The IT week was the broker. SkyKick’s publisher secret minted Graph tokens; ARMORY CASTLE used BeyondTrust as a zero-day; UTA0576 was already root on patched Connect Secure.

12–19 October 2026. Nine new KEVs. Huntress counted 300+ successful Entra sign-ins from a ConnectWise Cloud Backup credential. Mandiant named ARMORY CASTLE on Remote Support. Volexity named UTA0576 on 22.8R2.4. Cisco split 76519 out of September. BeyondTrust 102764 and Fortinet 61624 due today.

RWP Ventures · 2026-10-19 · 22 min read · priority 9.1

Executive summary

FACT: Last week the highest-leverage enterprise problem was the session kill — FortiBleed locking FortiGate admins out with no new CVE, ReliaQuest naming Settra on a five-month-old GlobalProtect cookie, Ahsay walking back 10.3.4.0, Citrix publishing a third SAML overflow that 14.1-73.41 does not close. Those tickets did not vanish. Ahsay and Atlassian moved onto KEV. NetScaler 107406 still has no row. They are unfinished hunts on last week’s boxes. They are not this week’s pattern.

This week’s pattern is that the trusted broker is the actor.

CISA’s Known Exploited Vulnerabilities catalog, version 2026.10.16 released 16 October 17:15 UTC, now holds 1,748 rows. Nine of those were added between 13 and 16 October. All nine carry ransomware-use Unknown. Eight of nine carry forensic triage Yes; Ahsay CVE-2026-105133 is No. Federal clocks on the new rows ran 16–19 October. Two of them — BeyondTrust CVE-2026-102764 and Fortinet CVE-2025-61624 — are due today.

The material IT development this window is not those nine CVE rows.

On 15 October a publisher credential that belongs to ConnectWise Cloud Backup (formerly SkyKick) was used to authenticate as the application itself into customer Microsoft 365 tenants and mint Microsoft Graph tokens. Huntress recovered that from Entra service-principal sign-in logs. Microsoft Threat Intelligence, 17 October, called it an active supply-chain attack against a trusted multi-tenant OAuth app. ConnectWise disabled seven application identities at 07:00 UTC on 17 October, revoked Cloud Backup certificates, and as of the 19 October 01:15 UTC Trust Center freeze still has Cloud Backup, SaaS Security, and Cloud Management suspended, with no confirmed restoration time. There is no CVE. MFA and user-session revoke do not stop it. Disabling the apps does not remove secrets already planted in the tenant.

On 15 October BeyondTrust published BT26-05 / CVE-2026-102764. Mandiant/GTIG attribute late-August zero-day use to ARMORY CASTLE (UNC5221 / Warp Panda). SaaS was patched 8–9 October. Self-hosted still has to hunt. CISA listed it 16 October, due today, forensic triage Yes. Mandiant’s sentence is rebuild, not clean.

On 13 October Volexity published that UTA0576 chained then-zero-days on Ivanti Connect Secure and landed unauthenticated root on a box that was fully patched at the time — 22.8R2.4, Build 19097. CISA listed CVE-2026-104935 the same day, due 16 October. The privilege-escalation that takes cgi-server to root still has no CVE. Integrity Checker looks at disk. The chain ran in memory.

On 14 October Cisco split CVE-2026-76519 out of the September AMP grouping because it was exploited. Unauthenticated attachment, root on Secure Email Gateway. Due 17 October. Content Scanner Tools 25.3.0.5525 is the close, not last month’s 76461 SQL-injection floor.

ASSESSMENT: If the patch queue this week was last week’s FortiGate session kill plus leftover NetScaler 73.46, you sequenced a VPN ticket and called it done. The Graph token minted as SkyKick still looks like a backup job. The Remote Support vault still holds the Jump Items. The Connect Secure that greened ICT on 22.8R2.4 was already root. The mail gateway that took September hardening without Content Scanner Tools 25.3.0.5525 still accepts the attachment.

The week in one assessment

Four threads, one pattern: the product you already trust is the initial-access path, and the vendor kill-switch is not the eviction. ConnectWise’s publisher secret inherited every consent the backup app already had. ARMORY CASTLE used Remote Support as a zero-day and dumped the vault. UTA0576 was root on a current Connect Secure build, then stripped the logs ICT would have read. Cisco’s AMP feature — the thing that is supposed to inspect the attachment — wrote the attachment as root. Nine new KEV rows sit under that pattern. Two of them (Ahsay 105133/105134, Atlassian 21589) are last week’s “not on KEV” tickets closing the wrong way, as catalog increments. The five Integrity Tech OSS rows from 8 October are last week’s leftover clocks, not this week’s lead. Attackers keep buying the box that already has permission: the MSP OAuth app, the help-desk appliance, the VPN that passed last month’s ISO, the mail scanner that is in the path on purpose.

