---
title: "Security digest: October 15, 2026"
url: https://erroneo.us/security/2026-10-15/
description: "October 15, 2026 vulnerability digest: 2 briefs (BeyondTrust Remote Support CVE-2026-102764…); 1 CISA KEV addition (Atlassian); 6 critical advisories (Go…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-10-15
date_modified: 2026-10-20
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: October 15, 2026

2 editorial briefs, 1 known exploited (cisa kev) addition and 6 critical advisories.

## Take stock

- Act now: BeyondTrust Remote Support CVE-2026-102764 Zero-Day . Organizations running self-hosted BeyondTrust Remote Support (any version through 26.2.3), and self-hosted Privileged Remote Access as a precaution.
- Check exposure: Siemens Software Center DLL Flaw Abused in ClickFix Attacks . Security teams with Windows endpoints, since attackers bring the vulnerable signed program themselves, and organizations that run Siemens Software Center for Siemens engineering software.
- Do you run any of these? Atlassian Multiple Products. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-10-18.
- Go: 5 critical advisories ( vitess.io/vitess , github.com/dgraph-io/dgraph/v25 , github.com/argoproj/argo-cd/v2 , github.com/argoproj/argo-cd/v3 , github.com/kedacore/keda , github.com/kedacore/keda/v2 , github.com/containers/podman , go.podman.io/podman/v6 ). Check with govulncheck ./... .
- npm: 1 critical advisory ( @tanstack/start-server-core , @tanstack/react-start , @tanstack/solid-start , @tanstack/vue-start ). Check with npm audit (or: npm ls <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Act now** [BeyondTrust Remote Support CVE-2026-102764 Zero-Day](https://erroneo.us/security/briefs/beyondtrust-remote-support-cve-2026-102764-zero-day/index.md): If you run a self-hosted BeyondTrust Remote Support appliance, patch it today and assume it may already be compromised; an espionage group used this as a zero-day for about seven weeks.
- **Check exposure** [Siemens Software Center DLL Flaw Abused in ClickFix Attacks](https://erroneo.us/security/briefs/siemens-software-center-dll-sideloading-cve-2026-110936/index.md): Siemens users get the fix automatically, but the real threat is attackers shipping their own signed, older copy as a malware loader, so Windows defenders should block the indicators and hunt rather than rely on patching.

## Known exploited (CISA KEV)

- [CVE-2026-21589](https://erroneo.us/security/cve/CVE-2026-21589/index.md) Atlassian Multiple Products: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability (CISA due 2026-10-18)

## Critical advisories

- [CVE-2026-104252](https://erroneo.us/security/cve/CVE-2026-104252/index.md) Vitess vttablet /twopcz reflected XSS — Go vitess.io/vitess < 0.23.5 → 0.23.5; Go vitess.io/vitess >= 0.24.0, < 0.24.2 → 0.24.2
- [CVE-2026-102989](https://erroneo.us/security/cve/CVE-2026-102989/index.md) TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses — npm @tanstack/start-server-core >= 1.143.12, < 1.169.39 → 1.169.39; npm @tanstack/react-start >= 1.143.12, < 1.168.60 → 1.168.60; npm @tanstack/solid-start >= 1.143.12, < 1.168.57 → 1.168.57
- [CVE-2026-102748](https://erroneo.us/security/cve/CVE-2026-102748/index.md) Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service — Go github.com/dgraph-io/dgraph/v25 <= 25.3.8 → 25.4.0
- [CVE-2026-77459](https://erroneo.us/security/cve/CVE-2026-77459/index.md) Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks — Go github.com/argoproj/argo-cd/v2 >= 2.10.0, <= 2.14.21 → no fix; Go github.com/argoproj/argo-cd/v3 >= 3.0.0, < 3.3.15 → 3.3.15; Go github.com/argoproj/argo-cd/v3 >= 3.4.0, < 3.4.10 → 3.4.10
- [CVE-2026-77524](https://erroneo.us/security/cve/CVE-2026-77524/index.md) KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication — Go github.com/kedacore/keda <= 1.5.0 → no fix; Go github.com/kedacore/keda/v2 < 2.21.0 → 2.21.0
- [CVE-2026-94603](https://erroneo.us/security/cve/CVE-2026-94603/index.md) Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation — Go github.com/containers/podman >= 4.4.0, < 5.8.8 → 5.8.8; Go go.podman.io/podman/v6 >= 6.0.0, < 6.1.3 → 6.1.3

---
Source page: https://erroneo.us/security/2026-10-15/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt