ALERT · Actively exploited. Last updated 28 October 2026. See the Alert Tracker
Three patch priorities: an Apple CoreGraphics flaw on CISA’s KEV list since 29 September, an MLflow tracking-server RCE fixed in 3.17.0, and eight CVSS 10.0 flaws in HPE Aruba AOS.
Apple CVE-2026-86950. CISA KEV (opens in a new tab) lists an out-of-bounds write in CoreGraphics (added 29 September 2026, due 13 October; ransomware Unknown). The federal deadline has passed, so anything still unpatched is overdue. Apple’s iOS and iPadOS 18.7.11 security content (opens in a new tab) covers the CVE under CoreGraphics (credited Meta Product Security). FIRST EPSS on 27 October: about 0.262 (98th percentile). Status: Actively exploited. Patch to iOS/iPadOS 18.7.11 or iOS/iPadOS 26.7.1.
MLflow CVE-2026-116692. GHSA-26p8-2jq9-3vq9 (opens in a new tab) / NVD (opens in a new tab): Critical CVSS 3.1 9.8 RCE via third-party scorer deserialisation on /ajax-api/3.0/mlflow/scorer/invoke. Affects MLflow >=3.12.0rc0 and <3.17.0; fixed in 3.17.0. Not in KEV; no exploitation claimed in the sources we checked. Status: Patch available. Experimental detection: Hunt Lab PR #5 (opens in a new tab).
HPE Aruba AOS (HPESBNW05162). HPE’s CSAF advisory (opens in a new tab) (22 October) covers 72 vulnerabilities; eight of them, CVE-2026-79844 through CVE-2026-79851, are CVSS 3.1 10.0. Fixed builds include AOS-8.10.0.24, 8.13.3.1, 10.4.1.14, 10.7.2.7 and 10.8.1.2. HPE says it is not aware of public exploit code at advisory release. Not in KEV. Status: Patch available.
Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)