Microsoft disclosed CVE-2026-57989, a high-severity origin validation error in Chromium-based Edge that lets an unauthorized attacker disclose information over a network. The flaw is rated CVSS 7.4 and affects versions before 150.0.4078.99.
An unauthorized attacker could exploit the flaw to disclose information.
This indicates network attack vector, low attack complexity, no privileges required, user interaction required, changed scope, high confidentiality impact, and no integrity or availability impact.
Enterprise security teams should prioritize patching Edge to the 150.0.4078.99 release to mitigate the high confidentiality risk from this network-reachable flaw.
Tap a lens to see what this story means for you.
Liked this? The Brief brings you the whole day in tech, verified, every morning.
Two minutes, free forever. What's in The Brief →
See what’s happening right now
The Feed runs all day — short, verified briefs the moment they break.
Open the FeedFollow @thecircuitry_
Every story we publish, as it happens. No noise between.
Reader-supported
The Circuitry is a passion project I've always wanted to build, and I love the work behind it.
Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.
Any contribution is appreciated. If not, no pressure. Thanks for reading.
A newly published CVE (CVE-2026-116199, assigned by VulnCheck on Oct 25) covers a flaw in Snipe-IT's Google SSO login. Versions before 8.6.3 didn't check whether an account was deactivated, so a former user whose Google account was still active could sign back in with their old permissions, including admin. It only applies when Google SSO is on and usernames are email addresses, and Snipe-IT says default installs aren't affected. The fix shipped in v8.6.3 on June 15, and the latest release is v8.8.3. VulnCheck scores it 9.2 Critical (CVSS 4.0) and 8.1 High (CVSS 3.1), while Snipe-IT's advisory rates it Moderate. It isn't in CISA's KEV catalog, and no public exploit or attacks have been reported.
CISA has added CVE-2026-114625, a critical SQL injection bug in Arista VeloCloud Orchestrator, to its KEV catalog with an October 26 deadline. Fixed releases are 5.2.3.18, 6.1.3.10 and 6.4.2.12.
CISA added CVE-2026-110447, an OS command injection flaw in Collabora Online's built-in CODE server used within Nextcloud, to its Known Exploited Vulnerabilities catalog on October 23. It allows remote code execution; federal agencies must mitigate by October 26 under BOD 26-04.
Microsoft assesses that Storm-0940, a group it calls China-state aligned, was behind the ConnectWise Cloud Backup supply-chain compromise. Microsoft says the group used the open-source agentic AI framework ARTEX to abuse already-consented app identities to sign in to Microsoft 365 tenants, with follow-on Microsoft Graph activity in some of them.
Microsoft on Monday announced a new Voluntary Exit Offer for eligible employees in participating teams in the US, Canada, India and the UK at level 70 and below. Chief People Officer Amy Coleman's memo says it "builds on what we learned" from April's Voluntary Retirement Program. About 60,000 people, roughly a quarter of its 223,000 staff, are eligible, the company told GeekWire. A person familiar told CNBC that employees decide in December and leave Dec. 31. Some groups, including sales, aren't participating, and Microsoft says the offer doesn't replace layoffs.