1. Most important development

The broker, not the CVE.

Do not collapse four facts. They are four tickets.

1. SkyKick is a publisher credential, not a phished user. Huntress, Todyl, ConnectWise, and Microsoft Threat Intelligence all name Application ID 506e08f9-6e9a-4da4-942b-a099a03644ae and source 144.172.64[.]128. The credential type is a client assertion that lives in ConnectWise’s tenant. Nothing a customer configured produced it. Huntress’s first floor, 19:00 UTC 16 October: 162 confirmed unauthorized sign-ins. Huntress’s 17 October 17:15 ET floor: almost 1,000 Entra tenants with any sign-in activity from that IP, over 300 successful. Those are different metrics. Microsoft has not published a matching count. The Hacker News 17 October relay of 173 is the earlier Huntress number moving, not a third census. ConnectWise’s own sentence, 18 October 01:00 UTC: disabling the seven identities prevents new authentication; it does not reverse changes previously made inside a tenant; previously issued tokens may remain usable until they expire. As of 19 October 01:15 UTC the three services are still down and there is still no restoration time. ConnectWise has no evidence stored backup archives were accessed. That is a statement about ConnectWise-held stores. It is not a statement about what Graph tokens did inside customer tenants. Actor: unnamed.

1. ARMORY CASTLE used Remote Support before the CVE existed. CVE-2026-102764, CWE-290, CVSS 4.0 9.3. Unauthenticated file operations on the appliance via improper origin validation in an internal messaging component. BeyondTrust reproduced 28 September, patched SaaS 8–9 October, published 15 October. Mandiant’s self-hosted IR: SAWFLY webshell, SUID dbus-authd, bt-secrets vault dump, zz-root-persist, Jump Item admin, BARECLAW via HAProxy. Confirmed victims on 29 August: one SaaS, one self-hosted. Shadowserver >1,400 internet-facing Remote Support / PRA instances is exposure, not compromise. Catalog freeze 2026.10.16 / 1748: listed 16 October, due today, forensic triage Yes, ransomware Unknown. Mandiant: treat internet-reachable appliances in the window as potentially compromised until reviewed. Rebuild, do not clean.

1. UTA0576 was root on the current build. Volexity, 13 October: unauthenticated chain on Ivanti Connect Secure 22.8R2.4 Build 19097, in since 3 October (Defused 1 October floor is REPORTED). CVE-2026-104935 is auth bypass plus RCE (CWE-290, CVSS 8.6). The local-root step has no CVE; Ivanti told Volexity it lands in a later release. Integrity Checker misses in-memory patches. CISA listed it 13 October, due 16 October, forensic triage Yes. Fixed trains: 22.8R2.5 / 25.1.1.2 / 25.1.3.0-1. 22.7 is unaffected by 104935 and still EOL 31 January 2027. Named actor is Volexity’s UTA0576, motive low-confidence criminal. Do not merge with ARMORY CASTLE.

1. Cisco’s September grouping was not the exploitation notice. CVE-2026-76519 (CWE-23, CVSS 9.8, bug ID CSCwu56223) is AMP File Reputation path traversal. The code shipped 14 September inside CVE-2026-76440. Cisco split it on 14 October because PSIRT became aware of October exploitation. Two conditions: File Reputation assigned to a mail policy, and Content Scanner Tools earlier than 25.3.0.5525. AsyncOS floors 15.5.5-014 / 16.5.0-780. 16.0 has no fixed AsyncOS. This is not [CVE-2026-76461](/posts/2026-09-15-cisco-seg-cve-2026-76461-sqli/). CISA listed it 14 October, due 17 October, forensic triage Yes.

There is no confirmed OT or physical-process impact on any of these four. An industrial or hospital tenant whose MSP installed SkyKick is an IT compromise of Microsoft 365 at that organization. A Remote Support or Connect Secure box in front of a plant is still an IT perimeter compromise until evidence says otherwise. We do not have it. CERT-FR’s Danfoss AK-SM/AK-SC cold-chain event belongs in [this week’s weekly OT](/posts/2026-10-16-weekly-ot-danfoss-copeland-siemens/), not as process impact imported onto SkyKick.

