OpenEFA Daily Threat Brief

October 16, 2026
SANS Threat Level: GREEN

Email Security Overview

2,107
Processed
1,057
Delivered
385
Quarantined
0
Rejected
18.3%
Block Rate
29.7
Avg Score

Threats Blocked by Category

385
Phishing
385
BEC
385
Impersonation
8
Backscatter

Top Spam Origin Countries

CountryBlockedShare
United States (US)31488.2%
United Kingdom (GB)195.3%
The Netherlands (NL)102.8%
Singapore (SG)72.0%
India (IN)61.7%

Based on emails that reached the content filter. MTA-level blocks (RBL, GeoIP) are not included.

Top Spam Sender Domains

DomainBlockedAvg ScoreVolume
dmarc.yahoo.com56-0.6
gmail.com1242.2
kbra.com7-0.3
microbiltmarketing.com737.0
safied.com590.5
email.repdailyred.com462.0
jewishworldreview.com480.9
e.myfilingservices.com318.7

Notable High-Score Threats

ScoreSenderSubject
164.115DHL <contact@[redacted]>DHL Electronic Proof of Delivery Request for conta
161.877"Adobe ShareFile | [redacted]"[[redacted]: New Sender] Complete with ShareFile: EFT
158.57[redacted] <postmaster@cactoine.sho[[redacted]: New Sender] 03970406-Survey Request for
154.914Maintain a healthy brain <support@select[[redacted]: New Sender] Natural antidote to memory l
153.823PayPal Rewards <offers1935707x76@mail.on[[redacted]: New Sender] 🎁 A PayPal Gift Card for you

CISA Known Exploited Vulnerabilities (New)

CVEVendor / ProductRansomware
CVE-2026-21589Atlassian Multiple Products
Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.
Unknown
CVE-2026-105134Ahsay AhsayCBS
Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.
Unknown
CVE-2026-76519Cisco Secure Email Gateway
Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
Unknown
CVE-2026-105133Ahsay AhsayCBS
Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.
Unknown
CVE-2026-0322Palo Alto Networks PAN-OS
Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
Unknown

Active Malicious URLs (URLhaus)

50
Active URLs
1
Threat Types
1
Unique Hosts

Top threat types:

unknown: 50

Email Threat IOCs (ThreatFox)

20 email-related indicators of compromise in the last 24 hours.

Malware FamilyIOCsSeverity
Vidar20High