Security

Daily CVE highlight, 28 October 2026: four 9.8s, and each one turns on a different question

28 October 2026·6 min read

In the 30 hours to the evening of 28 October, 903 new CVE records were published and 104 of them scored 8.5 or higher. Four deserve your time today. They share a headline score and nothing else: each one turns on a different question, and that question is the one to answer before you decide how fast to move.

1. Today: Dell PowerProtect Data Domain, DSA-2026-416

One Dell advisory fixes more than forty CVEs, and four of them are 9.8 with no login needed: CVE-2026-103780 (stack-based buffer overflow leading to command execution), CVE-2026-86384 (hard-coded cryptographic key, leading to credential exposure), CVE-2026-86397 (improper authentication leading to privileged account creation) and CVE-2026-86400 (improper authentication leading to command execution as root). Affected: Feature Release 7.7.1.0 to 8.8, LTS2024 up to 7.13.1.80, LTS2025 up to 8.3.1.40 and LTS2026 up to 8.6.1.20. The CVE records give the fixes as 8.9.0.0, 7.13.1.90, 8.3.1.50 and 8.6.1.30 or later.

This is one of the cases where the score means what it says. The question is network reach: the attacker needs access to the appliance, not an account on it. That matters because a backup appliance holds the copies you would restore from, so it is a place where an attacker who has already got into your network has a reason to look. That last point is our judgement, not Dell's. First move: list every Data Domain, Virtual Edition, APEX Protection Storage and Management Center instance, read the exact version, shrink the set of hosts that can reach their interfaces to your backup and admin systems, and schedule the upgrade.

2. Today, if you stage or hold spares: Juniper Session Smart Router, CVE-2026-103409

An unauthenticated network attacker can obtain administrative privileges by passing crafted URL parameters to an insecure endpoint that runs as root. CVSS 9.8. The line that changes the picture is Juniper's own: it can only be exploited before the device is onboarded to Mist or Conductor, and cannot be once it is. Affected: before 7.0.5, 7.1.0 to before 7.1.7, and 7.2.0 to before 7.2.3. Fixed in 7.0.5, 7.1.7 and 7.2.3 and later. Juniper lists no workaround.

So the question here is the device's state, not its version. A router in production and onboarded is out of reach of this bug. One on a bench, in a depot, at a branch waiting for its onboarding, or reset and not yet re-enrolled is not. First move: list your Session Smart Routers with their onboarding status, keep any that are not onboarded off networks you do not control until they are, and upgrade to the fixed release regardless.

3. This week: jackson-databind, CVE-2026-110879

If you patched jackson-databind last time, this one still reaches you. It is an incomplete fix for CVE-2026-54512: that fix added validation of generic type arguments, and this bypass shows classes inside those arguments, and the element type of array type IDs, were still accepted. CVSS 9.8, CWE-502, deserialization of untrusted data. Patched in 2.18.12, 2.21.8, 2.22.4, 3.1.8 and 3.2.4. There is no 2.19.x fix listed, so 2.19.x moves to 2.21.8 or later, and the releases that fixed the earlier CVE (2.18.8, 2.21.4, 3.1.4) are still affected.

The 9.8 is the worst case. Whether you are in it depends on a configuration question: do you turn untrusted JSON into objects using class-name polymorphism? The advisory lists default typing in 2.x and 3.x, annotation-based class-name polymorphism with a default 3.x JsonMapper, allowIfBaseType rules, and, by name, Spring Security's legacy Jackson 2 module and Spring Data Redis serializers. Exploitability also needs a usable class on the classpath. First move: find which version each service really ships, then search for the features above.

# What each build actually resolves
mvn dependency:tree -Dincludes=com.fasterxml.jackson.core:jackson-databind
./gradlew dependencies --configuration runtimeClasspath | grep -i jackson-databind

# Does the code use class-name polymorphism?
grep -rnE 'activateDefaultTyping|enableDefaultTyping|Id\.CLASS|Id\.MINIMAL_CLASS|GenericJackson2JsonRedisSerializer' --include=*.java --include=*.kt .

4. This week: Jenkins advisory 2026-10-28

Fifteen issues, all fixed in weekly 2.588 and LTS 2.580.2. The headline in the feed is CVE-2026-117618: a race in the setup wizard that lets an unauthenticated attacker create an administrator account while the first account is being replaced. The advisory rates its complexity high, and it only exists while an instance is still in initial setup. If you have a Jenkins that was started and never finished, finish it or upgrade.

The one that matters to more people is lower down the list. Several of the high-severity issues need only Overall/Read, including CVE-2026-117616, a path traversal in agent names that can overwrite files and potentially lead to code execution. Overall/Read sounds harmless and, on instances that allow anonymous read, it is available to anyone who can reach the page. First move: upgrade, then check who holds Overall/Read and whether anonymous read is on. For the cross-site scripting issues, Jenkins says enforcing a Content Security Policy on 2.539 or LTS 2.541.1 and later mitigates three of them; for the rest the advisory lists no workaround.

What the four have in common

The same score, and four different questions. Who can reach the appliance. What state is the device in. Do you use the feature the bug lives in. What permission does the attacker already hold. A CVSS number cannot answer any of them, and each answer can move you from this week to today or from today to not at all. Ask the question before you read the severity.

Fifteen minutes this morning

List your Data Domain and related Dell protection storage and read the version off each.
List Session Smart Routers and their onboarding state.
Run the dependency-tree command above on your largest Java service.
Check each Jenkins controller's version, and whether setup finished and anonymous read is on.

Moved today: CISA's Known Exploited Vulnerabilities catalog

CISA added four on 27 and 28 October, listed here by the titles CISA gives them: Linux Kernel Missing Initialization of a Variable (CVE-2026-46300, due 31 October, the shortest deadline), Broadcom VMware ESX Insufficient Logging (CVE-2026-41709), Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type (CVE-2026-48356) and Google Brotli Unchecked Return Value (CVE-2026-111497). None of our four picks is among them. If you run any of these four products, they come before ours.

Worth a minute, not picked

MLflow, CVE-2026-116692 (9.8, fixed in 3.17.0): deployments with authentication disabled allow unauthenticated code execution; with basic auth it needs an account that can create experiments and upload artifacts, and the allowed scorer package must be writable by the server.
Apache Kafka Connect, CVE-2026-115644: when admin.listeners is a separate listener, the admin logger endpoint skips the configured authentication extensions, so an attacker with network access can read and change log levels, including cluster-wide.

Keep reading

What we do not know

Whether any of the four is being exploited. None of the records says so, and none is among the KEV additions we read.
Whether public exploit code appears. We have not read any.
Dell's release date and per-release notes beyond what the CVE records and advisory table show; read the full advisory before you schedule.