2. Active exploitation

CONFIRMED in KEV this window, catalog 2026.10.16:

Nine rows is not nine equivalent tickets. 104935, 76519, 105134, and 102764 are unauthenticated or chained-to-root on internet-facing brokers. 0322 is authenticated management RCE (PR:H). 61624 is authenticated admin CLI path traversal, CVSS 6.5. 96951 is UI:R MotW / command injection on Windows Shell. 21589 is unauthenticated read of a known path under the web root, not RCE. 105133 is the auth-bypass half of the Ahsay chain and is the one new row without forensic triage.

CONFIRMED exploited this window, not in KEV:

• ConnectWise Cloud Backup / SkyKick OAuth. No CVE. Huntress, Todyl, Microsoft TI, ConnectWise. Catalog has no row to add; BOD 26-04 is a CVE instrument.

CONFIRMED exploited, already in KEV last week, catalog increment this window:

• AhsayCBS CVE-2026-105133 / 105134. Last week’s weekly IT recorded Huntress SYSTEM and the 10.3.4.45 walk-back with both CVEs absent from 2026.10.08. CISA listed them 14 October. That is a catalog close, not a new intrusion. Partner hotfix 10.3.4.45 remains the named build. Forensic triage Yes only on 105134.
• Atlassian CVE-2026-21589. Last week: not on KEV, Cloud patched, self-hosted exploitation UNKNOWN. CISA listed it 15 October, due 18 October, forensic triage Yes. WatchTowr is in the catalog notes URL. Still not RCE.

CONFIRMED exploited, already in KEV, no material field flip this window:

• CVE-2026-0257 GlobalProtect, ransomware Known since 29 May. ReliaQuest’s 9 October Settra join is last week’s increment; no long-form IR this window.
• CVE-2026-88771 / 88772 / 88779 NetScaler. Clocks expired. CVE-2026-107406 is still not on KEV. Citrix/MS-ISAC still report no exploitation of this CVE.
• CVE-2026-104286 FortiMail. Firmware shipped last week. No new PSIRT increment this window.

CONFIRMED exploited, still not in KEV: CVE-2026-58138 Orkes / conductor-oss Conductor. Same status as four weeks ago. Named actor: UNKNOWN.

Not claimed exploited, still not KEV: Check Point CVE-2026-85103 and management CVE-2026-91843. Beazley republished the September 85102/85103 pair this week as an alert restatement, not as a wild-use flip. NetScaler 107406. SonicWall SMA1000 CVE-2026-102255. Splunk Patroni CVE-2026-76268. FortiSIEM CVE-2026-106173 (vendor: not exploited). Juniper J-Web CVE-2026-101954.

FortiBleed remains not a CVE. FBI/USSS JCSA-20261006-01 is last week’s CSA. No new lockout census this window.

3. Threat actor / campaign activity

ConnectWise OAuth, actor unnamed. Huntress timeline, all 15 October unless noted:

• 13–14 October: password spray against four law-firm tenants from 144.172.64[.]128, User-Agent curl/7.88.1. No successful user sign-ins in Huntress telemetry.
• ~01:58 UTC: in ~50 Huntress-monitored tenants, ConnectWise Cloud Management service principals assigned themselves directory roles, mostly Exchange Administrator, User-Agent kiota-dotnet. Huntress has not confirmed with ConnectWise that this was vendor automation. Operator UNKNOWN.
• 03:44–03:49 UTC, one tenant: Cloud Management for Teams (24205314-2b89-4e07-a2a4-579e898a5640) self-assigned Global Administrator, then Python-urllib/3.12 added 2028-expiring client secrets to an MSP management app and to Huntress’s own app (ATT&CK T1098.001). Huntress later said the access that planted the Huntress-app secret came from private Azure IPv6, not .128, and that secret was used seven times. Huntress removed it 16 October. Microsoft does not log every Graph read.
• 06:13–08:34 UTC: app 506e08f9 from .128, tenants in sorted GUID order. Todyl independently: 07:11–08:47, Azure-private vs VPS distinction.
• Second wave, 15 October, 16 Huntress-protected tenants in policy, national security, trade, and critical minerals: failed, because most lacked the service principal. Targeting, not a breach, not attribution.

