Welcome to the October 2026 edition of the MEDITECH Customer Security Newsletter. This month, we provide critical updates on vulnerabilities added to federal catalogs and strategic intelligence on threat actors targeting essential infrastructure. Our goal is to provide you with actionable information and resources to strengthen your organization's security posture. This data has been gleaned from the review of public records on file with CISA, H-ISAC and Health Sector Cybersecurity Coordination Center (HC3) alerts. Please note the Talk To Us section, as we would like to tailor future editions of the newsletter to address specific concerns.
Known Exploited Vulnerabilities
Between September 9, 2026 October 5, 2026, CISA added 34 items to its "Known Exploited Vulnerabilities" catalog based on definitive evidence of active exploitation in the wild.
| CVE Record | Targeted Product | Attack Type |
|---|---|---|
| Zammad GmbH Zammad | Session Fixation | |
| Zammad GmbH Zammad | Improper Privilege Management | |
| Fortinet FortiMail | Path Traversal | |
| Cisco Catalyst SD-WAN Manager | Improper Handling of URL Encoding | |
| Apple Multiple Products | Out-of-Bounds Write | |
| Citrix NetScaler | Improper Input Validation | |
| Citrix NetScaler | Improper Restriction of Operations within the Bounds of a Memory Buffer | |
| WordPress Core | Remote File Inclusion | |
| Microsoft SharePoint | Code Injection | |
| Mikrotik RouterOS | Improper Enforcement of Behavioral Workflow | |
| Adobe Commerce and Magento | Incorrect Authorization | |
| WSO2 Multiple Products | Path Traversal | |
| Check Point Multiple Products | Improper Certificate Validation | |
| Check Point Multiple Products | Path Traversal | |
| F5 BIG-IP APM | Heap-based Buffer Overflow | |
| Arista VeloCloud Orchestrator | Improper Input Validation | |
| Zyxel GS1900 Series Switches | Stack-Based Buffer Overflow | |
| Linux Kernel | Improper Check for Unusual or Exceptional Conditions | |
| Linux Kernel | Out-of-Bounds Write | |
| Linux Kernel | Race Condition | |
| Acronis Backup | Incorrect Default Permissions | |
| Cisco Identity Services Engine | Incorrect Use of Privileged APIs | |
| Google Pixel | Improper Authorization | |
| Cisco Secure Email Gateway | SQL Injection | |
| GitLab Community Edition and Enterprise Edition | Path Traversal | |
| JFrog Artifactory | Improper Authentication | |
| JFrog Artifactory | Incorrect Authorization | |
| ConnectWise ScreenConnect | Improper Privilege Management and Missing Authorization | |
| MikroTik RouterOS | Missing Authentication for Critical Function | |
| MikroTik RouterOS | Improper Neutralization of Argument Delimiters in a Command | |
| Cisco Firewall Management Center | Authentication Bypass Using an Alternate Path | |
| Google Chromium V8 | Out of Bounds Write | |
| Fortinet Multiple Products | Heap-based Buffer Overflow | |
| Citrix NetScaler | Authentication Bypass |
Threat Actor Spotlight: Black Basta Ransomware
First identified in April 2022, Black Basta is a prolific ransomware-as-a-service (RaaS) organization that aggressively targets critical infrastructure, with a strong operational focus on healthcare and public health (HPH) organizations across North America and Europe. Operating a double-extortion scheme, the group exfiltrates sensitive patient and operational data before deploying file encryption, using the threat of public leaks on dark web forums to compel ransom payments.
- Targeting Strategy: Black Basta prioritizes healthcare providers due to their dependence on continuous operations and protected health information (PHI) confidentiality. Disrupting clinical operations and threatening public exposure of patient records creates severe leverage for extortion.
- Initial Access & Loaders: The group primarily achieves entry via targeted spear-phishing emails containing malicious links that drop archive files with deceptive [.lnk] shortcuts. These payloads deploy secondary loaders like Qakbot or SystemBC to establish persistent backdoor communication.
- Privilege Escalation & Evasion: Following initial access, operators conduct reconnaissance using Cobalt Strike and abuse open-source utilities like [nircmd.exe] and [nsudo.exe] alongside Mimikatz to escalate system privileges. To inhibit security monitoring, attackers execute custom batch scripts to disable antivirus software, while maintaining persistence through autorun registry keys and scheduled tasks.
- Impact & Execution: Black Basta operators exhibit a typical loiter time of 2 to 3 days before moving files off-network via RClone. During final execution, the ransomware binary deletes volume shadow copies, appends
.bastato encrypted files, replaces the desktop wallpaper, and leavesreadme.txtransom demands across endpoints. - Proactive Defense: Healthcare IT administrators should deploy anti-spoofing email controls, enforce multi-factor authentication (MFA), restrict execution of unauthorized administrative utilities (
nircmd/nsudo), enable Windows Credential Guard, and maintain immutable offline backups.
News
Securing the New Perimeter: CISA and NIST Unveil Framework to Stop Cloud Token Attacks
Inside Microsoft's Takedown of EvilTokens: How AI Chatbots Are Automating Corporate Fraud
Additional Resources
- HHS 405(d) Aligning Health Care Industry Security Approaches - The 405(d) Program and Task Group is a collaborative effort between industry and the federal government, which aims to raise awareness, provide vetted cybersecurity practices, and move healthcare organizations towards consistency in mitigating the current most pertinent cybersecurity threats to the sector. Their website provides the latest resources and information as well as an opportunity for involvement.
- Helpful resources CISA has provided can be found on the following pages:
Talk to us!
We at MEDITECH would love to hear your feedback about this newsletter, and we’d like to know what is on your mind. Is there something you would like us to address?
We also have a question for you that is important to us. What are your largest concerns or security hopes for 2026?
Please let us know by contacting us!
Until next time, stay alert out there!