FOCUS FRIDAY: TPRM Insights on Critical Vulnerabilities in Citrix NetScaler, ONLYOFFICE Docs, MSSQL, Exchange Server, SharePoint, NGINX UI, MariaDB, and ProFTPD

Introduction

This week's Focus Friday addresses eight FocusTags® spanning active advisory expansion, a record-breaking product vulnerability disclosure, and confirmed nation-state exploitation of two vulnerabilities whose original disclosure dates span more than a decade. Citrix NetScaler leads the week in operational urgency: this is the platform's third distinct advisory expansion within October, adding a new CNA-rated memory overflow, a SAML IdP memory overread, and a race-condition session mixup on top of the KEV-listed RCE cluster from the October 9 cycle — creating a compounding re-engagement burden for any TPRM team that already confirmed remediation last week. SharePoint follows with the largest single-month disclosure batch in the product's recorded history: thirty-six CVEs covering remote code execution, elevation of privilege, cross-site scripting, server-side request forgery, and information disclosure across all three supported SharePoint release lines.

Two of the eight advisories center on CVEs now appearing on CISA's Known Exploited Vulnerabilities catalog for the first time. ONLYOFFICE Docs carries a 2021 path traversal vulnerability being actively weaponized by Flax Typhoon — a Chinese APT attributed to the PRC — in ongoing campaigns against enterprise collaboration environments. ProFTPD carries a decade-old complete authentication bypass in the mod_copy module confirmed as currently exploited, with a near-certain exploitation probability at 96.75% EPSS. These historical CVE activations require immediate re-assessment across vendor inventories, as standard patch cycle monitoring would have dismissed these vulnerabilities years ago. Exchange Server, MSSQL, NGINX UI, and MariaDB complete the week with October Patch Tuesday batches and new code injection pathways requiring urgent patching attention.

Filtered view of vendors with the Citrix NetScaler - Oct2026 FocusTag® on the Black Kite platform.

Citrix NetScaler - Oct2026

What is this vulnerability?

Citrix NetScaler ADC and NetScaler Gateway remain under continuous active advisory expansion through October 2026. This FocusTag® — the third distinct NetScaler advisory cluster within the month — introduces five CVEs, two of which (CVE-2026-88771 and CVE-2026-88772) were previously included in the October 9 advisory cycle and carry CISA KEV status from that prior cluster. The three new additions are CVE-2026-107406, CVE-2026-3055, and CVE-2026-4368.

CVE-2026-107406 is a memory buffer overflow in NetScaler ADC and Gateway that Citrix's own CNA has scored at CVSSv4 9.5 — a critical severity assignment — while NVD scoring remains pending at time of disclosure. The vulnerability can be triggered remotely, leading to unintended control flow or denial of service. CVE-2026-3055 introduces a memory overread specific to deployments where NetScaler is configured as a SAML Identity Provider — a pattern common in enterprises using NetScaler for SSO authentication federation. CVE-2026-4368 is a race condition in session management that can cause sessions to be incorrectly assigned between users, with NVD scoring pending; the impact is potential session hijacking if an attacker can time the race condition to inherit another user's authenticated session. CVE-2026-88771 (CVSS 9.8, unauthenticated RCE via improper input validation) and CVE-2026-88772 (CVSS 8.1, memory overflow via DTLS) were KEV-listed in the prior October advisory and are included here as part of the consolidated advisory.

CVE-2026-88771 and CVE-2026-88772 carry CISA KEV status from the October 9, 2026 advisory. CVE-2026-107406, CVE-2026-3055, and CVE-2026-4368 are new to this advisory cycle — verify with Citrix that your current build addresses all five CVEs.

Why should TPRM professionals care?

Citrix NetScaler's third advisory expansion in October creates a significant TPRM re-engagement problem. Vendors who responded to the October 9 advisory and communicated confirmed remediation may not have patched to the build level required to address CVE-2026-107406, CVE-2026-3055, and CVE-2026-4368 — all new to this cycle. Vendor responses focused narrowly on the KEV-listed pair (CVE-2026-88771, CVE-2026-88772) may have missed the new additions entirely.

CVE-2026-3055's SAML IdP-specific attack surface is a particularly high-priority concern: enterprises commonly deploy NetScaler as the authentication gateway for SSO into multiple downstream applications. A memory overread in this configuration could expose sensitive authentication data, and a crash of the SAML IdP component cascades into SSO unavailability across all federated applications. CVE-2026-4368's race condition → session mixup is especially dangerous in multi-tenant or high-concurrency environments, where an attacker who can time requests to exploit the race may inherit another user's authenticated NetScaler session — including privileged administrative sessions.

What questions should TPRM professionals ask vendors?

1. Have you confirmed the currently deployed NetScaler ADC and Gateway build version addresses all five CVEs in this advisory — specifically CVE-2026-107406, CVE-2026-3055, and CVE-2026-4368, which are new beyond the October 9 advisory?
2. Is any NetScaler appliance configured as a SAML Identity Provider for SSO authentication federation, which specifically exposes the deployment to CVE-2026-3055's memory overread?
3. If you already confirmed remediation for the October 9 NetScaler advisory, is that build version also sufficient for this expanded advisory, or does it require an additional upgrade?
4. Have you conducted a compromise assessment for the window between deployment of the October 9 patch and deployment of the October 16 patch, during which CVE-2026-107406 and CVE-2026-3055 remained exploitable?
5. What network controls are in place around NetScaler management interfaces and DTLS endpoints while the updated patch deployment is completed?

Remediation recommendations

• Deploy the latest Citrix-published NetScaler ADC and Gateway builds that address all five CVEs in this advisory cluster — verify build-level specificity against Citrix's October 16 advisory, as prior October builds may not address CVE-2026-107406, CVE-2026-3055, and CVE-2026-4368.
• Prioritize SAML IdP-configured deployments for immediate patching, as CVE-2026-3055 specifically targets NetScaler acting as a SAML Identity Provider.
• Re-engage all vendors previously confirmed as patched for the October 9 NetScaler advisory to verify the updated build version addresses the complete five-CVE set.
• Restrict NetScaler management interfaces to allowlisted IP ranges and disable DTLS on deployments where it is not operationally required until patching is complete.