ConnectWise, 18 October 18:45 UTC, added 144.172.64[.]99 and 144.172.64[.]60 from downstream partner monitoring. Huntress republished them as vendor-shared. They are not independently confirmed as the 15 October GUID-order source. MSP-community bulk-exfil claims remain REPORTED. Directory reads through Graph often leave no audit trail; a clean MailItemsAccessed search is a visibility limit, not a clean bill.

ARMORY CASTLE / UNC5221 / Warp Panda. Mandiant/GTIG: late-August zero-day on BeyondTrust Remote Support, two confirmed boxes. Prior public pattern is selective zero-day (NetScaler CVE-2023-4966, Ivanti CVE-2023-46805 / 2024-21887 / 2025-0282) then opportunistic scanning the day the CVE is public. Mandiant writes that outlook for 102764. Treat 15 October as the start of the mass-scan window, not the first day the bug existed. PRA exploitation UNKNOWN; BeyondTrust patched shared code anyway.

UTA0576. Volexity cluster, not a government designation. In-memory command channel, no first-stage on disk, ICT miss, LAPS/BitLocker material behind the LDAP bind is the downstream hunt. Motive low-confidence criminal per Volexity. Do not flatten onto ARMORY CASTLE because both are VPN-adjacent.

UNC7017 / AOMEI. Mandiant/GTIG, disclosed 15 October: ephemeral tampering of AOMEI Backupper / AnyViewer update files in 5–10 minute windows (28 May, 16 July, 20 July). CROSSROAD / SHINYROAD. Event window is April–July. Vendor server fix does not clean already-hit endpoints. Opportunistic, 11 countries, victim count undisclosed. Named country: none. This is a real supply-chain, older than this week’s SkyKick ticket, and it is not the interrupt.

Integrity Tech / AA26-281A. No material increment past last week’s five KEV rows and the MicroScan/FishHub seizure. SoftEther-as-conhost remains the persistence hunt.

Qilin / Settra / FortiBleed IAB. No new ReliaQuest, Arctic Wolf, or FBI/USSS increment this window.

Warlock / Longlegs. No material increment past the 1 October Symantec bulletin.

Do not convert Huntress’s 16-tenant sector labels, or a SkyKick install at an industrial customer, into confirmed process impact.

4. Vulnerabilities to prioritize

Order is operator consequence, not CVSS.

1. ConnectWise Cloud Backup / SkyKick — no CVE, tenant hunt today. Inventory Application IDs in every tenant you manage, including dormant SkyKick connections. Disable, do not delete. Then hunt client secrets, certificates, federation trusts, directory roles, owners, consent grants, mailbox forwarding, and transport rules added since 13 October — especially on MSP and security-platform apps. Searching only .128 misses .99, .60, and the Azure IPv6 path Huntress documented in the persistence tenant. Entra Free seven-day retention means 13 October sign-ins age off 20 October; export is a same-day action. ConnectWise’s 18 October PDF is the workflow; a vendor kill-switch is not a tenant clean. Keep the apps disabled until ConnectWise publishes restoration instructions.

| Application | Application ID |

|---|---|

| ConnectWise Cloud Backup (formerly SkyKick) | 506e08f9-6e9a-4da4-942b-a099a03644ae |

| ConnectWise Cloud Management | 2399d300-6fca-4e6a-a686-399fefe75b83 |

| Cloud Management - MS Teams | 24205314-2b89-4e07-a2a4-579e898a5640 |

| Cloud Management - Exchange Online | b78f6a77-d4e5-46fb-87e5-d1648bd02519 |

| Cloud Management - MS Graph | 0de14c77-b9b0-4137-9360-34878a929827 |

| Cloud Management - Partner Center | 412dcf96-176d-4b3a-a1b0-4981ad66971e |

| Cloud Management - SharePoint Online | b2b55f5b-7758-4719-8d8f-88ae172e6bdb |

1. BeyondTrust Remote Support CVE-2026-102764 — BT26-05-RS, then assume compromise if the box was internet-reachable since August. SaaS is BeyondTrust’s (patched 8–9 October); still rotate credentials and review sessions. Self-hosted 24.3.1–26.2.3 apply the patch; older than 24.3.1 upgrade first. Off-box syslog and reverse-proxy URI logs are the record; the actor deleted on-box logs. Federal clock today. Forensic triage Yes.

