Cyber One Solutions logo.
Get Support

Security Advisory

This Week's Top 5: A BeyondTrust Zero-Day by a Suspected Nation-State Actor, Five More Exploited Flaws, and the End of Windows Server 2012 Patching

Published October 18, 2026 · Updated October 18, 2026 · Cyber One Solutions

CISA added nine actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog this week, including a BeyondTrust Remote Support zero-day that BeyondTrust and Google's Mandiant say a suspected nation-state actor used for nearly seven weeks before disclosure. Extended Security Updates for Windows Server 2012 and 2012 R2 also ended for good on October 13. Here are the five verified developments for small and mid-size businesses this week, ranked by relevance, exploitation evidence, and urgency.

This brief covers verified security and compliance developments from Sunday, October 11 through Saturday, October 17, 2026, with a research cutoff of Sunday, October 18, 2026 at 6:00 a.m. Central. It is the edition for the regular Sunday, October 18 slot. It was a heavy week for CISA's Known Exploited Vulnerabilities (KEV) catalog: nine vulnerabilities across eight vendors were added in seven days, each with reliable evidence that attackers are already using it, and one of them is a zero-day a named, suspected nation-state actor used against a remote-support vendor for nearly seven weeks before its public disclosure. The same week closed out a three-year countdown that had nothing to do with active exploitation at all: the last Extended Security Update for Windows Server 2012 and 2012 R2 shipped on October 13, and no further year follows it.

Executive Summary and Priorities

Five verified developments met our bar for inclusion this week:

How We Ranked This Week's Developments

We ranked these five by how many of the businesses we serve are likely to run the affected technology, the strength of the exploitation evidence (a vendor's own confirmation, a CISA KEV listing, or both), how directly the affected system is reachable from the internet or from a privileged position inside the network, and how much time remains before a deadline or consequence lands. The KEV due dates referenced below are the catalog dates CISA uses to set federal civilian agencies' own remediation timelines under Binding Operational Directive 26-04, each calculated per agency and per asset from its exposure, not a single deadline that binds every system or that applies to your business directly; we use them here only as a signal of how urgently CISA rates each flaw.

BeyondTrust ranks first because the exploitation evidence here is unusually deep and specific: two named companies jointly confirmed a suspected nation-state actor's zero-day use, documented its full post-exploitation pattern, and warned that this actor has a history of moving from narrow, selective use to broad scanning of every unpatched instance once a flaw goes public. Atlassian ranks second on severity and evidence strength, with the narrowest remaining window of any item here, since its KEV due date is today. Cisco and PAN-OS rank third: Cisco's flaw is unauthenticated and rated critical, while PAN-OS requires the attacker to already hold valid credentials, so the pair sits a step below Atlassian on ease of exploitation even though both are now past their KEV due dates. Ivanti and Windows Shell rank fourth: Ivanti's flaw is unauthenticated and the attack chain is confirmed in detail, but the standalone Windows Shell flaw matters most as a building block in a phishing chain rather than as an internet-facing flaw of its own. Windows Server 2012 ranks fifth not because it is less consequential over time, but because nothing about it is a this-week exploitation event; it is a deadline that landed, and the risk it creates accumulates rather than detonates. These rankings are editorial judgments, not a measured risk score.

1. A BeyondTrust Remote Support Zero-Day, Exploited by a Suspected Nation-State Actor Since August

BeyondTrust and Google's Mandiant jointly disclosed on October 15-16, 2026 that a suspected China-nexus espionage actor Mandiant tracks as ARMORY CASTLE (formerly UNC5221, the same cluster CrowdStrike tracks as WARP PANDA) exploited CVE-2026-102764, an improper origin-validation flaw in an internal messaging component of BeyondTrust Remote Support, as a zero-day beginning August 29, 2026, against one SaaS-hosted and one self-hosted appliance. CISA added the flaw to its KEV catalog on October 16 with an October 19 due date. BeyondTrust rates the flaw 9.3 under CVSS v4.0; NVD separately scores it 9.8 under CVSS v3.1. This is not a flaw where exploitation is merely confirmed; Mandiant documented the actor's full tradecraft, including root-level compromise within minutes, persistence designed to survive a reboot, credential harvesting, and deletion of the appliance's own logs before leaving.

Remote-support software sits in an unusually sensitive spot: it exists specifically so a help desk or managed service provider can reach into endpoints, often with elevated access, which is exactly why this category of software draws this category of attacker. BeyondTrust patched SaaS tenants automatically by October 9 and shipped a self-hosted patch the same week; Privileged Remote Access was patched out of caution even though BeyondTrust found no confirmed way to exploit this specific flaw in that product. If your help desk, internal IT team, or MSP uses BeyondTrust Remote Support or Privileged Remote Access, our full advisory covers the patch status check, the compromise-assessment steps Mandiant recommends specifically for a self-hosted Remote Support appliance that was internet-reachable since late August (BeyondTrust found no confirmed way to exploit this flaw in PRA, so a self-hosted PRA appliance without separate evidence of compromise needs only the precautionary patch), and the credential-rotation order to follow once an appliance is patched or rebuilt.

