Today's briefing covers three CISA items dated 2026-10-15: the Known Exploited Vulnerabilities addition of CVE-2026-21589, which lets unauthenticated attackers read files in the web root of eight Atlassian products, with a federal remediation due date of 2026-10-18; ICS advisory ICSA-26-288-01 for six CVEs in the Eclipse Milo OPC UA implementation, fixed in version 1.1.5; and ICSA-26-288-02 for EseeCloud IP cameras, where a hard-coded credential scores CVSS v3 9.8 and the vendor did not respond to CISA. The first two come with vendor remediation; the camera advisory leaves mitigation entirely to operators.
CISA added CVE-2026-21589 to the Known Exploited Vulnerabilities Catalog on 2026-10-15, based on evidence of active exploitation. The catalog entry describes a files-or-directories-accessible-to-external-parties vulnerability in multiple Atlassian products: Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye. In affected versions, an unauthenticated attacker can access specific files within the web application root directory.
The required action is to apply mitigations in accordance with vendor instructions, in compliance with Binding Operational Directive (BOD) 26-04, Prioritizing Security Updates Based on Risk, and CISA's Forensics Triage Requirements, and to follow BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. The due date is 2026-10-18, three days after the addition. Known ransomware campaign use is listed as unknown. CISA's accompanying alert notes that BOD 26-04 requires Federal Civilian Executive Branch agencies to prioritize KEV-listed CVEs on publicly exposed assets that grant total control of the asset after exploitation, and sets basic expectations for when agencies must check whether threat actors compromised a system before the patch was applied.
The flaw needs no authentication, it is already being exploited, and the federal remediation window is three days. Every organization running any of the eight listed products should inventory internet-facing instances now and apply Atlassian's mitigations for this CVE. Because the KEV entry ties remediation to forensic triage, treat patching as the midpoint of the response rather than the end: review exposed instances for signs of access to web-root files before the fix went in.
CISA's advisory for Eclipse Milo covers six CVEs, with a headline CVSS v3 score of 8.2, in versions 0.6.0 through 1.1.4 and 1.0.0 through 1.1.4. The product is deployed worldwide in the Chemical, Critical Manufacturing, Energy, and Water and Wastewater sectors. CISA says successful exploitation could let an attacker delete protected data, recover user credentials and impersonate legitimate users, or cause the server to stop responding to all clients.
Two flaws break authorization in 1.0.0 through 1.1.4. In CVE-2026-62927 (CVSS v3.1 7.5), the Call service dispatches the original mixed batch to address-space handlers after authorization is calculated, so an anonymous or low-privileged client can execute a denied method by batching it with an allowed one. In CVE-2026-58080 (8.2), OpcUaServerConfig.copy() drops a configured RoleMapper; on servers that build their running configuration through copy(), sessions receive no role IDs and the default access controller skips role-permission checks, letting an anonymous client, where anonymous sessions are permitted, read role-permission metadata, invoke protected methods or delete protected nodes.
Two flaws expose credentials and session data in 0.6.0 through 1.1.4. CVE-2026-63248 (6.5) leaves server diagnostics nodes without access authorization: an anonymous client can enable diagnostics over a None/None endpoint without a certificate, and a client with a trusted application certificate over SignAndEncrypt can read other active sessions' security diagnostics, including usernames, login history, authentication mechanisms, security modes and policies, and public client certificates. CVE-2026-60007 (CVSS v3.1 7.4, v4 9.1) returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding during username-token processing, so an on-path attacker who captures a victim's Basic128Rsa15-encrypted username token can use repeated unauthenticated ActivateSession requests as a padding oracle, recover the password and log in.
Two flaws affect availability. CVE-2026-63252 (7.5, versions 0.6.0 through 1.1.4) fails to release retained partial message chunks when a channel disconnects, so a remote unauthenticated client can exhaust pooled direct memory by repeatedly sending incomplete chunks and disconnecting, potentially terminating the server. CVE-2026-61387 (5.3, versions 1.0.0 through 1.1.4) does not restore the server-global monitored-item reservation when item creation fails with an unchecked error; deeply nested PubSub ExtensionObjects in a CreateMonitoredItems event filter trigger such an error, a StackOverflowError during decoding, letting an unauthenticated remote client exhaust the quota and block all clients from creating new monitored items until restart. The Eclipse Foundation recommends upgrading to Milo 1.1.5; there are no 0.6.x releases with the fixes, so 0.6.x users must migrate to 1.1.5 or later. Abhinav Agarwal reported the vulnerabilities to CISA.
Several of these flaws need no credentials at all, and the padding oracle turns a captured login into a recovered password. Find every OPC UA server built on Milo, including inside vendor products, and move it to 1.1.5; the 0.6.x line has no fix. Until then, disable anonymous sessions and the None/None endpoint where the deployment allows, remove Basic128Rsa15 from permitted security policies, check whether your server configuration is built through copy(), and follow CISA's standing advice to keep control-system endpoints off the internet and behind firewalls isolated from business networks.
CISA's advisory covers the EseeCloud App up to version 4.9.6 and EseeCloud Firmware up to version 4.9.86.0 from Guangzhou Juan IoT Technology Co., Ltd., headquartered in China, with devices deployed worldwide in the Energy, Communications, Transportation Systems, Financial Services, and Government Services and Facilities sectors. CISA says successful exploitation could allow an attacker to gain control over affected IP cameras.
CVE-2026-107617 (CVSS v3.1 9.8, v4 9.3) is a hard-coded credential that an attacker can use to log in to EseeCloud devices. CVE-2026-97858 (v3.1 5.3) lets an attacker cause the server to unbind a target device from its current owner and rebind it to the requesting account, regardless of whether it is bound to a different account, exposing the device's full serial ID. CVE-2026-105664 (v3.1 5.3, v4 8.7) is an enumeration oracle: an endpoint returns a distinct error code for a nonexistent ID than for a valid registered one, so an attacker holding any valid access token can separate valid IDs from the full 10-digit numeric space, and with no meaningful rate limiting can discover registered devices at scale.
The vendor did not respond to CISA's coordination attempts, and the advisory's only remediation is to contact the vendor for support. Donghyeon Lee of Tokyo University of Science and GMO Flatt Security reported the vulnerabilities to CISA.
There is no patch, so every control is the operator's. Identify EseeCloud cameras and app installations on your networks, take them off the internet, and place them behind firewalls isolated from business networks, as CISA recommends. The rebinding and enumeration flaws are described as server-side behavior, so isolating cameras on your own network may not address them; for cameras in critical facilities, plan replacement with devices from a vendor that responds to coordinated disclosure.