1. Ivanti Connect Secure CVE-2026-104935 — 22.8R2.5 / 25.1.1.2 / 25.1.3.x, then rebuild if the box was current in the first week of October. ICT is the wrong close. Privilege-escalation still unpatched. Rotate the directory account the appliance uses. Hunt LAPS and BitLocker material. Clock expired 16 October. Forensic triage Yes.

1. Cisco SEG CVE-2026-76519 — Content Scanner Tools 25.3.0.5525, then triage. contentscannerstatus tonight. 16.0 has no fixed AsyncOS. Virtual appliances: rebuild, do not import last week’s config. Clusters: one member’s SSH keys are a path into the rest. Clock expired 17 October. Not 76461.

1. AhsayCBS CVE-2026-105133 / 105134 — 10.3.4.45, now KEV. Partner portal. Forensic triage Yes on 105134, No on 105133. Clock expired 17 October. Last week’s SYSTEM cluster is the hunt, not a new one.

1. Atlassian CVE-2026-21589 — eight self-hosted Data Center products, now KEV. Clock expired 18 October. Crowd floor 7.1.7, Bamboo 10.2.24 (CVE-field mismatches remain). Cloud is Atlassian’s. Exact path, no directory listing.

1. PAN-OS CVE-2026-0322 — authenticated management RCE, due 17 October. Not unauthenticated WAN. Restrict management off the internet; that is the exposure condition. Limited exploitation per vendor. Forensic triage Yes. Do not collapse onto GlobalProtect 0257.

1. Fortinet CVE-2025-61624 — authenticated admin CLI path traversal, due today. FortiOS, FortiPAM, FortiProxy, FortiSwitchManager. CVSS 6.5. Same KEV batch as 102764, much smaller blast radius. FG-IR-26-122. Not FortiBleed and not FortiMail 104286.

1. Windows CVE-2026-96951 — MotW / Shell command injection, clock expired 16 October. UI:R. Parallel federal clock from 13 October, not the broker.

1. Leftovers whose clocks already expired and whose hunts are unfinished: NetScaler 88771/88772/88779 plus 107406 third ISO, FortiMail 104286, FortiBleed session kill, GlobalProtect 0257 session kill, SD-WAN Manager 76504, Zammad 102489/102490, Check Point 85102/93616, SharePoint 65660, F5 APM, WSO2, ISE 76460, SEG 76461, vCenter 59310, FMC, N-central, ScreenConnect 84869, PaperCut, GitLab 85706, Conductor 58138, Integrity Tech Appendix B plus SoftEther-as-conhost.

Splunk 76268, FortiSIEM 106173, Juniper 101954, Drupal 108097, Broadcom WPS forever-day, OpenCode Console key theft: real bugs or real incidents, no claimed in-the-wild that changes this week’s interrupt.

5. Identity / cloud / enterprise

The identity plane this week is the service principal, not the VPN cookie.

SkyKick is the MSP pattern in one object: one publisher secret, every consented tenant, Graph permissions broad enough to back up mail and files, no user, no device, no MFA. Conditional Access written for users does not apply. Interactive sign-in logs will not show it. The tab is Service principal sign-ins. Todyl’s distinction — legitimate Cloud Backup egress is Azure private IPv6; the malicious sign-ins were a commercial VPS IPv4 — is the hunt filter, with the caveat that Huntress’s persistence tenant used Azure IPv6 on purpose.

The second identity ticket is persistence that survives the vendor. Adding a client secret to an already-trusted application gives the holder that app’s Graph rights from anywhere until an administrator deletes the secret. Huntress saw it done to an MSP management app (often consented downstream) and to a security-platform app. ConnectWise turning Cloud Backup off does not delete those secrets. Disabling 506e08f9 does not delete them either.

BeyondTrust and Ivanti are identity-adjacent the other way: the appliance is the credential broker. Remote Support holds Jump Items and vaulted passwords. Connect Secure holds the LDAP bind and, in Volexity’s case, a path to LAPS and BitLocker material. Patching without rebuild leaves the vault.

Atlassian 21589 is the self-hosted collaboration plane, now with a federal clock that expired yesterday. PAN-OS 0322 is the management plane of the firewall, authenticated. Windows 96951 is the client MotW path from Patch Tuesday, 13 October.

No material Entra Conditional Access product bug was published this window. The Entra problem is the consent you already granted a backup vendor.

6. Ransomware / criminal activity

CONFIRMED by CISA catalog field, unchanged: GlobalProtect CVE-2026-0257 ransomware-use Known. All nine new KEV rows this week: ransomware-use Unknown.

NOT claimed: SkyKick as ransomware. Graph tokens on a backup app are a ransomware-enabling position (tenant-wide mail and file read/write, restore-plane interruption while Cloud Backup is down). Huntress has not named a locker. ConnectWise has not named a locker. Microsoft TI has not named a locker.

NOT claimed: ARMORY CASTLE as ransomware. Vault dump and Jump Item admin are a ransomware-enabling position. Mandiant’s cluster is a suspected PRC-nexus CNE actor, not a locker.

NOT claimed: UTA0576 as ransomware. Volexity low-confidence criminal. Credential theft and exfil are the documented objectives.

NOT claimed: Ahsay Huntress cluster as ransomware. Still XMRig. Now on KEV with ransomware Unknown.

UNC7017/AOMEI is backdoor delivery (SHINYROAD), not a named ransomware family in the GTIG write-up.

FortiBleed INC/Lynx and Payload remain last week’s REPORTED hand-off. No CSA update this window.

PaperCut KEV ransomware-use remains Unknown. No new GreyNoise increment past 440.

Do not convert a water-utility SkyKick tenant or a hospital Remote Support appliance into confirmed process impact. None of this week’s IT sources showed a PLC write.

7. Defensive priorities

1. Every tenant you manage, tonight: the seven ConnectWise Application IDs disabled (not deleted), credentials on every other enterprise application reviewed since 13 October, service-principal sign-ins from 144.172.64.128/.99/.60 and Azure private IPv6 in the 15–16 October window, Entra Free logs exported before tomorrow. Then internet-facing BeyondTrust Remote Support (BT26-05, rebuild if in the August–October window), Ivanti Connect Secure (104935 build and rebuild if current in early October), Cisco SEG (25.3.0.5525 plus triage), leftover AhsayCBS 10.3.4.45, Atlassian Data Center 21589, PAN-OS management 0322, Fortinet 61624 CLI, leftover FortiBleed / GlobalProtect 0257 session kills, NetScaler 107406 third ISO plus WHIPSHOT hunt, FortiMail 104286 hunt, Integrity Tech Appendix B, Check Point 85102/93616, ScreenConnect, PaperCut, Conductor 58138.
2. Forensic triage is the instruction on eight of this week’s nine new KEV rows. Patching SkyKick off without hunting planted secrets is how you leave a 2028-expiring client secret on an MSP app. Patching BeyondTrust without rebuild is how you leave dbus-authd. Patching Connect Secure without memory forensics is how you leave a green ICT on a rooted box.
3. SkyKick: ConnectWise cannot see inside your tenant. Its archive statement is not your Graph statement. Dormant consents count.
4. BeyondTrust: 15 October is Mandiant’s mass-scan start, not the first exploit day. Off-box logs. Vault rotation. Jump Item role review.
5. Ivanti: 22.8R2.4 was “fully patched” on 3 October. Treat that sentence as the reason to rebuild, not as a waiver.
6. Cisco SEG: September hardening without Content Scanner Tools 25.3.0.5525 is still in. 76461 is a different bug.
7. Ahsay: the KEV row does not replace 10.3.4.45. NVD’s older “10.3.4 unaffected” is still stale.
8. Atlassian: clock expired yesterday. Crowd/Bamboo floor mismatches are how a ticket closes on the wrong build.
9. PAN-OS 0322 and Fortinet 61624 are authenticated. Management off the internet is the control that makes the KEV row a residual risk rather than an emergency.
10. Check Point 85103 and 91843 still uncatalogued. Conductor 58138 still exploited, still no row. NetScaler 107406 still not KEV; 73.41 remains in for SAML IdP.

8. What changed from last week

Last week’s [weekly IT](/posts/2026-10-12-weekly-it-session-kill-fortibleed-ahsay-netscaler/) was FortiBleed lockouts, ReliaQuest Settra-on-0257, Ahsay 10.3.4.45 walk-back not on KEV, NetScaler 107406 third SAML ISO not on KEV, Integrity Tech five KEV due 11 October, FortiMail firmware shipped.