2. CISA Confirms Active Exploitation of a Critical Atlassian File-Access Flaw Atlassian Itself Could Not Rule Out

CISA added CVE-2026-21589 to its KEV catalog on October 15, 2026 with an October 18 due date, the same day this brief publishes. Atlassian's own advisory, published ten days earlier on October 5, rates the flaw 9.3 under CVSS v4.0 and describes an unauthenticated attacker able to access specific files inside the web application root of an affected product, across eight self-hosted products: six labeled Data Center plus Crucible and Fisheye, which are not labeled Data Center but are affected all the same. What makes the CISA listing notable is the gap it fills: Atlassian's advisory states its investigation found no evidence of exploitation in the already-patched Cloud products, a statement scoped only to Cloud, while for the self-hosted products this flaw actually affects, Atlassian says plainly it "cannot confirm if your instances have been affected." CISA's KEV catalog only adds a vulnerability when it has reliable evidence of active use, so the October 15 listing is newer, federal-level evidence where the vendor itself could not confirm either way.

Exploitation requires the attacker to already know the exact file name and path they want to read; the flaw does not let an attacker browse directory contents to find targets on its own, which somewhat narrows the practical risk even at this severity. If your organization runs a self-hosted Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible, or Fisheye instance, our full advisory lists every affected product and fixed version and the log-review steps worth taking given how far exploitation may already have progressed before this week's confirmation.

3. Two More Exploited Edge-Device Flaws: Cisco Secure Email Gateway and Palo Alto PAN-OS

CISA added two unrelated vulnerabilities to its KEV catalog on the same day, October 14, 2026, both with an October 17 due date that has already passed: CVE-2026-76519 in Cisco Secure Email Gateway and CVE-2026-0322 in Palo Alto Networks PAN-OS. Cisco's flaw is the more severe of the pair by evidence and access: a relative path-traversal issue, rated CVSS v3.1 9.8, that lets an unauthenticated attacker write arbitrary files to the appliance's operating system when File Reputation is enabled and the appliance's Content Scanner Tools component is behind version 25.3.0.5525, a common configuration since File Reputation is a standard anti-malware feature. Cisco's Product Security Incident Response Team confirmed active exploitation. PAN-OS's flaw, by contrast, requires the attacker to already hold valid credentials and reach the management interface over the network; Palo Alto rates it 8.6 under CVSS v4.0 and describes only "very limited exploitation" from three identified IP addresses, a meaningfully lower bar of evidence than Cisco's.

A business running either product should treat the two differently: Cisco's flaw needs attention regardless of who can authenticate, while PAN-OS's risk depends heavily on whether the management interface is reachable only from a restricted network, which it should be regardless of this specific flaw. Our full advisory has the exact fixed versions for each and Cisco's note about which Secure Email Cloud customers it has already contacted directly.

4. Ivanti Connect Secure and a Windows Shell Flaw, Both Past Their KEV Due Date

CISA added two more vulnerabilities on October 13, 2026, with an October 16 due date already behind us: CVE-2026-104935, an unauthenticated authentication-bypass-by-spoofing flaw in Ivanti Connect Secure that lets a remote attacker run arbitrary commands on the VPN appliance with no credentials at all, and CVE-2026-96951, a command-injection flaw in Windows Shell that lets a crafted file slip past Mark of the Web protections. The Ivanti flaw carries the more detailed exploitation account of the two: the security firm Volexity reports exploitation began October 3 against an appliance that was fully patched at the time, after which the attacker harvested the domain credentials the appliance used for LDAP, searched Active Directory for LAPS passwords and BitLocker recovery keys, and deleted log entries to cover their tracks. CISA and Volexity both warn that Ivanti's Integrity Checker Tool may show no changes on a compromised device, because the attacker's commands ran in memory; a clean scan is not proof an appliance was untouched.

