Security brief | 2026-10-21

Microsoft October updates: identify affected systems

GovCERT.HK issued a high-risk alert on vulnerabilities in multiple Microsoft products and noted reports of attacks exploiting CVE-2026-96951.

Adobe Commerce: verify UNKNOWN results after patching

Adobe updated its October standalone patch for version 2.4.8-p5. Earlier installations may be reported as UNKNOWN by the tool; Adobe states that this status alone does not mean the environment remains vulnerable.

OAuth risks: a genuine sign-in page can still be abused

HKCERT updated its article on OAuth risks, covering device-code phishing and token abuse. A legitimate sign-in or MFA step may still give an attacker access when a user is tricked into granting permission.

Veeam iResOps: understand AI activity across Microsoft 365 data

Veeam announced general availability of Intelligent ResOps for Microsoft 365 as an add-on to Veeam Data Cloud for Microsoft 365, connecting AI activity, data permissions and recovery information.

Veeam introduces its Sovereign Service Providers programme

Veeam announced a phased Sovereign Service Providers programme, starting with a Data Sovereignty Competency for VCSPs that covers operational, legal, technical and governance requirements.

CVE-2026-9869 | NVD vulnerability record

NVD published this record on 2026-10-20 and last updated it on 2026-10-20.

Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant

CVE-2026-9827 | NVD vulnerability record

NVD published this record on 2026-10-20 and last updated it on 2026-10-20.

Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant

Cachet has Stored XSS in Incident Component

GitHub Advisory Database lists GHSA-x397-5hrv-j9m9 for package cachethq/cachet, with affected range <= 2.4.1.

Compiled / adapted by AL-Touch · CC-BY-4.0

A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure

GitHub Advisory Database lists GHSA-x32g-jvvm-4725 for package org.a2aproject.sdk:a2a-java-sdk-transport-rest, with affected range < 1.3.0.Final.

Compiled / adapted by AL-Touch · CC-BY-4.0

Introducing a new AI chapter in the NCSC research problem book

UK NCSC published or updated this public security item on 2026-10-20. The original title and link are retained for verification.

Compiled / adapted by AL-Touch · Open Government Licence v3.0

Fortinet Products Elevation of Privilege Vulnerability

HKCERT published or updated this public security item on 2026-10-20. The original title and link are retained for verification.

Compiled / adapted by AL-Touch · CC-BY-3.0-HK

Microsoft Edge Multiple Vulnerabilities

HKCERT published or updated this public security item on 2026-10-20. The original title and link are retained for verification.

Compiled / adapted by AL-Touch · CC-BY-3.0-HK

Multiples vulnérabilités dans Laravel (20 octobre 2026)

ANSSI / CERT-FR published or updated this public security item on 2026-10-20. The original title and link are retained for verification.

Compiled / adapted by AL-Touch · Licence Ouverte / Open Licence v2.0