This week those open items closed or moved as follows:

• Ahsay 105133/105134 are now KEV, added 14 October, due 17 October. Forensic triage Yes only on 105134. 10.3.4.45 remains the named close. Huntress’s five-org cluster was last week’s exploitation evidence; the catalog caught up.
• Atlassian 21589 is now KEV, added 15 October, due 18 October. Self-hosted exploitation still not independently confirmed in a new IR this window.
• NetScaler 107406 is still not KEV. Citrix/MS-ISAC still report no exploitation of this CVE. 73.41/64.28 remains in for SAML IdP. WHIPSHOT hunt unfinished.
• FortiBleed: no new CVE, no new CSA. Session-kill ticket still open.
• GlobalProtect 0257: no new ReliaQuest or Arctic Wolf increment.
• FortiMail 104286: no new PSIRT increment. Hunt unfinished.
• Check Point 85103 is still not KEV. 91843 is still not KEV. Beazley’s 18 October restatement is not a wild-use flip.
• Conductor 58138 is still exploited and still has no KEV row.
• PaperCut did not grow a published victim increment past 440.
• Integrity Tech five: clocks expired 11 October. No second-wave listing.
• Catalog count 1739 → 1748. Nine adds in seven days, versus five the week before — and unlike last week, eight of nine are 2025–2026 products, not 2015 OSS. The unfinished business moved off “the ISO is not the eviction” and onto the broker you already consented.
• The target class moved inward. Last week the actor was already on the firewall, the VPN cookie, the backup console, the ADC. This week the actor is the backup vendor’s app, the help-desk appliance, the VPN that was current, the mail scanner in the path.

9. What we are watching next

Whether ConnectWise restores Cloud Backup, names how the publisher credential was taken, or confirms tenant-side data access. Whether Huntress’s ~1,000 / 300+ floor grows, or Microsoft publishes a count. Whether the .99 / .60 addresses are independently tied to the 15 October GUID-order sweep. Whether the unnamed SkyKick actor is clustered. Whether planted secrets show up past the one Huntress tenant. Whether CISA finds a way to list a non-CVE OAuth incident, or BOD 26-04 stays a CVE instrument.

Whether BeyondTrust 102764 victim count moves past two, PRA exploitation moves off UNKNOWN, or Mandiant names a third box. Whether Ivanti ships the unpatched privilege-escalation and whether UTA0576 grows past Volexity’s limited set. Whether Cisco 76519 draws a named campaign or a cluster ID. Whether NetScaler 107406 or Conductor 58138 land in KEV. Whether Check Point 85103 or 91843 follow 85102/93616. Whether AOMEI/UNC7017 produces endpoint hunts now that the May–July windows are public. Whether FortiBleed lockouts produce a named IAB cluster. Chromium’s next in-the-wild after 85046 and 87491.

10. RWP assessment

Confidence: High on the KEV listing set (catalog 2026.10.16, count 1748), on Huntress/Todyl/Microsoft TI/ConnectWise agreement that a Cloud Backup publisher credential minted Graph tokens from 144.172.64.128 on 15 October, on ConnectWise disabling seven identities at 07:00 UTC 17 October and leaving three services suspended as of 19 October 01:15 UTC, on Mandiant’s ARMORY CASTLE / SAWFLY / BARECLAW reconstruction and BeyondTrust’s BT26-05 floors, on Volexity’s UTA0576 chain against 22.8R2.4 and CISA’s same-day 104935 listing, and on Cisco’s 76519 split from the September grouping. Moderate on unifying SkyKick, BeyondTrust, Ivanti, and SEG into a single “trusted broker” week — the pattern is operator consequence, not actor. Moderate on Huntress’s ~1,000 / 300+ as a floor rather than a census, and on the 16-tenant sector wave as targeting rather than capability. Low on SkyKick downstream data theft (visibility limit), on ARMORY CASTLE victim count past two, on UTA0576 motive, and on .99/.60 as confirmed 15 October sources. None claimed on OT process impact. None claimed on a named SkyKick actor.

The week does not require a new SIEM use-case. It requires disabling seven Application IDs and hunting the secrets that survive that disable, rebuilding Remote Support and Connect Secure boxes that were internet-reachable in the window, confirming Content Scanner Tools 25.3.0.5525 on the mail path, and not calling last week’s FortiGate session kill the close.

This assessment covers 12–19 October 2026 and was published 19 October 2026. ConnectWise Trust Center freeze is 19 October 01:15 UTC. KEV freeze is catalogVersion 2026.10.16, count 1748.