Skip to content
feed: live
0dayNews
Briefing · 2026-10-23

Oct 23: Arista Zero-Day, Cisco 34 CVEs, Quest Breach

Arista VeloCloud CVE-2026-114625 CVSS 9.9 zero-day under active exploitation, CISA deadline October 26. Cisco 34-CVE advisory, six critical. Quest Diagnostics patient data breach.

tldr.txt
  • Arista VeloCloud CVE-2026-114625: CVSS 9.9 SQL injection zero-day under confirmed active exploitation. Patches are out. Hosted instances already fixed. CISA KEV-listed with a federal remediation deadline of October 26.
  • Cisco October advisory: 34 CVEs, six critical. Expressway Series, Unified Communications, and Snort 3 affected. No exploitation confirmed.
  • Atlassian October bulletin: 75 vulnerabilities, 14 critical, all in third-party components across Jira, Confluence, and Bitbucket.
  • Quest Diagnostics breach: unauthorized access to the Quanum Lab Services Manager. Patient records among the data exposed.
  • Linux KSMBD: Trend Micro ZDI disclosed two CVSS 9.0 RCEs before kernel patches exist. More severe flaw requires no authentication.

Arista VeloCloud CVE-2026-114625 is the most pressing item today. CVSS 9.9 SQL injection zero-day, confirmed exploited in the wild, CISA KEV-listed. Federal remediation deadline: October 26. Hosted VeloCloud instances are already patched by Arista. On-prem Orchestrator deployments are exposed until you apply the patch.

Cisco October advisory

34 CVEs, six critical. Products: Expressway Series, Unified Communications Manager, and Snort 3. No exploitation confirmed as of October 23. Treat accordingly: Cisco IOS XE has a recent history of rapid weaponization.

Atlassian October bulletin

75 vulnerabilities, 14 critical. All critical-rated flaws are in third-party components shipped with Atlassian Data Center and Server products. Jira, Confluence, and Bitbucket all covered. Atlassian’s advisory has the version-specific patch matrix.

Quest Diagnostics breach

Quest Diagnostics filed a regulatory disclosure confirming unauthorized access to its Quanum Lab Services Manager. Patient records are among the data exposed. Scope and notification timeline: see the linked coverage.

Linux KSMBD: two unpatched RCEs

Trend Micro ZDI disclosed two CVSS 9.0 RCEs in Linux’s KSMBD SMB server before kernel patches are available. The more severe flaw requires no authentication. Wild exploitation: unconfirmed. Mitigation: disable KSMBD if it is not in use.

Sources