Black Kite's Citrix NetScaler - Oct2026 FocusTag® details critical insights on the event for TPRM professionals.

ONLYOFFICE Docs

What is this vulnerability?

ONLYOFFICE Docs is an open-source collaborative office suite providing word processing, spreadsheet, and presentation editing through a web-based server deployment model. Organizations and managed service providers deploy ONLYOFFICE Docs as a self-hosted alternative to Microsoft 365, Google Workspace, and Nextcloud Office, particularly in privacy-sensitive, government, and regulated-industry environments that prefer on-premises document processing over cloud-hosted alternatives.

CVE-2021-3199 is a path traversal vulnerability in ONLYOFFICE Docs' file handling pipeline, present in versions prior to 6.1.0. The vulnerability allows remote attackers to manipulate file path references using directory traversal sequences — causing the server to resolve file paths outside the intended document storage boundaries. By chaining this traversal with ONLYOFFICE's internal document processing and conversion components, an attacker can read arbitrary files from the server filesystem, write attacker-controlled content to arbitrary locations, and achieve remote code execution by placing executable payloads in locations the server will subsequently process. The vulnerability was first disclosed in 2021 but remained absent from active exploitation catalogues until October 2026, when Flax Typhoon — a Chinese state-sponsored APT attributed to the PRC — was confirmed to be actively weaponizing it in campaigns targeting enterprise document management environments. CISA added CVE-2021-3199 to the Known Exploited Vulnerabilities catalog on October 9, 2026.

Why should TPRM professionals care?

The CISA KEV listing fundamentally changes the risk posture of every vendor in your third-party ecosystem that uses ONLYOFFICE Docs. Previously a theoretical vulnerability in a prior year's advisory, CVE-2021-3199 is now a confirmed, actively-exploited pathway under APT-level targeting. The CVSS base score is 9.8 (CRITICAL), and EPSS has reached 8.22% — reflecting the probability uplift from confirmed active exploitation.

State-sponsored exploitation context matters uniquely for TPRM. Flax Typhoon operations typically prioritize persistence and lateral movement over immediate data exfiltration — meaning vendors already compromised may show no operational disruption while attackers establish long-term footholds. TPRM teams cannot rely on vendor-reported incident signals as an indicator of compromise. ONLYOFFICE Docs is disproportionately represented in vendor environments processing sensitive documents: legal firms, healthcare providers, government contractors, and professional services. In these sectors, a path traversal reaching system files, SSH keys, or credential stores is operationally catastrophic.

The five-year gap between disclosure and KEV listing underscores a systemic TPRM gap: vulnerabilities from prior years routinely fall out of active patch monitoring programs. TPRM teams must assess whether vendors with ONLYOFFICE Docs have applied patches from the 2021 advisory cycle that may never have been flagged in current vulnerability management programs.

What questions should TPRM professionals ask vendors?

1. Is ONLYOFFICE Docs deployed in your environment, and have you confirmed the installed version is 6.1.0 or later — the version that remediates CVE-2021-3199's path traversal?
2. Given that this vulnerability has been added to CISA KEV as a currently exploited vulnerability attributed to the Flax Typhoon APT, have you conducted or initiated a compromise assessment or threat hunt focused on your ONLYOFFICE Docs deployment?
3. Does your vulnerability management program have a process for re-evaluating older CVEs (pre-2024) when they are newly added to CISA KEV, or does your active monitoring focus primarily on current-year disclosures?
4. Is ONLYOFFICE Docs exposed to the internet, or is it restricted to internal networks with prior authentication required — and if exposed, what perimeter controls were in place before the KEV listing?
5. What access did the ONLYOFFICE Docs server have to sensitive filesystem paths — including SSH keys, credential files, database configurations, or other high-value targets — that a path traversal attack could have reached?

Remediation recommendations

• Upgrade ONLYOFFICE Docs to version 6.1.0 or later immediately; this is a CISA KEV-designated actively-exploited vulnerability with a federal remediation deadline applicable to US government-connected organizations.
• Conduct a compromise assessment focused on file system access logs, ONLYOFFICE Docs server request logs, and outbound network connections from the ONLYOFFICE Docs host — given confirmed Flax Typhoon exploitation of this CVE in active campaigns.
• Restrict ONLYOFFICE Docs deployments to internal networks behind authentication barriers; eliminate any direct internet exposure of the document server.
• Implement file system access controls limiting the ONLYOFFICE Docs service account to only the specific directories required for operation, preventing traversal from reaching OS-level or credential file paths.

Black Kite's ONLYOFFICE Docs FocusTag® details critical insights on the event for TPRM professionals.

MSSQL - Oct2026

What is this vulnerability?

Microsoft SQL Server's October 2026 Patch Tuesday batch delivers twenty-two CVEs across SQL Server editions from 2019 through the current 2026 release. All twenty-two CVEs are newly disclosed — NVD scoring was pending for each at time of publication — and all carry EPSS scores of 0.02%, reflecting the standard baseline for newly published Patch Tuesday CVEs before public exploit code emerges. The full set spans remote code execution, elevation of privilege, information disclosure, and denial of service.

The two highest-severity RCE vulnerabilities — CVE-2026-94512 (CVSS 8.8) and CVE-2026-65674 (CVSS 8.8) — require only an authenticated SQL Server connection to trigger. CVE-2026-94512 exploits a heap-based buffer overflow in the server engine; CVE-2026-65674 exploits unsafe deserialization of SQL Server data structures. Both represent the standard attacker's priority after initial authentication: pivot from a compromised database credential to full code execution on the server host. CVE-2026-88083 is notable for requiring no SQL Server privileges — only user interaction — making it relevant for social engineering scenarios. CVE-2026-88086 is the one entry reachable from an adjacent network without authentication, making it relevant for internal lateral movement scenarios where SQL Server is network-accessible to attacker-controlled systems.

Why should TPRM professionals care?

SQL Server's October Patch Tuesday represents a critical inflection in the database vulnerability landscape. The density of the batch — twenty-two CVEs in a single advisory cycle — means organizations attempting manual triage are likely to deprioritize lower-CVSS entries that may represent lateral movement enablers in their specific deployment topology. For TPRM professionals, Microsoft SQL Server's ubiquity across enterprise environments creates mandatory scale: SQL Server is present in the overwhelming majority of enterprise back-end systems — ERP, CRM, healthcare records, financial systems, and data warehouses. A vendor with an unpatched SQL Server carries a direct pathway from database credential exposure to full server code execution.

CVE-2026-88086's adjacent-network information disclosure is the highest-priority lateral movement concern. SQL Server in enterprise environments frequently sits on internal network segments shared with jump servers, management VLANs, and other database servers. A threat actor who has achieved internal access can probe SQL Server for sensitive information without credentials — particularly relevant for TPRM scenarios where a vendor's internal network has already been partially compromised through another attack chain.

What questions should TPRM professionals ask vendors?

1. Have you applied the October 2026 SQL Server cumulative update or security patch across all SQL Server instances — including development, staging, and backup instances that may not be covered by standard production patching SLAs?
2. What is your patch deployment timeline for SQL Server cumulative updates, and has the October 2026 batch been scheduled for immediate installation rather than deferred to the next standard maintenance window?
3. Are any SQL Server instances accessible from adjacent network segments — including internal VLANs or management networks — where CVE-2026-88086's unauthenticated adjacent-network information disclosure could be exploited by an attacker who has already achieved internal access?
4. Do you have monitoring in place to detect anomalous SQL Server activity — specifically unusual query patterns, unexpected memory allocation failures, or process creation from the SQL Server process — that would signal RCE exploitation attempts?
5. What credential management practices govern SQL Server service accounts and administrative logins — are credentials rotated on a defined schedule and separated from other system credentials that would expand the blast radius of a SQL Server compromise?

Remediation recommendations

• Apply the October 2026 SQL Server cumulative update or security patch to all instances immediately, prioritizing internet-facing or credential-accessible instances; deferring SQL Server cumulative updates is a common vulnerability pattern that this 22-CVE batch makes actively dangerous.
• Audit SQL Server network exposure: any instance reachable from adjacent network segments without authentication should be treated as a priority patching target given CVE-2026-88086's unauthenticated adjacent-network information disclosure.
• Implement SQL Server audit logging to detect anomalous query patterns, excessive resource consumption, and unexpected process creation — which would signal exploitation attempts targeting the RCE vulnerabilities.
• Review and enforce least-privilege access controls on all SQL Server service accounts and administrative credentials; privilege escalation from a database-level compromise to system-level execution is the core attack chain this batch enables.

Black Kite's MSSQL - Oct2026 FocusTag® details critical insights on the event for TPRM professionals.

Exchange Server - Oct2026 (Latest)

What is this vulnerability?

Microsoft Exchange Server's October 2026 advisory delivers six CVEs across all current Exchange Server release lines. Designated '(Latest),' this advisory is distinct from the September 2026 Exchange cluster addressed in prior Focus Friday issues. Two of the six vulnerabilities are unauthenticated — the highest-priority subset for TPRM purposes.

CVE-2026-70279 is the highest-CVSS entry at 9.3: a cross-site scripting and spoofing vulnerability triggerable without authentication. An attacker sending a specially crafted email can cause Exchange to render attacker-controlled script within Outlook Web Access, enabling phishing attacks that appear as authenticated Exchange communications. CVE-2026-70571 is the most operationally severe: an unauthenticated stack buffer overflow (CVSS 8.1, CWE-121) in an Exchange protocol handler, leading to remote code execution on the Exchange server. CVE-2026-77910 (CVSS 8.8) allows an authenticated network attacker to escalate privileges within the Exchange permission model — enabling any compromised Exchange credential to move to higher administrative roles. The three remaining CVEs are local elevation of privilege vectors: CVE-2026-87692 (CVSS 7.8) exploits unsafe deserialization; CVE-2026-87695 (CVSS 7.8) exploits untrusted code inclusion; CVE-2026-87696 (CVSS 7.5) bypasses cryptographic signature verification in Exchange. All six CVEs carry EPSS scores of 0.02% at time of disclosure, consistent with newly published Microsoft CVEs before public exploit code emerges.

Why should TPRM professionals care?

Exchange Server continues to generate TPRM-critical advisories in every October cycle. The combination of an unauthenticated XSS/spoofing vulnerability (CVE-2026-70279) with an unauthenticated stack buffer overflow RCE (CVE-2026-70571) creates the exact attack chain pattern that has characterized the most damaging Exchange exploitations in recent history: initial foothold via protocol-level remote code execution, followed by privilege escalation through internal Exchange components.

CVE-2026-70279's XSS/spoofing vector is particularly relevant for TPRM because it can be triggered by sending an email — an action any external threat actor can perform against any Exchange server that accepts inbound SMTP from the internet. For TPRM professionals, this means any vendor's Exchange environment is at risk regardless of external perimeter configuration, as long as Exchange accepts email from outside the organization.

CVE-2026-87696's cryptographic signature bypass deserves specific attention as a network-accessible EoP. Cryptographic signature verification failures in Exchange are historically significant — the 2021 HAFNIUM Exchange exploitation chain used authentication bypass techniques in this same category. A bypass of Exchange's cryptographic verification could enable an attacker to forge authentication tokens or signed requests, moving laterally through Exchange infrastructure without valid credentials.

What questions should TPRM professionals ask vendors?

1. Have you applied the October 2026 Exchange Server security update to all Exchange server roles — including edge transport, hub transport, and mailbox servers that may be patched on different schedules?
2. Is your Exchange Web Services or Outlook Web Access endpoint accessible from the internet without prior authentication, directly exposing CVE-2026-70279's unauthenticated XSS and CVE-2026-70571's unauthenticated stack buffer overflow to external attackers?
3. What network access restrictions prevent external actors from reaching the vulnerable Exchange protocol handler before patching is complete — specifically for the unauthenticated RCE vector CVE-2026-70571?
4. Have Exchange administrators reviewed all privileged role assignments — including Organization Management and Exchange Administration groups — for anomalous additions that might indicate prior exploitation of CVE-2026-77910's authorization escalation vector?
5. What is your Exchange Server patch deployment SLA for security-classified updates, and can the October 2026 cumulative update be applied within 48 hours given the unauthenticated RCE and XSS attack vectors?

Remediation recommendations

• Apply the October 2026 Exchange Server cumulative update immediately across all Exchange server roles — the unauthenticated stack buffer overflow (CVE-2026-70571) and unauthenticated XSS (CVE-2026-70279) represent externally exploitable attack surface that cannot wait for standard maintenance windows.
• Restrict or block external access to Exchange protocol handlers at the network perimeter while patching is in progress, prioritizing any Exchange endpoint reachable from the internet without authentication.
• Audit Exchange role-based access control for anomalous elevation — CVE-2026-77910's incorrect authorization vulnerability creates a post-authentication escalation pathway that attackers may have already exploited in environments with prior Exchange credential exposure.
• Enable Extended Protection for Authentication (EPA) on Exchange if not already configured — this provides an additional authentication binding layer that reduces the effectiveness of signature bypass and authentication relay attacks targeting CVE-2026-87696.

Black Kite's Exchange Server - Oct2026 (Latest) FocusTag® details critical insights on the event for TPRM professionals.

SharePoint - Oct2026

What is this vulnerability?

Microsoft SharePoint's October 2026 advisory is the largest single-month SharePoint vulnerability disclosure in recorded history: thirty-six CVEs across SharePoint Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. The batch spans every major vulnerability category — remote code execution, elevation of privilege, cross-site scripting and spoofing, server-side request forgery, path traversal, information disclosure, and data tampering — representing a comprehensive risk event affecting SharePoint's entire trust model.

The two unauthenticated attack vectors define the immediate external risk boundary. CVE-2026-102866 (CVSS 8.1) is a cryptographic signature bypass enabling privilege escalation without credentials. CVE-2026-97783 (CVSS 8.1) is an unauthenticated XSS vulnerability. Both are exploitable by any attacker with HTTP access to a SharePoint web front end. The highest-EPSS entry is CVE-2026-85900 (EPSS 1.52%) — a deserialization vulnerability leading to remote code execution. Path traversal info-disclosure entries CVE-2026-70298 (EPSS 1.09%) and CVE-2026-85932 (EPSS 1.04%) are among the highest in the advisory. Among the fifteen elevation of privilege vulnerabilities, three SSRF chains (CVE-2026-70202, CVE-2026-88206, CVE-2026-70251) escalate through internal request forgery — with CVE-2026-88206 reaching SYSTEM-level privilege. CVE-2026-105713 exposes an adjacent-network SSRF that captures NTLMv2 authentication hashes, enabling offline credential cracking attacks on SharePoint administrator accounts.

Why should TPRM professionals care?

SharePoint is one of the highest-density TPRM risk surfaces in enterprise ecosystems. As the foundational document management, intranet, and collaboration platform across every sector, SharePoint's presence in third-party vendor environments is nearly universal. The thirty-six CVE batch means that even after aggressive triage, vendors face an extensive remediation list — and any organization that has not applied the October 2026 security update carries a combination of RCE, EoP, and data disclosure pathways that collectively constitute a complete compromise scenario.

CVE-2026-105713's NTLMv2 hash capture via adjacent-network SSRF is a particularly impactful TPRM concern. If an attacker operating from an adjacent network position can trigger SharePoint to make outbound NTLM-authenticated requests to attacker-controlled infrastructure, the resulting NTLMv2 hashes can be cracked offline or used directly in pass-the-hash attacks against Active Directory — a path from SharePoint access to domain credential compromise. The SQL injection EoP vector (CVE-2026-70266) creates a chained pathway from SharePoint authentication to the underlying database, meaning the SharePoint service account's SQL permissions directly determine the blast radius. The sheer volume of this advisory signals a systemic review of the SharePoint codebase; TPRM programs should treat this as a multi-cycle risk event.

What questions should TPRM professionals ask vendors?

1. Have you applied the October 2026 SharePoint cumulative update to all SharePoint server roles — including web front ends, application servers, and search servers — given that partial application can leave specific vulnerability classes unpatched?
2. Is any SharePoint web front end accessible from the internet without prior authentication, directly exposing CVE-2026-102866's unauthenticated signature bypass and CVE-2026-97783's unauthenticated XSS to external attackers?
3. Can SharePoint servers in your environment make outbound network connections to arbitrary adjacent-network or internet endpoints, enabling CVE-2026-105713's SSRF-based NTLMv2 hash capture by an attacker on an adjacent network?
4. Have you reviewed the SharePoint service account's database permissions in the underlying SQL Server — specifically confirming it does not hold sysadmin or db_owner roles that would amplify the impact of CVE-2026-70266's SQL injection escalation?
5. Is AMSI (Anti-Malware Scan Interface) integration enabled for SharePoint on your servers, which would provide detection coverage for deserialization and code injection exploitation attempts targeting CVE-2026-85900 and related RCE vectors?

Remediation recommendations

• Apply the October 2026 SharePoint cumulative update immediately to all SharePoint server roles — the two unauthenticated attack vectors (CVE-2026-102866 and CVE-2026-97783) mean any internet-accessible SharePoint deployment is under direct external threat.
• Disable outbound NTLM authentication from SharePoint servers or restrict outbound connections to approved endpoints only — this directly mitigates CVE-2026-105713's NTLMv2 hash capture pathway from adjacent-network positions.
• Enable AMSI integration for SharePoint if running on a supported build — this provides detection coverage for deserialization and code injection exploitation attempts targeting CVE-2026-85900 and related RCE vectors.
• Review and restrict SharePoint service account permissions in the underlying SQL Server — specifically eliminating sysadmin or db_owner roles that would amplify the impact of CVE-2026-70266's SQL injection escalation vector.
• Implement reverse proxy or WAF rules enforcing authentication before SharePoint HTTP requests reach web front-end servers, converting the unauthenticated attack surface into an authenticated-only exposure.

Black Kite's SharePoint - Oct2026 FocusTag® details critical insights on the event for TPRM professionals.

Nginx UI

What is this vulnerability?

Nginx UI is an open-source web-based management panel for NGINX, providing a graphical interface for configuration management, log monitoring, and backup and restore functionality for NGINX configurations and associated files. It is widely deployed by managed service providers, DevOps teams, and hosting providers as the preferred GUI alternative to direct NGINX configuration file editing, commonly exposed to administrators via a browser-accessible panel on the same host as the production NGINX instance.

Two CVEs in this advisory target Nginx UI's backup and restore pipeline through code injection. CVE-2026-42238 is the more severe: a CVSS 9.8 unauthenticated remote code execution vulnerability exploiting code injection (CWE-94) in the backup restore function. An attacker with no credentials to Nginx UI can trigger code execution on the underlying server by submitting a crafted restore payload — no session, no login, no prior access required. CVE-2026-107806 is an authenticated variant: scored CVSSv4 9.4 by the CNA (NVD scoring pending), it requires a valid Nginx UI session but allows the authenticated user to execute arbitrary code on the host through the same backup restore functionality. The presence of both unauthenticated and authenticated variants exploiting the same pipeline feature suggests a fundamental trust boundary failure in the backup/restore module rather than an isolated input handling flaw.

Why should TPRM professionals care?

Nginx UI's deployment profile makes it a high-value TPRM target. Management panels sitting atop production web servers are lateral movement multipliers: compromise of Nginx UI yields control not just of the NGINX process, but of the host system, the TLS certificates loaded into NGINX, the backends proxied by NGINX, and potentially the broader application infrastructure. In cloud-native and containerized environments, Nginx UI frequently runs with elevated host privileges to manage configuration files — amplifying code execution from the panel level to the underlying host.

CVE-2026-42238's unauthenticated attack vector is the highest-urgency concern: Nginx UI deployments exposed to the internet without prior authentication are directly exploitable without any credential material. CVE-2026-107806's EPSS of 0.33% and CVE-2026-42238's EPSS of 0.83% are both elevated for newly disclosed CVEs, reflecting pre-publication research activity and community interest in this attack surface. The backup/restore vector is particularly relevant for forensic triage: attackers may use the restore functionality to load modified NGINX configurations that route traffic through attacker-controlled proxies, positioning the compromised NGINX instance as a covert traffic interception point.

What questions should TPRM professionals ask vendors?

1. Is Nginx UI deployed in your environment, and if so, is the management panel accessible from the internet or restricted to specific IP allowlists or VPN-gated access only?
2. Have you upgraded Nginx UI to the patched version addressing CVE-2026-42238's unauthenticated RCE and CVE-2026-107806's authenticated RCE via backup restore?
3. Have you reviewed Nginx UI backup and restore logs for suspicious restore operations — specifically restores from unexpected file paths, at unusual times, or by unexpected accounts — that may indicate prior exploitation of these vulnerabilities?
4. What privilege level does the Nginx UI process run at on the underlying host, and does it have access to sensitive host resources — SSH keys, application credentials, container orchestration APIs — that a code execution exploit would reach?
5. Is multi-factor authentication or session management monitoring in place for Nginx UI administrative access, to limit exposure from CVE-2026-107806's authenticated code injection pathway?

Remediation recommendations

• Upgrade Nginx UI to the patched version immediately; CVE-2026-42238's unauthenticated RCE means any internet-accessible Nginx UI deployment is directly exploitable without credentials and must be treated as an emergency patch event.
• Restrict Nginx UI access to VPN-gated or IP-allowlisted connections; the management panel must never be directly accessible from the open internet regardless of patch status.
• Disable or restrict the backup/restore functionality in Nginx UI if it is not operationally required — both CVEs target this specific feature, and its disablement eliminates the primary attack surface for this advisory.
• Review NGINX configuration files across all Nginx UI-managed instances for unauthorized modifications — particularly changes to upstream proxy definitions, SSL certificate paths, or access control directives — which may indicate prior exploitation.

Black Kite's Nginx UI FocusTag® details critical insights on the event for TPRM professionals.

MariaDB - Oct2026

What is this vulnerability?

MariaDB's October 2026 advisory addresses nine CVEs across the MariaDB server and MariaDB Connector/C — the open-source MySQL-compatible database fork's first structured multi-CVE advisory batch of the year. MariaDB is the most widely deployed open-source MySQL-compatible database, present across Linux server environments, web hosting stacks, cloud-native deployments, and embedded database applications — particularly in organizations that migrated from MySQL following Oracle's acquisition of Sun Microsystems.

The most severe vulnerability is CVE-2026-107815 (CVSS 8.5, EPSS 0.58%): a stack out-of-bounds write in the CONNECT storage engine. The CONNECT engine enables MariaDB to read and write external data sources — flat files, ODBC connections, JSON feeds — and an authenticated MariaDB user with CONNECT engine access can trigger the stack overflow to achieve remote code execution on the database server host. CVE-2026-107818 (CVSS 8.4, EPSS 0.34%) targets the startup configuration chain: environment variable injection during MariaDB initialization allows an attacker with the ability to restart the MariaDB service to inject persistent configuration changes that survive standard remediation. CVE-2026-107819 (CVSS 5.9, EPSS 0.14%) affects MariaDB Connector/C — the client library used by applications to connect to MariaDB — introducing a TLS hostname validation bypass that enables man-in-the-middle attacks against applications relying on the connector for secure database connections. CVE-2026-107814 (CVSS 8.4, EPSS 0.28%) addresses incorrect file permissions in MariaDB RPM packages — affecting only RPM-based deployments.

Why should TPRM professionals care?

MariaDB's advisory requires TPRM teams to distinguish between database server vulnerabilities and connector-level vulnerabilities. CVE-2026-107819's TLS hostname validation bypass is in the MariaDB Connector/C client library — not the database server itself. This means the vulnerability is present in any application compiled with a vulnerable Connector/C version, potentially including applications whose database connection code has not been reviewed since the connector was integrated into the application build. Patching the MariaDB server does not remediate CVE-2026-107819; the application's Connector/C dependency must be updated separately.

CVE-2026-107815's CONNECT engine pathway is a significant concern for environments where MariaDB is deployed as a data aggregation layer — common in analytics, ETL pipelines, and data warehouse configurations. In these environments the CONNECT engine may be enabled system-wide, making any authenticated MariaDB user a potential attacker against the host. CVE-2026-107818's environment variable injection represents a sophisticated persistence threat model: it requires the ability to trigger a MariaDB service restart — achievable through other vulnerabilities or through social engineering of operations teams performing routine database maintenance — and the resulting persistence survives standard remediation that focuses only on database-level access.

What questions should TPRM professionals ask vendors?

1. Have you applied the October 2026 MariaDB security update to all MariaDB instances, and separately updated the MariaDB Connector/C library in any applications that use it — as CVE-2026-107819's TLS bypass requires a separate application-level update?
2. Is the CONNECT storage engine enabled in any MariaDB instance in your environment, and which database users have access to it — given CVE-2026-107815's stack overflow is exploitable by any authenticated user with CONNECT engine access?
3. Were any MariaDB deployments installed via RPM packages? CVE-2026-107814 specifically affects RPM installations with incorrect file permissions — Debian/Ubuntu installations are not affected.
4. Have you reviewed MariaDB service startup configurations for injected environment variables — specifically /etc/mysql/conf.d/, /etc/mariadb.conf.d/, and MariaDB systemd service override files — that may indicate prior exploitation of CVE-2026-107818?
5. Do any applications in your environment use MariaDB Connector/C for TLS-encrypted database connections, and have you confirmed the connector version compiled into those applications is updated to a version that validates TLS hostnames correctly?

Remediation recommendations

• Update MariaDB to the October 2026 patched release for all server instances, and separately update MariaDB Connector/C in any applications that compile it as a dependency — server patching alone does not address CVE-2026-107819's client-side TLS bypass.
• Audit CONNECT storage engine access and disable it on any MariaDB instance that does not require external data source connectivity — this eliminates CVE-2026-107815's attack surface for those deployments.
• Review MariaDB startup configurations and service unit files for injected environment variables — specifically checking for variables that modify MariaDB's data directory, plugin directory, or SSL configuration, which would indicate exploitation of CVE-2026-107818.
• For RPM-deployed MariaDB instances, verify and correct file permissions on MariaDB installation directories as described in CVE-2026-107814's advisory — Debian/Ubuntu deployments are not affected.

Black Kite's MariaDB - Oct2026 FocusTag® details critical insights on the event for TPRM professionals.

ProFTPD - Oct2026

What is this vulnerability?

ProFTPD is an open-source FTP server widely deployed in legacy enterprise file transfer environments, hosting control panels, and embedded appliances. Despite the widespread industry shift toward SFTP and HTTPS-based file transfer, ProFTPD remains broadly present in older deployments — particularly in manufacturing, healthcare, telecommunications, and government environments that have not completed migration to modern protocols.

CVE-2015-3306 is an eleven-year-old vulnerability in ProFTPD's mod_copy module. The mod_copy module enables FTP users to copy files between directories using two custom FTP commands: SITE CPFR (copy from) and SITE CPTO (copy to). CVE-2015-3306 exposes these commands to unauthenticated users — any visitor to an FTP server running ProFTPD with mod_copy enabled can issue these commands without credentials, allowing them to read any file the FTP server process can access and write files to any location the FTP server process can write. Attackers can read sensitive configuration files, SSH keys, and credential stores — and write web shells or malicious files into web-accessible directories, achieving remote code execution. The vulnerability carries a CVSS base score of 10.0 (CRITICAL) and an EPSS of 96.75% — near-certain exploitation probability. CISA added CVE-2015-3306 to the Known Exploited Vulnerabilities catalog on October 8, 2026, confirming active current exploitation.

Why should TPRM professionals care?

An eleven-year-old CVE with a 10.0 maximum CVSS score, 96.75% EPSS, and an active CISA KEV listing is the defining challenge of legacy technology risk management. CVE-2015-3306 was publicly disclosed in 2015, patches were available in 2015, and any organization running ProFTPD with mod_copy enabled in 2026 has failed to apply a decade-old patch on a system currently being actively exploited.

This scenario exposes two systemic TPRM gaps simultaneously. The first is legacy asset visibility: organizations frequently maintain FTP servers in infrastructure layers that fall outside the scope of primary vulnerability management programs — backup systems, legacy file transfer integrations, hosting control panels, and embedded device management interfaces. A vendor may sincerely believe their FTP infrastructure is patched without having a current inventory of every ProFTPD instance deployed.

The second gap is protocol-level risk: any organization still running FTP transmits credentials in cleartext — a pre-authentication risk compounded by the mod_copy vulnerability. The 96.75% EPSS score means attackers will find and exploit a vulnerable ProFTPD instance within days of identifying it in any scanning campaign. There is effectively no window between vendor exposure discovery and exploitation.

What questions should TPRM professionals ask vendors?

1. Is ProFTPD with the mod_copy module enabled deployed anywhere in your infrastructure — including backup systems, hosting control panels, legacy file transfer endpoints, or embedded device management interfaces — and if so, has it been patched to version 1.3.5a or later?
2. Given that CVE-2015-3306 has been added to CISA KEV as an actively exploited vulnerability, have you conducted a targeted search for ProFTPD instances in your environment, including systems that may not be in your current vulnerability management scope?
3. Are any ProFTPD deployments accessible from the internet — even on non-standard ports — making them directly discoverable and exploitable by automated scanning campaigns that leverage CVE-2015-3306's 96.75% EPSS exploitation probability?
4. Is the mod_copy module explicitly enabled or disabled in your ProFTPD configuration? An older default configuration may have mod_copy enabled without active administrative decision — have you confirmed the actual configuration state of all ProFTPD instances?
5. If ProFTPD is used for external file transfer with business partners or customers, have you assessed migration to SFTP or HTTPS-based file transfer as a complete elimination of the FTP attack surface?

Remediation recommendations

• Patch ProFTPD to version 1.3.5a or later — the release disabling anonymous SITE CPFR/SITE CPTO commands — as an emergency action; given the 96.75% EPSS and CISA KEV listing, any unpatched internet-accessible ProFTPD instance should be treated as actively compromised.
• Disable the mod_copy module entirely if SITE CPFR/CPTO functionality is not operationally required; its disablement completely eliminates CVE-2015-3306's attack surface regardless of patch status.
• Audit all ProFTPD-accessible file paths for evidence of unauthorized file reads or writes — specifically looking for web shells in web-accessible directories, modified configuration files, or unexplained new files in FTP-writable locations.
• Evaluate migration from FTP to SFTP or HTTPS-based file transfer; FTP's cleartext credential transmission combined with CVE-2015-3306 represents a complete file transfer security failure, and the patch alone does not address the underlying protocol risk.

Black Kite's ProFTPD - Oct2026 FocusTag® details critical insights on the event for TPRM professionals.

FocusTags® in the Last 30 Days

• Citrix NetScaler - Oct2026: CVE-2026-107406, CVE-2026-88771, CVE-2026-88772, CVE-2026-3055, CVE-2026-4368, Third October Advisory Expansion — New Memory Overflow (CVSSv4 9.5), SAML IdP Memory Overread, and Race-Condition Session Mixup Added to Existing KEV-Listed RCE Cluster.
• ONLYOFFICE Docs: CVE-2021-3199, CVSS 9.8, EPSS 8.22% — Path Traversal → Arbitrary File R/W → RCE in ONLYOFFICE Docs Server (CISA KEV Oct 9 2026, Actively Exploited by Flax Typhoon APT, Fixed: Version 6.1.0).
• MSSQL - Oct2026: CVE-2026-94512, CVE-2026-65674, and 20 additional CVEs — 22-CVE October Patch Tuesday Batch Including Heap Buffer Overflow RCE (CVSS 8.8), Deserialization RCE (CVSS 8.8), and Multiple Elevation of Privilege Pathways Across SQL Server 2019–2026.
• Exchange Server - Oct2026 (Latest): CVE-2026-70279, CVE-2026-70571, CVE-2026-77910, CVE-2026-87692, CVE-2026-87695, CVE-2026-87696 — Unauthenticated XSS/Spoofing (CVSS 9.3) and Unauthenticated Stack Buffer Overflow RCE (CVSS 8.1) in Microsoft Exchange Server (October 2026 Security Update).
• SharePoint - Oct2026: CVE-2026-85900, CVE-2026-88155, and 34 additional CVEs — Largest Single-Month SharePoint Disclosure Batch on Record: 7 RCE, 15 EoP, 5 Info Disclosure, 5 XSS/Spoofing, 3 SSRF, 1 Tampering — Including Unauthenticated Crypto Signature Bypass and NTLMv2 Hash Capture via SSRF (SharePoint SE / 2019 / 2016).
• NGINX UI: CVE-2026-107806, CVE-2026-42238 — Unauthenticated RCE (CVSS 9.8) and Authenticated RCE (CVSSv4 9.4) via Code Injection in NGINX UI Backup Restore Pipeline (Fixed: Patched Release).
• MariaDB - Oct2026: CVE-2026-107815, CVE-2026-107818, CVE-2026-107814, and 6 additional CVEs — Stack OOB Write in CONNECT Engine (CVSS 8.5), Environment Variable Injection for Persistence (CVSS 8.4), and TLS Hostname Validation Bypass in Connector/C (Fixed: October 2026 Release).
• ProFTPD - Oct2026: CVE-2015-3306, CVSS 10.0, EPSS 96.75% — Unauthenticated Arbitrary File R/W via mod_copy SITE CPFR/CPTO Commands Enabling RCE (CISA KEV Oct 8 2026, Active Exploitation, Fixed: ProFTPD 1.3.5a).
• Citrix Pitscaler 2: CVE-2025-6543, CVE-2026-88771, CVE-2026-88772, CVE-2026-88779, CVE-2026-88778, Updated Advisory Requiring Build 14.1-73.41 / 13.1-64.28 — Vendors Patched to 14.1-73.37 per Sep2026 Advisory Remain Exposed to Memory Overflow in Gateway Mode and Must Patch Again.
• SonicWall SMA1000 - Oct2026: CVE-2026-102255, CVE-2026-102256, CVE-2026-102257, CVE-2026-102258, CVE-2026-83548, CVE-2026-83549, Oct2026 Advisory Expands CISA KEV-Listed Pre-Auth SSRF/RCE Chain with Four New CVEs Including Zip Slip and Stored XSS in AMC.
• Exchange Server - Oct2026: CVE-2026-96940, Weak Authorization in Microsoft Exchange Server Enabling Authenticated Network Privilege Escalation (Patched: October 2026 Security Update).
• Cisco NX-OS - Oct2026: CVE-2026-76471 and 6 additional CVEs, Unauthenticated RCE with Root Privileges via NX-API Feature and Proactively Identified High-Severity Flaws in Cisco NX-OS Data Center Switching Platform.
• Atlassian - Oct2026: CVE-2026-21589, Critical Cross-Product Vulnerability Simultaneously Affecting All Atlassian Data Center Products — Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye.
• Langflow - Oct2026: CVE-2026-104334, CVE-2026-93674, and 19 additional CVEs, Fifth Advisory Cycle — 21-CVE IBM Batch Disclosure Including 4 Unauthenticated RCEs and 17 Authenticated RCE / Info Disclosure Vulnerabilities in Langflow OSS 1.0.0–1.12.2 (Fixed: 1.12.3).
• Elastic - Oct2026: CVE-2026-102406, CVE-2026-103007, CVE-2026-103009, and 5 additional CVEs, Kibana Cross-Tenant Authorization Bypass, Elasticsearch Privilege Escalation, Cross-Cluster Information Disclosure, and Denial of Service.
• Kiteworks: No CVE, Precautionary Shutdown Advisory Driven by Federal Intelligence Warning of Imminent Cyberattack, Advanced Forms Vulnerability Identified (Fixed: Kiteworks 9.5.1, Mandiant Engaged, Fewer Than 1% of Customers Affected).
• Citrix NetScaler - Sep2026 (Latest): CVE-2026-88771, CVE-2026-88772, and 6 additional CVEs, Two Confirmed Zero-Day Unauthenticated RCEs in All Default NetScaler Deployments and HTTP Smuggling (CISA KEV Sep 27 2026, Federal Deadline Sep 30, Fixed: 14.1-73.37, 13.1-64.23).
• MikroTik RouterOS - Sep2026: CVE-2026-84411, CVE-2026-86060, CVE-2026-67276, Integer Underflow Enabling Unauthenticated RCE or DoS, SSH Username Argument Flaw, and SSH Key Comparison Bypass (CISA ICS Advisory ICSA-26-272-06, Fixed: RouterOS 7.24).
• OpenSSL - Sep2026: CVE-2026-84782, CVE-2026-84783, CVE-2026-72897, CVE-2026-84784, Out-of-Bounds Read in DTLS, Use-After-Free in X.509 Certificate Caching, OOB Write in SSL_CTX Switching, and QUIC Resource Exhaustion (~1.8M Exposed Instances, Fixed: 3.0.16–3.4.1, 4.0.1).
• WordPress Core - Sep2026: CVE-2026-87902, Pre-Authentication Path Traversal → LFI → Unauthenticated RCE via PEAR pearcmd.php, Present Since WordPress 4.7.0 (CISA KEV Sep 25 2026, Public PoC, Fixed: 7.1.2 / backports to 4.7.37).
• ScreenConnect - Sep2026: CVE-2026-84869, Missing Authorization in ScreenConnect Client File-Transfer Enabling Worm-Like Malware Propagation to Every Connected Host Session (CISA KEV, Actively Exploited).
• Exim Mail - Sep2026: CVE-2026-94054, CVE-2026-94056, Out-of-Bounds Write and Uninitialized Resource in Exim PROXY Protocol v1 and v2 Handling (Fixed: Exim 4.100.1).
• Citrix NetScaler - Sep2026: CVE-2026-19490, CVE-2026-19489, Authentication Bypass via Unsigned SAML Assertion and Memory Overflow via SIP ALG (CISA KEV, Actively Exploited, Public PoC).
• Apache Tomcat - Sep2026: CVE-2026-76183, CVE-2026-86248, CVE-2026-86350, and 5 additional CVEs, WebSocket Security Constraint Bypass, CLIENT_CERT Auth Failure, and HTTP Request Smuggling (Fixed: 9.0.122, 10.1.60, 11.0.26).
• Langflow - Sep2026: CVE-2026-12944, CVE-2026-7524, CVE-2026-0770, CVE-2026-9198, Fourth Critical Vulnerability — SSRF via Incomplete DANGEROUS_IMPORTS Blocklist with False 'Validated: True' Signal (Fixed: 1.10.1).
• N-central - Sep2026: CVE-2026-86218, CVE-2026-86206, CVE-2026-86207, CVE-2026-18556, CVE-2026-18577, Pre-Authenticated CVSS 10.0 RCE Zero-Day and Dual Auth Bypass in N-able N-central (CISA KEV, Actively Exploited, Hotfix 4 Required).
• Adobe Commerce & Magento: CVE-2026-75650, CVE-2026-7565, Unauthenticated Template Injection RCE in Adobe Commerce and Magento (CISA KEV, Actively Exploited, Composer Hotfix Required).
• MikroTrick: CVE-2026-67276, CVE-2026-86060, CVE-2026-67277, CVE-2026-67281, CVE-2026-67279, CVE-2026-67278, Six-Vulnerability Set Enabling Unauthenticated RouterOS Takeover (Active Exploitation Confirmed).
• Fortinet - Sep2026 [Suspected]: CVE-2026-84393, CVE-2026-84391, CVE-2026-22575, Improper Certificate Validation and Authenticated DoS in FortiOS, FortiProxy, FortiAnalyzer, and FortiManager.
• MSSQL - Sep2026: CVE-2026-47297, CVE-2026-65669, and 59 additional CVEs, Largest Single-Month SQL Server Disclosure Batch with Unauthenticated RCE.

References

https://www.cve.org/CVERecord?id=CVE-2021-3199

https://www.cisa.gov/known-exploited-vulnerabilities-catalog

https://helpcenter.onlyoffice.com/installation/docs-changelog.aspx

https://support.citrix.com/support-home/kbsearch

https://www.cve.org/CVERecord?id=CVE-2026-107406

https://www.cve.org/CVERecord?id=CVE-2026-88771

https://www.cve.org/CVERecord?id=CVE-2026-88772

https://www.cve.org/CVERecord?id=CVE-2026-3055

https://www.cve.org/CVERecord?id=CVE-2026-4368

https://msrc.microsoft.com/update-guide/

https://www.cve.org/CVERecord?id=CVE-2026-94512

https://www.cve.org/CVERecord?id=CVE-2026-65674

https://www.cve.org/CVERecord?id=CVE-2026-88086

https://www.cve.org/CVERecord?id=CVE-2026-70279

https://www.cve.org/CVERecord?id=CVE-2026-70571

https://www.cve.org/CVERecord?id=CVE-2026-77910

https://www.cve.org/CVERecord?id=CVE-2026-87692

https://www.cve.org/CVERecord?id=CVE-2026-87695

https://www.cve.org/CVERecord?id=CVE-2026-87696

https://www.cve.org/CVERecord?id=CVE-2026-85900

https://www.cve.org/CVERecord?id=CVE-2026-102866

https://www.cve.org/CVERecord?id=CVE-2026-97783

https://www.cve.org/CVERecord?id=CVE-2026-105713

https://www.cve.org/CVERecord?id=CVE-2026-70266

https://www.cve.org/CVERecord?id=CVE-2026-107806

https://www.cve.org/CVERecord?id=CVE-2026-42238

https://github.com/0xJacky/nginx-ui

https://mariadb.com/kb/en/security/

https://www.cve.org/CVERecord?id=CVE-2026-107815

https://www.cve.org/CVERecord?id=CVE-2026-107818

https://www.cve.org/CVERecord?id=CVE-2026-107814

https://www.cve.org/CVERecord?id=CVE-2026-107819

https://www.cve.org/CVERecord?id=CVE-2015-3306

http://www.proftpd.org/docs/RELEASE_NOTES-1.3.5a