ISPsystem patches VMmanager 6 flaw without a CVE after FirstVDS breach

ISPsystem said on 20 October 2026 it had released security updates for the VMmanager 6 vulnerability behind the FirstVDS breach, with more updates promised on 22 October. No CVE identifier, affected build number or exploitation details were published, so operators must verify patches by installed build number rather than public vulnerability feeds.

• Patch released 20 October, further updates promised 22 October
• No CVE, affected build number or exploit mechanism disclosed
• ZoomEye query on 27 October matched 2,823 exposed VMmanager panels
• Vendor promised a detailed incident report in the following days