Week 41 · 2 Oct – 9 Oct 2026 · 45 items reviewed

All seven exploited items this week are already in CISA KEV

Forty-five items were reviewed this week, seven of them with published exploitation, and all seven are listed in CISA KEV. None of the exploited items touch Microsoft 365; seven other items do, with no exploitation published for them. Five of the exploited items lead the page: ProFTPD, Zammad, ONLYOFFICE Docs, Apache Struts and Citrix NetScaler.

Every item this week in ranking order: exploited, touches Microsoft 365, everything else; a ring marks CISA KEV.

Start here

The 5 the ranking puts first. Exploitation evidence outranks a higher score without it; a Microsoft 365 match outranks everything else.

  1. ProFTPD Improper Access Control Vulnerability

    Remote attackers can read and write arbitrary files through the site cpfr and site cpto commands, so authentication holds but the check on what that identity may do does not, and data belonging to other users and to the administrator is in reach.

    Upgrade proftpd-dfsg to the fixed version for your Debian release, 1.3.4a-5+deb7u3 on wheezy, 1.3.5-1.1+deb8u1 on jessie and 1.3.5-2 on stretch or sid, or move upstream ProFTPD to maintenance release 1.3.9d, then sample real access records for cross-boundary reads.

    In CISA KEVOfficial advisorycisa.govscore 10.0 Authorization bypass · full reading and source

    In the CISA KEV catalogue, so exploitation is not hypothetical. US federal agencies get a binding deadline for these; everyone else gets a strong hint.

    Mitigation

    Patch available

    Fixed in:

    1. Upgrade your proftpd-dfsg packages to the fixed version for your Debian release. lists.debian.org
    2. On Debian 7 (wheezy) install proftpd-dfsg 1.3.4a-5+deb7u3. lists.debian.org
    3. On Debian 8 (jessie) install proftpd-dfsg 1.3.5-1.1+deb8u1. lists.debian.org
    4. On Debian testing (stretch) or unstable (sid) install proftpd-dfsg 1.3.5-2. lists.debian.org
    5. If you run upstream ProFTPD instead of distribution packages, update to the current maintenance release 1.3.9d. www.proftpd.org

    Steps extracted by AI from the linked pages; each links to the page that says so. Confirm there before acting.

    From CISA KEV:

    This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: www.proftpd.org

    Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

    US federal remediation deadline: 11 October 2026.

    Where we looked (4)

    General notes on authorization bypass, the same for every item of this class:

    What this class puts at risk

    Authentication worked; the check on what that identity may do did not. Ordinary users reach data and actions belonging to other tenants, other teams, or the administrator.

    General practice

    Patch, then sample real access records for cross-boundary reads. This class is usually discovered by a customer, not by monitoring.

    Publisher text. ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.

    Read the original at cisa.gov CVE record

    Exposure and response are Digest interpretation of the vulnerability class, not claims made by the publisher. Confirm against the source before acting.

  2. Zammad GmbH Zammad Improper Privilege Management Vulnerability

    The local zammad user can escalate to root, and the publisher says this can be chained with CVE-2026-102489, so a foothold in the ticketing service turns into control of the host.

    Upgrade to Zammad 7.2.0, upgrade immediately if you still run 6.5 or older because those versions get no security fixes, and treat the issue as unpatched for now while you watch Zammad's GitHub security advisories for a verified fix.

    In CISA KEVOfficial advisorycisa.govscore 9.8 Detail and source

    In the CISA KEV catalogue, so exploitation is not hypothetical. US federal agencies get a binding deadline for these; everyone else gets a strong hint.

    Mitigation

    No fix published yet

    1. Upgrade to Zammad 7.2.0, the current stable release. community.zammad.org
    2. If you still run Zammad 6.5 or older, upgrade immediately since those versions get no security fixes. community.zammad.org
    3. Treat this issue as unpatched for now, because the vendor cannot yet confirm its scope or affected versions. community.zammad.org
    4. Watch Zammad's GitHub security advisories for a verified fix for this CVE. community.zammad.org

    Steps extracted by AI from the linked pages; each links to the page that says so. Confirm there before acting.

    From CISA KEV:

    Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

    US federal remediation deadline: 5 October 2026.

    Where we looked (6)

    Publisher text. Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.

    Read the original at cisa.gov CVE record

    Exposure and response are Digest interpretation of the vulnerability class, not claims made by the publisher. Confirm against the source before acting.

  3. ONLYOFFICE Docs Server Path Traversal Vulnerability

    A /.. sequence in an image upload parameter reaches files outside the intended directory when JWT is used, and the publisher says it could allow remote code execution, so configuration files and private keys are the realistic target.

    Patch, rotate every secret stored in a file that process could open, and check whether the same open-source component or library is bundled in other products you run.

    In CISA KEVOfficial advisorycisa.govscore 9.8 Path traversal · full reading and source

    In the CISA KEV catalogue, so exploitation is not hypothetical. US federal agencies get a binding deadline for these; everyone else gets a strong hint.

    Mitigation

    No fix found in the pages we could read

    From CISA KEV:

    This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see:

    Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

    US federal remediation deadline: 11 October 2026.

    Where we looked (4)

    General notes on path traversal, the same for every item of this class:

    What this class puts at risk

    Arbitrary file read outside the intended directory, sometimes write. Nobody traverses a directory to fetch your logo; they go for configuration files and private keys.

    General practice

    Patch, then rotate every secret stored in a file that process could open.

    Publisher text. ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.

    Read the original at cisa.gov CVE record

    Exposure and response are Digest interpretation of the vulnerability class, not claims made by the publisher. Confirm against the source before acting.

  4. Apache Struts Command Injection Vulnerability

    Anyone who can reach the application can execute arbitrary code as the service account via method:prefix when Dynamic Method Invocation is enabled, and what matters is what that account was quietly allowed to reach.

    Upgrade Struts 2 to 2.3.20.3, 2.3.24.3 or 2.3.28.1 after checking whether your version falls in the affected 2.3.20 to 2.3.28 range, disable Dynamic Method Invocation if you cannot upgrade right away, and rotate what the service held.

    In CISA KEVOfficial advisorycisa.govscore 8.1 Command injection · full reading and source

    In the CISA KEV catalogue, so exploitation is not hypothetical. US federal agencies get a binding deadline for these; everyone else gets a strong hint.

    Mitigation

    Patch available

    Fixed in:

    1. Upgrade Apache Struts 2 to version 2.3.20.3, 2.3.24.3, or 2.3.28.1. cwiki.apache.org
    2. If you cannot upgrade right away, disable Dynamic Method Invocation. cwiki.apache.org
    3. Check whether your Struts version falls in the affected range 2.3.20 through 2.3.28. cwiki.apache.org
    4. As another workaround, implement your own ActionMapper based on the fixed Struts source code. cwiki.apache.org
    5. Expect no compatibility problems when moving to the fixed releases. cwiki.apache.org

    Steps extracted by AI from the linked pages; each links to the page that says so. Confirm there before acting.

    From CISA KEV:

    This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: cwiki.apache.org

    Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

    US federal remediation deadline: 11 October 2026.

    Where we looked (9)

    General notes on command injection, the same for every item of this class:

    What this class puts at risk

    Whoever reaches the service gets a shell as the service account. The vulnerability is rarely the interesting part — what that account was quietly allowed to reach is.

    General practice

    Patch, then rotate what the service held. Treat those credentials as spent, not merely exposed.

    Publisher text. Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.

    Read the original at cisa.gov CVE record

    Exposure and response are Digest interpretation of the vulnerability class, not claims made by the publisher. Confirm against the source before acting.

  5. Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

    A memory buffer flaw in NetScaler ADC and NetScaler Gateway can be used for denial of service, which puts availability of remote access at risk rather than confidentiality or integrity.

    Patch on the normal cycle, unless the service is customer-facing and already running close to its limits.

    In CISA KEVOfficial advisory2 publisherscisa.govscore 7.5 Denial of service · full reading and source

    In the CISA KEV catalogue, so exploitation is not hypothetical. US federal agencies get a binding deadline for these; everyone else gets a strong hint.

    Mitigation

    From CISA KEV:

    Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

    US federal remediation deadline: 7 October 2026.

