erroneo.us
Search all guides⌘K

Digest · Tuesday

Security digest: October 27, 2026

2 editorial briefs, 2 known exploited (cisa kev) additions and 5 critical advisories.

All digests · RSS · Markdown

Take stock

  • Act now: Oracle EBS CVE-2026-101767: Unauthenticated SQLi to RCE. Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 without the October 2026 Critical Patch Update, first those whose EBS web tier (OA_HTML) is reachable from the internet or from partner and supplier networks.
  • Patch this week: MLflow CVE-2026-116692: Unauthenticated RCE via Scorers. Teams running an MLflow tracking server from 3.12.0rc0 up to 3.17.0, especially the official Docker image or any install where the server process can write to its own Python packages, and above all servers reachable without authentication.
  • Do you run any of these? Adobe Commerce and Magento, Google Brotli. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-11-10.
  • PyPI: 4 critical advisories (agno, authlib, monai, mlflow). Check with pip-audit (or: pip show <package>).
  • npm: 1 critical advisory (better-auth). Check with npm audit (or: npm ls <package>).
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Vulnerability · CVE-2026-101767

Oracle EBS CVE-2026-101767: Unauthenticated SQLi to RCE

Attackers are already probing this unauthenticated SQL-injection-to-RCE flaw a week after the patch, and EBS holds finance, HR and payroll data, so any EBS web tier reachable from the internet needs the October CPU or the servlet blocked today.

Must act: Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 without the October 2026 Critical Patch Update, first those whose EBS web tier (OA_HTML) is reachable from the internet or from partner and supplier networks.

Can relax: Teams that have applied the October 2026 CPU, and organizations that do not run Oracle EBS; Oracle Fusion Cloud applications are a different product and are not listed for this CVE.

  1. Find every EBS instance and its release: SELECT release_name FROM apps.fnd_product_groups; and note which web tiers are reachable from the internet or partner networks.
  2. Apply the October 2026 Critical Patch Update for E-Business Suite, using the patch list in My Oracle Support note KA923, starting with internet-facing instances.
  3. Until patched, remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist; Horizon3 notes the default URL firewall allows it.

Read the brief →

Patch this week

· Vulnerability · CVE-2026-116692

MLflow CVE-2026-116692: Unauthenticated RCE via Scorers

No exploitation is reported, but the advisory spells out a five-step chain to code execution on default no-auth MLflow servers, so upgrade to 3.17.0 or later this week and today for any server reachable beyond your own team.

Must act: Teams running an MLflow tracking server from 3.12.0rc0 up to 3.17.0, especially the official Docker image or any install where the server process can write to its own Python packages, and above all servers reachable without authentication.

Can relax: Users of MLflow below 3.12.0 or at 3.17.0 and later, local-only servers on the default 127.0.0.1 binding, people who only use the MLflow client library, and servers whose package directories are read-only to the server process.

  1. Check every tracking server: pip show mlflow, or docker exec <container> pip show mlflow; anything from 3.12.0rc0 up to 3.17.0 is affected.
  2. Upgrade to 3.17.0 or later (pip install -U "mlflow>=3.17.0" or pull a 3.17.x image) and restart the server.
  3. Until upgraded, take the server off untrusted networks and put it behind authentication (MLflow basic auth, a VPN or an identity-aware proxy).

Read the brief →

Known exploited (CISA KEV) 2

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2026-48356Adobe Commerce and Magento
Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability		2026-11-10
CVE-2026-111497Google Brotli
Google Brotli Unchecked Return Value Vulnerability		2026-11-10

Critical advisories by ecosystem 5

GitHub-reviewed advisories rated critical, published this day (Pacific time).

PyPI 4

Check: pip-audit (or: pip show <package>)

npm 1

Check: npm audit (or: npm ls <package>)