Weekly Threat Roundup: VeloCloud Exploit, Camel Bugs (Oct 19–25)

This Week at a Glance

An actively exploited privilege escalation flaw in on-premises VMware VeloCloud Orchestrator (CVSS 9.9) tops this week’s risk list, while Apache Camel accounts for six of the ten tracked CVEs—including a 10.0-rated deserialization RCE. CISA added new flaws to its exploited-in-the-wild catalog and ordered federal agencies to patch Plex2Shell, Siemens, and SiteGuard issues. On the breach front, France’s Assurance Retraite confirmed 70,000 accounts exposed, and ransomware groups claimed AB InBev, TOPLIVO, and Heber City, UT.

Top Vulnerabilities

• CVE-2026-114625 (CVSS 9.9, critical, actively exploited): A privilege escalation issue in on-premises VeloCloud Orchestrator (VCO) that may allow a remote attacker to gain privileged access. Patch immediately—exploitation is confirmed.
• CVE-2026-78162 (CVSS 10.0, critical): Deserialization of untrusted data in Apache Camel (4.0.0 and later) enables remote code execution. A public PoC is circulating.
• CVE-2026-111058 (CVSS 9.8, critical): Mercury, a Python framework for sharing Jupyter notebooks as web apps, allows RCE without authentication prior to 3.2.6—dangerous for any internet-facing deployment.
• CVE-2026-107083 (CVSS 9.8, critical): SQL injection in SLiMS Bulian 9.8.0 admin modules can expose administrative data. A PoC is public.
• CVE-2026-111497 (CVSS 9.2, critical): Buffer overflow in Google Brotli’s decoder (1.0.3–1.2.0) can leak memory and carries RCE risk. Audit any service parsing untrusted Brotli content.
• Apache Camel cluster (CVSS 8.2–8.8): CVE-2026-78165 (Spring Redis deserialization RCE), CVE-2026-83531 (code injection), CVE-2026-80344 (AS2 SSRF), CVE-2026-80343 (Netty HTTP auth bypass), and CVE-2026-80312 (OAuth fail-open). Treat Camel as this week’s highest-priority patch cycle.

Data Breaches

• Assurance Retraite: The French pension organization confirmed roughly 70,000 accounts exposed, including names and Social Security numbers. SSN exposure elevates identity-fraud risk for affected retirees—monitor for follow-on phishing.

Threat Intelligence

• TOPLIVO: Ransomware group n0n claimed undisclosed records on October 25. Unverified—treat as a watch item.
• Heber City, UT: Qilin claimed undisclosed records from a municipal target. Government entities remain a favored Qilin victim class.
• AB InBev: Emperador claimed 3.2GB of records—the largest volume claimed this week. Verify before treating as confirmed.

Key Takeaway

Six of ten tracked CVEs this week hit a single integration framework—Apache Camel—spanning deserialization, code injection, SSRF, auth bypass, and fail-open OAuth. Attackers increasingly target middleware and integration layers rather than edge devices, because a single Camel instance often bridges trusted internal systems. If Camel runs in your environment, inventory it and patch as a batch; piecemeal fixes will leave gaps.