    Where we looked (3)

    General notes on denial of service, the same for every item of this class:

    What this class puts at risk

    Availability only, with no confidentiality or integrity implication. Worth saying out loud when it is competing for the same change window as something that leaks data.

    General practice

    Patch on the normal cycle, unless the service is customer-facing and already running close to its limits.

    Publisher text. Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.

    Read the original at cisa.gov CVE record

    Exposure and response are Digest interpretation of the vulnerability class, not claims made by the publisher. Confirm against the source before acting.

The pattern

Remote code execution is the week's most common class, at four of the thirteen classified items. The repetition is the useful part. When one class keeps coming back it is usually worth checking whether your own estate has the same shape of exposure, rather than only chasing the named products. Two of the exploited items fit that shape: the Apache Struts command injection, and the ONLYOFFICE Docs path traversal that the publisher says could allow remote code execution.

  • 1 of 7 exploited items are access-control failures. Authentication, authorization, or credential handling — not memory safety. These reward an attacker with no skill and no exploit development, which is why they get used quickly.
  • 8 CVEs here are reported by a single publisher. Single-source does not mean wrong, it means unconfirmed. Corroboration on this page requires two independent publisher domains naming the same CVE, and most items do not have it yet.

Worth a read

Pieces from the week that are not advisories: managed Microsoft 365 posture, agentic coding, and the occasional essay.

Everything else this week

Triage order, not severity order. Opening an item shows what its class puts at risk, what to do, the publisher text, and the link.

Exploited elsewhere

2
7.5CVE-2015-5477 cisa.gov 2026-10-08 ISC BIND Data Processing Errors Vulnerability ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. In CISA KEVOfficial advisory Denial of service · exposure, response and source

In the CISA KEV catalogue, so exploitation is not hypothetical. US federal agencies get a binding deadline for these; everyone else gets a strong hint.

Mitigation

Patch available

Fixed in:

  1. Upgrade BIND 9 to 9.9.7-P2 or 9.10.2-P3, whichever matches your current branch. web.archive.org
  2. Do this immediately, as exploit code is already public. web.archive.org
  3. On Red Hat Enterprise Linux 6 and 7, install the updated bind packages from RHSA-2015:1513. access.redhat.com
  4. Patch every BIND server you run, both recursive resolvers and authoritative servers. web.archive.org
  5. Do not rely on ACLs or query-restricting configuration instead of patching, and expect no workaround. web.archive.org

Steps extracted by AI from the linked pages; each links to the page that says so. Confirm there before acting.

From CISA KEV:

This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: web.archive.org

Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

US federal remediation deadline: 11 October 2026.

Where we looked (5)

General notes on denial of service, the same for every item of this class:

What this class puts at risk

Availability only, with no confidentiality or integrity implication. Worth saying out loud when it is competing for the same change window as something that leaks data.

General practice

Patch on the normal cycle, unless the service is customer-facing and already running close to its limits.

Publisher text. ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.

Read the original at cisa.gov CVE record

Exposure and response are Digest interpretation of the vulnerability class, not claims made by the publisher. Confirm against the source before acting.

7.0CVE-2023-22894 cisa.gov 2026-10-08 Strapi Cleartext Storage of Sensitive Information Vulnerability Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution. Users are advised to discontinue use… In CISA KEVOfficial advisory Remote code execution · exposure, response and source

In the CISA KEV catalogue, so exploitation is not hypothetical. US federal agencies get a binding deadline for these; everyone else gets a strong hint.

Mitigation

Patch available

Fixed in:

  1. Upgrade Strapi to v4.8.0 or later. strapi.io
  2. Treat any Strapi install at 4.7.1 or below as vulnerable and schedule the upgrade immediately. www.ghostccamm.com
  3. If you still run Strapi 3.x.x or older, move to a patched 4.x.x release because 3.x gets no security updates. strapi.io
  4. Check your logs against the published indicators for leaked private user data. www.ghostccamm.com
  5. Also verify no admin accounts were hijacked, since this flaw can be chained with CVE-2023-22621 for unauthenticated RCE on versions 4.5.5 and below. www.ghostccamm.com

Steps extracted by AI from the linked pages; each links to the page that says so. Confirm there before acting.

