Security Roundup: 13 Oct 2026

A federal deadline landing today, an Apache Struts code execution flaw, and three library and service fixes.

• CISA’s compliance due date for an exploited Apple CoreGraphics zero-day is today, 13 October.
• Apache says Struts versions using the legacy RESTful action mapper have an OGNL injection bug allowing remote code execution.
• AWS says AWS CDK Library Docker asset bundling prior to 2.267.0 can leak host symlink targets into deployment archives.
• Cisco Talos says OpenVPN 2.6 before 2.6.19 can be crashed remotely via a malformed TLS Crypt v2 key extraction packet.
• GitHub says Contao CMS versions before 4.13.52, 5.3.18, and 5.4.4 have a stored cross-site scripting flaw in the comments bundle.

Security

Federal compliance deadline lands today for Apple CoreGraphics zero-day

CISA Known Exploited Vulnerabilities catalog

CISA’s catalog lists CVE-2026-86950 with an emergency compliance due date of 13 October 2026 under BOD 26-04. The advisory describes an out-of-bounds write flaw in Apple CoreGraphics that allows arbitrary code execution across iOS, iPadOS, and macOS endpoints when processing crafted documents or images. CISA mandates applying vendor mitigations or removing affected devices from corporate networks. It hits organizations managing macOS, iOS, or iPadOS fleets that have not deployed Apple’s September updates.

This week. Audit your mobile device management (MDM) fleet inventory today and enforce OS updates on any Apple endpoint running pre-September software builds, quarantining non-compliant devices until patched.

Apache Struts RESTful action mapper OGNL injection permits remote code execution

Openwall oss-security

Lukasz Lenart posted advisory CVE-2026-104711 to oss-security for Apache Struts. The advisory says an Expression Language injection flaw exists when an application uses the legacy RESTful action mapper, allowing crafted requests to evaluate arbitrary OGNL expressions and achieve remote code execution. The vulnerability affects Struts versions 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0, and is resolved in Struts 6.12.0 and 7.4.0. It hits web applications relying on legacy Struts action mapping conventions.

This week. Upgrade Struts dependencies to 6.12.0 or 7.4.0. If an upgrade is delayed, inspect struts.xml to verify the legacy RESTful action mapper is disabled and confirm that the OGNL allowlist remains enabled.

AWS CDK Library Docker bundling can leak host files into synthesized assets

AWS

AWS Security Bulletin 2026-131-AWS, rated Important, covers CVE-2026-107608 in the AWS CDK Library (aws-cdk-lib). AWS says improper link resolution during asset bundling output handling allowed Docker bundling routines to copy unintended symlinked files from the host into deployment asset archives. The vulnerability affects aws-cdk-lib versions prior to 2.267.0 and is fixed in version 2.267.0. It hits infrastructure-as-code pipelines that use Docker asset bundling with shared host mounts.

This week. Upgrade aws-cdk-lib to 2.267.0 across all CDK repositories and build agent images, and inspect recently synthesized CloudFormation asset archives for unintended local files.

OpenVPN 2.6 TLS Crypt v2 assertion crash triggers remote daemon abort

Cisco Talos

Cisco Talos published advisory TALOS-2026-2381 covering CVE-2026-35058 in OpenVPN 2.6. Talos says a reachable assertion in the TLS Crypt v2 Client Key Extraction functionality allows an unauthenticated remote attacker to transmit a malformed key packet that causes the openvpn server process to abort. The vulnerability affects OpenVPN 2.6 before 2.6.19 and is resolved in 2.6.19. It hits organizations running self-hosted OpenVPN access gateways.

This week. Upgrade OpenVPN server instances to version 2.6.19 or later, and restrict ingress to gateway listening ports to authorized network blocks where possible until patched.

Contao CMS comments bundle stored XSS allows administrative takeover

GitHub Advisory Database

GitHub rates advisory GHSA-628f-v4f6-p37r (CVE-2026-107845) Critical. It says Contao’s comments bundle (contao/comments-bundle) does not adequately sanitize comment submissions, allowing an unauthenticated visitor to store malicious JavaScript that executes in an administrator’s browser during comment moderation. The flaw is resolved in Contao versions 4.13.52, 5.3.18, and 5.4.4. It hits websites running Contao with public comment forms enabled.

This week. Upgrade Contao installations to 4.13.52, 5.3.18, or 5.4.4. If an immediate update is not possible, disable public comment submissions or refrain from reviewing comment moderation queues in the administrative backend.