---
title: "Security digest: October 27, 2026"
url: https://erroneo.us/security/2026-10-27/
description: "October 27, 2026 vulnerability digest: 2 briefs (Oracle EBS CVE-2026-101767: Unauthenticated SQLi…); 2 CISA KEV additions (Adobe, Google); 5 critical…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-10-27
date_modified: 2026-10-28
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: October 27, 2026

2 editorial briefs, 2 known exploited (cisa kev) additions and 5 critical advisories.

## Take stock

- Act now: Oracle EBS CVE-2026-101767: Unauthenticated SQLi to RCE . Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 without the October 2026 Critical Patch Update, first those whose EBS web tier (OA_HTML) is reachable from the internet or from partner and supplier networks.
- Patch this week: MLflow CVE-2026-116692: Unauthenticated RCE via Scorers . Teams running an MLflow tracking server from 3.12.0rc0 up to 3.17.0, especially the official Docker image or any install where the server process can write to its own Python packages, and above all servers reachable without authentication.
- Do you run any of these? Adobe Commerce and Magento, Google Brotli. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-11-10.
- PyPI: 4 critical advisories ( agno , authlib , monai , mlflow ). Check with pip-audit (or: pip show <package>) .
- npm: 1 critical advisory ( better-auth ). Check with npm audit (or: npm ls <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Act now** [Oracle EBS CVE-2026-101767: Unauthenticated SQLi to RCE](https://erroneo.us/security/briefs/oracle-ebs-tcf-cve-2026-101767-sqli-rce/index.md): Attackers are already probing this unauthenticated SQL-injection-to-RCE flaw a week after the patch, and EBS holds finance, HR and payroll data, so any EBS web tier reachable from the internet needs the October CPU or the servlet blocked today.
- **Patch this week** [MLflow CVE-2026-116692: Unauthenticated RCE via Scorers](https://erroneo.us/security/briefs/mlflow-scorer-deserialization-cve-2026-116692-rce/index.md): No exploitation is reported, but the advisory spells out a five-step chain to code execution on default no-auth MLflow servers, so upgrade to 3.17.0 or later this week and today for any server reachable beyond your own team.

## Known exploited (CISA KEV)

- [CVE-2026-48356](https://erroneo.us/security/cve/CVE-2026-48356/index.md) Adobe Commerce and Magento: Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability (CISA due 2026-11-10)
- [CVE-2026-111497](https://erroneo.us/security/cve/CVE-2026-111497/index.md) Google Brotli: Google Brotli Unchecked Return Value Vulnerability (CISA due 2026-11-10)

## Critical advisories

- [CVE-2026-35002](https://erroneo.us/security/cve/CVE-2026-35002/index.md) Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall` — PyPI agno < 2.3.24 → 2.3.24
- [CVE-2026-114607](https://erroneo.us/security/cve/CVE-2026-114607/index.md) better-auth: OAuth state can be used as a Magic Link to sign in as another user — npm better-auth >= 1.4.0-beta.18, < 1.7.7 → 1.7.7
- [CVE-2026-96760](https://erroneo.us/security/cve/CVE-2026-96760/index.md) Authlib: empty signatures validation in JWS JSON deserialization — PyPI authlib <= 1.8.0 → 1.9.0
- [CVE-2026-48705](https://erroneo.us/security/cve/CVE-2026-48705/index.md) MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass) — PyPI monai < 1.6.1 → 1.6.1
- [CVE-2026-116692](https://erroneo.us/security/cve/CVE-2026-116692/index.md) MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules — PyPI mlflow >= 3.12.0rc0, < 3.17.0 → 3.17.0

---
Source page: https://erroneo.us/security/2026-10-27/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt