This Week in Business IT: 9 CVEs, Election Fraud Alerts

Crunchbase - 559,908 accounts exposed

Crunchbase disclosed a breach dated January 22, 2026, added to Have I Been Pwned on October 14. The exposed data includes email addresses, employers, job titles, names, phone numbers, physical addresses, and social media profiles. If your sales, business development, or recruiting staff have Crunchbase accounts, assume their professional details are now sitting in a dataset attackers will mine for convincing spear-phishing. Job titles and employer names are exactly what scammers need to craft a believable "urgent wire transfer from the CFO" email. Check staff emails against the breach, force a password reset for anyone who reused a Crunchbase password elsewhere, and remind your team that a well-worded email referencing their real job title isn't proof it's legitimate.

Sharecare - 318,185 accounts exposed

Sharecare's breach, dated August 12, 2026 and added to HIBP on October 12, is more sensitive: dates of birth, government issued IDs, marital status, gender, employer, job title, and physical address all appear in the dataset. If your company has offered Sharecare-based wellness programs as an employee benefit, this is a direct exposure of staff personal data, including identifiers useful for identity theft and benefits fraud. This isn't a HIPAA event on its own, but if health data flows through your benefits vendors you should revisit how that data is governed under your HIPAA compliance obligations. Notify HR, check which employees used Sharecare, and watch for follow-on phishing or fraudulent benefits claims.

Gîtes de France - 117,574 accounts exposed

This French vacation rental platform disclosed a breach dated May 16, 2026, added to HIBP on October 18, exposing booking details, emails, names, phone numbers, and addresses. For most Texas businesses this needs no action. It's worth a mention only if staff book corporate travel through the service, in which case a quick password check is sensible and nothing more.

CISA added nine vulnerabilities to its Known Exploited Vulnerabilities catalog this week, spanning remote access tools, firewalls, backup software, and Windows itself. Several federal due dates have already passed, which tells you how actively these are being used in the wild.

BeyondTrust Remote Support - authentication bypass (CVE-2026-102764)

Added October 16 with a federal due date of October 19. If you or your MSP use BeyondTrust for remote support sessions, this is an authentication bypass by spoofing, meaning an attacker can potentially impersonate a trusted session. Full details are in our BeyondTrust Remote Support guide. Patch now, not next maintenance window.

Fortinet - path traversal (CVE-2025-61624)

Also added October 16, due October 19. Path traversal on Fortinet products can let an attacker read files outside intended directories, a common stepping stone to credential theft. See the Fortinet FortiOS guide for affected versions. Given how often firewall appliances sit at your network edge, coordinate this patch through your network management provider this week.

Atlassian - files accessible to external parties (CVE-2026-21589)

Added October 15, due October 18. This one exposes internal files or directories to parties who shouldn't have access. If you run Atlassian products like Jira or Confluence on-prem, check your admin console for the patch now; the due date has passed.

Ahsay AhsayCBS - command injection and improper authentication (CVE-2026-105134, CVE-2026-105133)

Both added October 14, due October 17. Backup software is a high-value target because compromising it can give an attacker access to everything you're trying to protect. Details are in the AhsayCBS guide. If Ahsay is part of your backup chain, patch immediately and verify your backups weren't tampered with during the exposure window.

Cisco Secure Email Gateway - path traversal (CVE-2026-76519)

Added October 14, due October 17. Covered in the Cisco Secure Email Gateway guide. Email gateways sit at a chokepoint for your inbound mail; treat this patch as urgent if you run this appliance.

Palo Alto Networks PAN-OS - code injection (CVE-2026-0322)

Added October 14, due October 17. Full writeup at the PAN-OS guide. Code injection on a firewall operating system is as serious as it sounds. Confirm your PAN-OS version against the fix.

Ivanti Connect Secure - authentication bypass (CVE-2026-104935)

Added October 13, due October 16, already past due. See the Ivanti Connect Secure guide. Ivanti VPN products have been a recurring target over the past two years; if you haven't patched this one yet, assume it's being probed.

Microsoft Windows - command injection (CVE-2026-96951)

Added October 13, due October 16. Our Windows command injection guide has the specifics. For the full rated list of current Windows and macOS vulnerabilities, bookmark our vulnerability tracker and check it weekly rather than waiting for a single post.

Election-season threats target officials, campaigns, and voters

The FBI's Internet Crime Complaint Center issued four separate advisories this week ahead of the November 2026 midterms: one on techniques used against election and campaign officials, one on scammers exploiting the midterms for fraud, one warning voters about election crimes, and one on threats to election workers. If you run a county government contractor, a campaign vendor, or employ anyone involved in election administration, read all four and brief your team. For most other Texas businesses, there's no direct operational action required, but it's worth a reminder in your next staff email: election-themed phishing (fake donation requests, "verify your voter registration" links, urgent calls claiming to be from election offices) tends to spike during midterm season and lands in general inboxes, not just campaign offices.

Patch the nine CVEs above in order of federal due date, starting with anything already past deadline. Run your staff emails through HIBP to see who's exposed from Crunchbase or Sharecare. Brief your team on election-themed phishing even if you're not in that business. If you don't have a process for tracking new KEV entries against your own environment, that's a gap a vulnerability assessment will surface quickly, and ongoing threat monitoring will catch exploitation attempts before they become an incident response call.

For the fundamentals behind all of this, patch cadence, breach response, phishing recognition, visit LayerLogix Academy. If you want a straight answer on where your own environment stands against this week's list, start with a free IT assessment.