---
title: "Security digest: October 14, 2026"
url: https://erroneo.us/security/2026-10-14/
description: "October 14, 2026 vulnerability digest: 3 briefs (Next.js: Two Critical Unauthenticated RCEs (Oct…); 4 CISA KEV additions (Ahsay, Cisco, Palo Alto Networks).…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-10-14
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: October 14, 2026

3 editorial briefs and 4 known exploited (cisa kev) additions.

## Take stock

- Patch this week: Next.js: Two Critical Unauthenticated RCEs (Oct 14) . Teams running self-hosted Next.js on glibc Linux with the built-in Image Optimization API, and any Next.js 16 App Router app using Cache Components.
- Patch this week: PAN-OS CVE-2026-0322: Exploited Management-Interface RCE . Anyone running PAN-OS 10.2 through 12.2 on PA-Series or VM-Series firewalls or on Panorama, most urgently where the management web interface is exposed beyond a trusted admin network.
- Patch this week: SiteGuard WAF CVE-2026-106931: Exploited Command Injection . Organizations running SiteGuard Server Edition 2.20 or later for Apache httpd, Nginx or IIS below 8.00 Update 5 (7.00 Update 6 on FreeBSD) with the default-on statistics feature, a product JPCERT/CC says is widely used in Japan.
- Do you run any of these? Cisco Secure Email Gateway, Ahsay AhsayCBS, Palo Alto Networks PAN-OS. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-10-17.
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Patch this week** [Next.js: Two Critical Unauthenticated RCEs (Oct 14)](https://erroneo.us/security/briefs/nextjs-use-cache-image-optimizer-rce/index.md): Self-hosted Next.js apps should move to 16.4.1 or 15.5.28 this week; both RCEs have preconditions and no exploitation is reported, but the fix is a routine minor upgrade.
- **Patch this week** [PAN-OS CVE-2026-0322: Exploited Management-Interface RCE](https://erroneo.us/security/briefs/pan-os-cve-2026-0322-management-interface-rce/index.md): Patch every PAN-OS firewall and Panorama this week, and today if the management interface is reachable from the internet; the bug needs an admin login but is already being exploited.
- **Patch this week** [SiteGuard WAF CVE-2026-106931: Exploited Command Injection](https://erroneo.us/security/briefs/siteguard-server-edition-cve-2026-106931-zero-day/index.md): If you run SiteGuard Server Edition, save its diagnostic data and patch this week, sooner on public web servers; the bug is exploited, but its local rating means attackers need a foothold first.

## Known exploited (CISA KEV)

- [CVE-2026-76519](https://erroneo.us/security/cve/CVE-2026-76519/index.md) Cisco Secure Email Gateway: Cisco Secure Email Gateway Relative Path Traversal Vulnerability (CISA due 2026-10-17)
- [CVE-2026-105134](https://erroneo.us/security/cve/CVE-2026-105134/index.md) Ahsay AhsayCBS: Ahsay AhsayCBS Command Injection Vulnerability (CISA due 2026-10-17)
- [CVE-2026-105133](https://erroneo.us/security/cve/CVE-2026-105133/index.md) Ahsay AhsayCBS: Ahsay AhsayCBS Improper Authentication Vulnerability (CISA due 2026-10-17)
- [CVE-2026-0322](https://erroneo.us/security/cve/CVE-2026-0322/index.md) Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Code Injection Vulnerability (CISA due 2026-10-17)

## Critical advisories

None.

---
Source page: https://erroneo.us/security/2026-10-14/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt