27 Oct cloud incident (Global Search, Webhook, Identity Service): what do we know about the cause, and is anyone looking at the security side?

Hi everyone,

Creatio Support has confirmed an incident affecting Global Search, the Webhook Service and the Identity Service, and their teams are working on it. I’m not asking about the outage itself. I’d like to compare notes with other developers and partners on why it happened and whether there’s a security angle.

What we’re seeing on our cloud sites (DEV, UAT and PROD)

• Webhook Service: “Failed to get API key. Service connection error.” Landing-page form POSTs to the webhook endpoint return HTTP 400.
• Identity Service: OAuth discovery fails:
  Error while getting discovery for 'https://accounts.creatio.com' ... /.well-known/openid-configuration: Service Unavailable
  so ML scoring and other OAuth-based processes fail.
• File storage (not in the confirmed list): we can’t generate or open printables and attachments:
  The AWS Access Key Id you provided does not exist in our records. → (403) Forbidden

What I’d like to discuss

1. Root cause: Has anyone heard what took down several independent services at once? An infrastructure change, a credential/secret rotation, something external?
2. File storage: Are your sites also getting the S3 “invalid access key” error? An invalid key points to the storage credentials being rotated or revoked rather than a plain outage. Has anyone been told why?
3. Security angle: This month there have been reports of AI-agent attack campaigns (autonomous agents breaching around many company websites, and leaked secrets found on exposed attack panels). Does anyone think today’s incident is connected, or has anyone seen something that rules it out? I’m not claiming a link. The timing and the invalid-key error made me wonder.
4. Runtime patching: Does anyone know whether the Creatio cloud runtime picked up the October 2026 .NET security releases? What’s the patch status on your on-prem sites?
   
   • .NET out-of-band release, 25 Oct 2026 (8.0.33 / 9.0.22 / 10.0.14):
     
     • CVE-2026-111497: Brotli decompression buffer overflow (ASP.NET Core request decompression, HttpClient, System.IO.Compression)
     • CVE-2026-114148: Linux tarball ownership (local EoP)
     • CVE-2026-70197: SocketAsyncEventArgs memory corruption (re-released, the 13 Oct fix was incomplete)
     • CVE-2026-102870: Blazor WebAssembly debugger (re-released)
   • 13 Oct 2026 Patch Tuesday: ASP.NET Core updates KB5130034 / 5130035 / 5130036, reportedly including CVE-2026-70175 (ASP.NET Core Identity password reset).
   • .NET Framework 4.8 / 4.8.1 sites: the latest cumulative update I could confirm is 8 Sep 2026 (RCE CVE-2026-69522, EoP CVE-2026-62886). Has anyone seen an October rollup?
5. RCA: Has anyone been promised a post-incident report or an official status page for this?