• InterSystems Corporation InterSystems IRIS For Health
  "Successful exploitation of this vulnerability could allow an attacker to view transmitted data and use that data to log into the device."
  https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01

Industrial Sector

• Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP
  "Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.7 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-11
• Siemens SIMATIC S7-1500 TM MFP
  "Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1. Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-16
• Siemens RUGGEDCOM CROSSBOW Station Access Controller
  "RUGGEDCOM CROSSBOW Station Access Controller (SAC) contains multiple vulnerabilities in the integrated SQLite component that could allow an attacker to execute arbitrary code, cause a denial of service, or obtain sensitive information. Siemens has released a new version for RUGGEDCOM CROSSBOW Station Access Controller (SAC) and recommends to update to the latest version."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-15
• Siemens SIMATIC S7 PLCs Web Server
  "SIMATIC S7-1500 devices contain multiple vulnerabilities in the web server that could allow an attacker to execute malicious code in an authorized user’s browser session and perform PLC operations within the scope of that user’s authorization. Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-14
• Kiloview E3 NDI Encoder
  "Successful exploitation of this these vulnerabilities could allow an attacker to fully compromise the device."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01
• Siemens Industrial Edge Devices
  "Siemens Industrial Edge Devices contain multiple path traversal vulnerabilities that could facilitate an authenticated remote attacker to access sensitive internal information. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends specific mitigations for products where fixes are not or not yet available."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-17
• Siemens WinCC
  "Multiple SIMATIC WinCC versions are affected by a database privilege escalation vulnerability that could allow an authenticated user with access to the database to execute commands on the underlying host system. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends mitigations for products where fixes are not or not yet available."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-13
• Siemens RUGGEDCOM CROSSBOW
  "RUGGEDCOM CROSSBOW contains multiple vulnerabilities that could allow an attacker to execute arbitrary SQL commands on the underlying database, retrieve sensitive administrative credentials, escalate privileges, and perform unauthorized operations such as modifying system configurations or causing a denial of service. Siemens has released a new version for RUGGEDCOM CROSSBOW and recommends to update to the latest version."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-12
• Siemens Industrial Edge Device Kit
  "Users of Industrial Edge Devices are advised to consult the respective Security Advisories for their devices (for Siemens Industrial Edge devices see Additional Information). Industrial Edge Device Kit contains multiple path traversal vulnerabilities that could facilitate an authenticated remote attacker to access sensitive internal information. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-09
• Siemens RUGGEDCOM APE1808 Devices
  "Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens recommends to contact customer support to receive patch and update information."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-18
• Siemens SIMATIC S7 Webserver API
  ".NET Client Library for SIMATIC S7 Webserver API contains multiple vulnerabilities that could allow an attacker to obtain sensitive information or write arbitrary files outside the intended download directory. Siemens has released a new version for .NET Client Library for SIMATIC S7 Webserver API and recommends to update to the latest version."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-10
• Siemens APOGEE, TALON And Desigo PXC/PXM Products
  "The products listed below contain multiple vulnerabilities that could allow an attacker to cause a denial of service and potentially impact the availability of the affected device. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific mitigations for products where fixes are not or not yet available."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-08
• Siemens SIMATIC IPCs
  "The products listed below contain a vulnerability that could allow an attacker to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled. Siemens has released new versions for the affected products and recommends to update to the latest versions."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-07
• Siemens PSS(R)SINCAL
  "PSS(R)SINCAL uses WibuKey third-party product that contains an out-of-bounds write vulnerability. An attacker could exploit this vulnerability to cause a system crash, resulting in a denial-of-service condition. This affects PSS SINCAL only when configured to use the legacy WibuKey dongle license type. Siemens is actively preparing updates and recommends applicable mitigations for products where patches are currently unavailable."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-06
• Siemens SENTRON 3NA COM Fuse
  "SENTRON 3NA COM Fuse contains a Denial-of-Service vulnerability. Improper handling of a network management message could allow an attacker to trigger a denial-of-service (DoS) condition. Successful exploitation may require the affected network to be re-established to restore normal operation."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-05
• Siemens Capital Embedded AR Classic
  "The products listed below contain an out-of-bounds read vulnerability that could allow an attacker to cause abnormal product behavior, instability, or denial of service. Siemens has released a new version for Capital Embedded AR Classic R20-11 and recommends updating to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-04
• Siemens Software Center
  "The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. Siemens has released a new version for Siemens Software Center and recommends to update to the latest version. Please refer to our blog post for additional information about current known active exploitation and how to detect it."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-03
• Siemens Industrial Edge App Publisher
  "The Industrial Edge App Publisher contains a vulnerability chain involving improper certificate validation and the rendering of unescaped data from backend responses. These issues can be combined to allow an attacker on the network to impersonate the management server and execute arbitrary code (RCE) on the local machine through Node.js integration. Siemens has released an update for the Industrial Edge App Publisher and recommends to update to the latest version."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-02

New Tooling

• New PHP2Shell Scanner Checks Your Hosts For CVE-2026-109618 And CVE-2026-109619
  "Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed to CVE-2026-109618 and CVE-2026-109619, the pair of PHP remote code execution bugs patched on October 21. PHP2Shell lets an attacker reach pre-auth RCE against PHP applications running on Apache mod_php or PHP-FPM under default configurations, with confirmed exploitation on widely deployed software including WordPress, Drupal, Joomla, phpMyAdmin, Nextcloud, and Magento. If you run PHP behind a web server, you need to know which of your hosts are still vulnerable, and Searchlight’s researchers argue that most scanners already circulating cannot tell you reliably."
  https://www.helpnetsecurity.com/2026/10/22/php2shell-scanner-tool/
  https://github.com/assetnote/php2shell-scanner

Vulnerabilities

• Arista Patches New VeloCloud Orchestrator Zero-Day Exploited In Attacks
  "Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments. VCO is a web-based management portal that helps administrators configure, monitor, and manage VeloCloud SD-WANs (Software-Defined Wide Area Networks) and associated edge devices. Tracked as CVE-2026-114625, this critical-severity flaw can allow attackers with basic privileges, access to the VCO web interface, and a valid authenticated session to escalate privileges through low-complexity SQL injection attacks that don't require user interaction."
  https://www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/
  https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199
  https://thehackernews.com/2026/10/arista-warns-of-critical-velocloud-sql.html
• Cisco Patches 34 Vulnerabilities Across Multiple Products
  "Cisco on Wednesday announced patches for 34 vulnerabilities across Expressway Series, IOS XR, Snort 3, and Unified Communications products. Expressway Series received fixes for 10 vulnerabilities, including a critical-severity remote code execution (RCE) bug tracked as CVE-2026-76466. According to Cisco, the use of persistent cookies and insufficient validation of client certificates in certain configurations could allow attackers to connect to the database service and invoke specific remote procedure call (RPC) commands to exploit the bug."
  https://www.securityweek.com/cisco-patches-34-vulnerabilities-across-multiple-products/

อ้างอิง
Electronic Transactions Development Agency (ETDA)