From CISA KEV:

This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: strapi.io

Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

US federal remediation deadline: 11 October 2026.

Where we looked (4)

General notes on remote code execution, the same for every item of this class:

What this class puts at risk

Execution on the affected system. Everything that host can reach, mount, or authenticate to is in scope, which is reliably more than the asset register claims.

General practice

Patch now, then examine the host rather than assuming the patch closed an incident that may already have happened.

Publisher text. Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution. Users are advised to discontinue use and/or transition to a supported version.

Read the original at cisa.gov CVE record

Exposure and response are Digest interpretation of the vulnerability class, not claims made by the publisher. Confirm against the source before acting.

Touches Microsoft 365, no exploitation published

7
10.0CVE-2026-96940 msrc.microsoft.com 2026-10-02 CVE-2026-96940 Microsoft Exchange Server Elevation of Privilege Vulnerability Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network. ExchangeOfficial advisory2 publishers Privilege escalation · exposure, response and source

Applicable to Exchange. Nobody has published exploitation yet, so this belongs in the next planned change window rather than tonight.

Mitigation

Patch available

From Microsoft's update guide (msrc.microsoft.com). Microsoft marks customer action as required.

  • KB5129955, fixed build 15.02.2562.053 · Microsoft Exchange Server Subscription Edition RTM
  • KB5129958, fixed build 15.01.2507.075 · Microsoft Exchange Server 2016 Cumulative Update 23
  • KB5129956, fixed build 15.02.1748.053 · Microsoft Exchange Server 2019 Cumulative Update 15
  • KB5129957, fixed build 15.02.1544.048 · Microsoft Exchange Server 2019 Cumulative Update 14

General notes on privilege escalation, the same for every item of this class:

What this class puts at risk

The step between a compromised low-value account and administrative reach. Alone it reads as minor; chained behind any foothold it is the entire incident.

General practice

Patch, then review privileged role assignments and sign-ins for the window before the fix landed. Escalation leaves grants behind it.

Publisher text. Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network.

Read the original at msrc.microsoft.com CVE record

Exposure and response are Digest interpretation of the vulnerability class, not claims made by the publisher. Confirm against the source before acting.

10.0CVE-2026-96940 thehackernews.com 2026-10-05 Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes Microsoft has released out-of-band security updates to address a high-severity flaw in Microsoft Exchange Server that could allow an attacker to escalate privileges under certain conditions The vulnerability, tracked as CVE-2026-96940, is rated 8.8 on the CVSS scoring system. ExchangeEstablished reporting2 publishers Detail and source

Applicable to Exchange. Nobody has published exploitation yet, so this belongs in the next planned change window rather than tonight.

Mitigation

Patch available

From Microsoft's update guide (msrc.microsoft.com). Microsoft marks customer action as required.

  • KB5129955, fixed build 15.02.2562.053 · Microsoft Exchange Server Subscription Edition RTM
  • KB5129958, fixed build 15.01.2507.075 · Microsoft Exchange Server 2016 Cumulative Update 23
  • KB5129956, fixed build 15.02.1748.053 · Microsoft Exchange Server 2019 Cumulative Update 15
  • KB5129957, fixed build 15.02.1544.048 · Microsoft Exchange Server 2019 Cumulative Update 14

Publisher text. Microsoft has released out-of-band security updates to address a high-severity flaw in Microsoft Exchange Server that could allow an attacker to escalate privileges under certain conditions The vulnerability, tracked as CVE-2026-96940, is rated 8.8 on the CVSS scoring system.

Read the original at thehackernews.com CVE record

Exposure and response are Digest interpretation of the vulnerability class, not claims made by the publisher. Confirm against the source before acting.

3.8 crowdstrike.com 2026-10-05 Falcon Data Security for SaaS Secures Sensitive Data in Microsoft 365 Entra IDDefenderIntuneExchangeTeams / SharePointVendor research Detail and source

Applicable to Entra ID, Defender, Intune, Exchange, Teams / SharePoint. Nobody has published exploitation yet, so this belongs in the next planned change window rather than tonight.

Mitigation

The source published no mitigation steps with this item, and none were found in the pages we could read (no advisory links were listed for it). Check the linked advisory for fixed versions and workarounds before acting.

Read the original at crowdstrike.com

Exposure and response are Digest interpretation of the vulnerability class, not claims made by the publisher. Confirm against the source before acting.

3.8 darkreading.com 2026-10-06 'BigDiskBuster' Leaves Microsoft Defender Running While Blocking Updates Not quite an EDR-killer, but the proof-of-concept cyber technique creates a silent virus detection gap while service runs normally, no exploit required. DefenderEstablished reporting Detail and source

Applicable to Defender. Nobody has published exploitation yet, so this belongs in the next planned change window rather than tonight.

Mitigation

The source published no mitigation steps with this item, and none were found in the pages we could read (no advisory links were listed for it). Check the linked advisory for fixed versions and workarounds before acting.

Publisher text. Not quite an EDR-killer, but the proof-of-concept cyber technique creates a silent virus detection gap while service runs normally, no exploit required.

Read the original at darkreading.com

Exposure and response are Digest interpretation of the vulnerability class, not claims made by the publisher. Confirm against the source before acting.

3.8 thehackernews.com 2026-10-08 U.S. Offers Up to $10 Million for Tips on Zhang Yu, Charged in HAFNIUM Hacks The U.S. State Department is offering up to $10 million for information leading to the identification or location of Zhang Yu, a Chinese national charged in the United States in connection with the 2021 Microsoft Exchange Server attacks known as HAFNIUM. The reward is for information leading to his identification… ExchangeEstablished reporting Detail and source

Applicable to Exchange. Nobody has published exploitation yet, so this belongs in the next planned change window rather than tonight.

Mitigation

The source published no mitigation steps with this item, and none were found in the pages we could read (no advisory links were listed for it). Check the linked advisory for fixed versions and workarounds before acting.

Publisher text. The U.S. State Department is offering up to $10 million for information leading to the identification or location of Zhang Yu, a Chinese national charged in the United States in connection with the 2021 Microsoft Exchange Server attacks known as HAFNIUM. The reward is for information leading to his identification or location, the news outlet NTD reported this week, citing a notice

Read the original at thehackernews.com

Exposure and response are Digest interpretation of the vulnerability class, not claims made by the publisher. Confirm against the source before acting.

3.0 bleepingcomputer.com 2026-10-08 Microsoft Teams to get support for third-party deepfake detection tools Microsoft will soon introduce support for third-party deepfake detection solutions and impersonation protection in Teams meetings. [...] Teams / SharePointEstablished reporting Detail and source

Applicable to Teams / SharePoint. Nobody has published exploitation yet, so this belongs in the next planned change window rather than tonight.

Mitigation

The source published no mitigation steps with this item, and none were found in the pages we could read (no advisory links were listed for it). Check the linked advisory for fixed versions and workarounds before acting.

Publisher text. Microsoft will soon introduce support for third-party deepfake detection solutions and impersonation protection in Teams meetings. [...]

Read the original at bleepingcomputer.com

Exposure and response are Digest interpretation of the vulnerability class, not claims made by the publisher. Confirm against the source before acting.

3.0 therecord.media 2026-10-08 Lawmakers warn Google could expose Spirit Airlines data in $10 million AI training deal The proposed sale would include about 100 million emails, 500 million Microsoft Teams messages, employment contracts, employee and timecard records and payroll and tax information, Rep. Steven Horsford (D-NV) said in a press release. Teams / SharePointEstablished reporting Detail and source

Applicable to Teams / SharePoint. Nobody has published exploitation yet, so this belongs in the next planned change window rather than tonight.

Mitigation

The source published no mitigation steps with this item, and none were found in the pages we could read (no advisory links were listed for it). Check the linked advisory for fixed versions and workarounds before acting.

Publisher text. The proposed sale would include about 100 million emails, 500 million Microsoft Teams messages, employment contracts, employee and timecard records and payroll and tax information, Rep. Steven Horsford (D-NV) said in a press release.

Read the original at therecord.media

Exposure and response are Digest interpretation of the vulnerability class, not claims made by the publisher. Confirm against the source before acting.

Also reviewed this week

31