Sécurité IT 2026-10-14

Niveau Critique — 95/100 — 2026-10-14

Journée « Critique » : 12 sujets classés, 6 des 10 premiers signalés comme activement exploités, 6 failles ajoutées au catalogue des vulnérabilités exploitées de la CISA. En tête : Cisco Secure Email Gateway Relative Path Traversal Vulnerability (86/100).

1. Cisco Secure Email Gateway Relative Path Traversal Vulnerability — 86/100 (CVE-2026-76519)
2. Palo Alto Networks PAN-OS Code Injection Vulnerability — 82/100 (CVE-2026-0322)
3. Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability — 79/100 (CVE-2026-104935)
4. Ahsay AhsayCBS Command Injection Vulnerability — 68/100 (CVE-2026-105134)
5. Microsoft Windows Command Injection Vulnerability — 66/100 (CVE-2026-96951)
6. Ahsay AhsayCBS Improper Authentication Vulnerability — 60/100 (CVE-2026-105133)
7. CVE-2026-89068 — Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). — 38/100 (CVE-2026-89068)
8. CVE-2026-89073 — Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. — 38/100 (CVE-2026-89073)
9. CVE-2020-37282 — office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execut… — 36/100 (CVE-2020-37282)
10. CVE-2026-110635 — webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers th… — 36/100 (CVE-2026-110635)