If your business runs Ivanti Connect Secure for remote access, patch every affected appliance regardless of exposure, which is Volexity's own recommendation; patching alone does not confirm you were not already reached, though, so an appliance that was internet-facing on a vulnerable version since early October is worth checking for signs of compromise, such as unusual administrative changes, unfamiliar files, or VPN sessions you cannot account for. Because this attack runs in memory and can evade the Integrity Checker Tool, a clean-looking check is not proof either way; if anything looks suspicious, or you otherwise have reason to suspect compromise, isolate the appliance and preserve evidence before any reset, then follow the full factory-reset-and-rebuild and credential-rotation sequence rather than patching in place. Windows Shell's flaw needs its own urgency despite being a building block rather than a standalone internet-facing exploit: Microsoft rates it 8.8, CISA confirms active exploitation, and the fix shipped in Microsoft's October 13 security updates, so if your business has not yet deployed this month's Windows updates, prioritize doing so rather than waiting for your next regular cycle; Mark of the Web is one of the checks that stands between a downloaded file and silent execution, and it only takes one user opening a crafted file to lose that protection. Our full advisory has the exact fixed builds for each Ivanti branch, what to check for, and the full recovery sequence if you find it.

5. Windows Server 2012 and 2012 R2: The Patching Countdown Reached Zero

Extended Security Updates for Windows Server 2012 and 2012 R2 ended with Microsoft's October 13, 2026 security update, the final one the program provides anywhere, including the no-cost coverage Microsoft had offered for the same three years to workloads hosted in Azure, apart from a narrow Premium Assurance exception for customers who already held that agreement before Microsoft withdrew it from sale (if that may be you, check its specific terms rather than assuming the cutoff applies). This is not an exploited vulnerability; it is the scheduled end of a three-year-old countdown, and it belongs in this brief because of what it changes going forward rather than what happened this week on its own: a server still running either version keeps working exactly as before, but outside that narrow exception, no new security patch arrives for it anywhere now, through any channel.

The detail most IT teams get wrong is Azure. Moving a 2012 or 2012 R2 workload into Azure now does not newly qualify it for three fresh years of free patching; that window ran on the same fixed October 2023-to-October 2026 calendar as the paid on-premises program, not three years from whenever a given workload actually migrated, so it closed with everyone else's. If your business still has one of these servers in production, our full coverage explains what ESU actually covered, the narrow set of editions that were ever eligible, and the in-place upgrade paths Microsoft documents for moving a 2012 or 2012 R2 workload to a currently supported release. For businesses subject to the FTC Safeguards Rule or HIPAA Security Rule, continuing to run a server that can no longer receive a security patch at all is itself a fact your next risk assessment needs to account for, whether or not a specific exploit targets it this month.

Also Added to the KEV Catalog This Week

CISA also added CVE-2025-61624, a path-traversal flaw in FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager, to its catalog on October 16 alongside the BeyondTrust entry. We did not rank it: Fortinet's own advisory, FG-IR-26-122, rates it 6.0 under CVSS v3.1, its own "medium" severity band, and it requires an attacker who already holds privileged administrator credentials. In our own editorial judgment that combination sits below this week's five ranked items, though CVSS scores and vendor severity labels are not all directly comparable to one another, so we are not claiming a precise numeric ranking against each one. If your business or IT provider runs FortiOS, FortiPAM, FortiProxy, or FortiSwitchManager, ask whether the fixed version for your branch is installed; FortiOS 7.2, 7.0, and 6.4, FortiProxy 7.2 and 7.0, and FortiPAM releases before 1.7 have no fix of their own and need to move to a currently supported branch instead, since an already-compromised admin account is exactly the scenario this flaw would extend.

CISA also added CVE-2026-105133 and CVE-2026-105134, in Ahsay's AhsayCBS backup-server platform, on October 14. We did not cover them again in full here: our October 11 brief already covered this pair in depth, and this week's KEV listing confirms exploitation CISA now has evidence of without adding a new actionable fact. Two updates since that brief published, though: Ahsay's October 12 announcement says the v10.3.4.0 and v9.15.2.59 patches it had already shipped were themselves incomplete, so the fix is now v10.3.4.45 for the v10 line and v9.15.2.70 for v9, each requiring a reboot after applying it; and Ahsay's more specific October 13 status update says v7 and v8 installations cannot apply that hotfix directly and must first upgrade to v9.15.0.0, then apply v9.15.2.70 (both on Ahsay's partner portal). If you or your backup provider run AhsayCBS on any version, confirm which path applies to your line and that it is complete.

Do Now

Plan Next

Watch List

The Bottom Line

Four of this week's five developments are remote-access or edge-facing systems: the appliances and gateways a business depends on to let employees in and keep attackers out. The fifth is a reminder that patching is not indefinite; a server that has run out of updates is not a future problem, it is today's attack surface with no fix coming. This brief is general security awareness, not a HIPAA, FTC Safeguards, or cyber-insurance compliance service. Cyber One Solutions helps commercial businesses keep remote-access systems patched and watched through managed cybersecurity, and finds end-of-life servers and forgotten appliances through IT and security assessments. If you are not sure where to start, our free cybersecurity risk score is a quick way to see which of this week's gaps may apply to you.

Sources