,” “password,” and “123456.” 

The largest share of attack traffic, 39%, came from sources with a known bad reputation. 

Critical ICS Vulnerabilities 

CISA’s 14 ICS advisories covered 54 vulnerabilities, two-thirds of them rated high or medium. Toptech Systems and CISA itself disclosed the most flaws this week. 

Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · 54 vulnerabilities by vendor and severity 

Toptech Systems TMS7 and TopHAT (Critical) 

Toptech Systems’ TMS7 and TopHAT version 7.6.3 carried more critical-rated ICS vulnerabilities than any other product this week. They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379). 

TMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors. In a product that governs fuel terminal operations, these flaws could enable interference with physical processes, not just data theft. Toptech has published security update information. 

CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High) 

Two flaws affect Lantronix G520 Series cellular gateways running 2.6.0.4R6_stable. CVE-2026-91191 is an improper cryptographic signature verification flaw, and CVE-2026-84409 is a cross-site scripting (XSS) flaw. 

The signature flaw could let attackers bypass firmware integrity checks and push unauthorized firmware to remote field devices. Combined with the XSS bug, it creates a realistic multistage attack path against devices that may be hard to inspect physically. Lantronix has published remediation details. 

CVE-2026-84411 — MikroTik RouterOS (Critical) 

CVE-2026-84411 is a critical integer underflow vulnerability in MikroTik RouterOS versions before 7.24. Updated versions are available from MikroTik’s download page. 

CVE-2026-22755 — VIVOTEK Cameras (Critical) 

CVE-2026-22755 is a critical command injection flaw affecting 37 VIVOTEK camera models across its V, C, S, Dome, Bullet, and Panoramic series. VIVOTEK has posted an update package. 

CVE-2026-95102 — Monta (Critical) 

CVE-2026-95102 is a missing-authentication flaw for a critical function in all versions of monta.app. Three other Monta flaws involve excessive authentication attempts, session expiration, and credential protection. The advisory data referenced no vendor fix. 

Anjvision, Viidure, and Armatura One 

Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting. Others include OS command injection, hardcoded credentials, and improper signature verification. 

The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical). Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues. 

No vendor fixes were referenced for these products, so compensating controls such as network isolation are the main option for now. 

CISA Malcolm (15 Vulnerabilities) 

In an unusual disclosure, CISA reported 15 vulnerabilities in Malcolm, its own open-source network traffic analysis and threat-hunting platform. The flaws affect versions before 26.06.0. 

They span authentication bypass, missing authorization, default credentials, OS command injection, path traversal, and SSRF. Most are rated medium, and two are rated high. Users should update through the Malcolm releases page. 

The remaining advisories covered Baicells Technologies, Meari, and Johnson Controls products. 

Impacted Critical Infrastructure Sectors 

Energy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities. 

Source: CISA ICS advisories analyzed by CRIL, Sept. 29–Oct. 5, 2026 · share of 54 vulnerabilities touching each sector 

The largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities. Energy, Chemical, and Transportation Systems made up another 18.5%, driven largely by the Toptech disclosures. 

These disclosures cut across traditional infrastructure boundaries rather than clustering in one domain. A single flaw in a shared product can create risk for fuel, water, and transportation operators at once. 

Conclusion 

This weekly vulnerability report highlights several trends: 

  • Fast exploitation of newly disclosed flaws in WordPress, Apache Solr, and AI workflow tools such as Langflow and n8n 

  • Persistent attacks on years-old embedded-device and router vulnerabilities 

  • Critical ICS flaws in fuel distribution, cellular gateway, and camera products 

  • Several ICS products with no vendor fix referenced, leaving compensating controls as the main defense 

  • Ongoing phishing and brute-force activity that relies on weak and default credentials 

With 13 critical ICS vulnerabilities and active exploitation attempts against both new and legacy flaws, organizations face risk across enterprise IT and operational technology (OT) environments. 

Key Recommendations From This Weekly Vulnerability Report 

  • Patch internet-exposed web platforms, plugins, and AI workflow tools first, starting with the flaws under active exploitation above 

  • Replace default usernames and passwords, and enforce strong, unique credentials on servers and devices 

  • Restrict or block exposed remote access and database ports, including VNC, RDP, SSH, Telnet, and SQL Server 

  • Segment IT and OT networks with firewalls and demilitarized zones (DMZs) to limit lateral movement 

  • Apply compensating controls, such as network isolation, for ICS products without available fixes 

  • Verify firmware integrity on remote field devices and cellular gateways 

  • Monitor macOS endpoints for unexpected disk-image apps and new LaunchAgents 

  • Track CISA advisories and the Known Exploited Vulnerabilities (KEV) catalog, and prioritize by exploitability and operational impact 

  • Conduct regular vulnerability assessments and penetration testing 

Cyble’s attack surface management and vulnerability intelligence solutions help organizations identify exposed assets, prioritize remediation, and detect early signs of compromise. Combined with real-time sensor intelligence, they help security teams stay ahead of threats across enterprise and critical infrastructure environments. To see these capabilities in action, schedule a demo with Cyble. 

Disclaimer: The data and content written in this blog is based on certain sensor and open web information available. Analysts and researchers are advised to confirm once again from original sources. 

The post The Week in Vulnerabilities: Toptech, Lantronix, Langflow, and CISA Malcolm Flaws appeared first on Cyble.