CISA KEV October 2026: 36 Exploited Vulnerabilities Added So Far

CISA has added 36 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue so far in October, according to the catalogue's data feed as of its 30 October release. The newest, added on 30 October, are two Ivanti Connect Secure flaws that attackers chained with an earlier Ivanti zero-day.

CISA adds a flaw based on evidence of active exploitation, and its due dates bind only US federal civilian agencies, under Binding Operational Directive 26-04. In the feed, seven of October's 36 get 14 days instead of three, among them the Adobe, Brotli and VMware flaws.

30 October: Ivanti Connect Secure, again

Ivanti says attackers hit "a limited number of customers" by chaining CVE-2026-104935, the authentication bypass CISA listed on 13 October, with the two flaws below. Volexity, which found the attacks, traced the first exploitation to 3 October, on an appliance running 22.8R2.4.

• CVE-2026-111357, Ivanti Connect Secure: "missing authentication for a critical function" that lets a local, already logged-in attacker escalate privileges. Ivanti rates it CVSS 8.8. CISA gave agencies until 2 November.
• CVE-2026-118527, Ivanti Connect Secure: predictable filenames let a remote authenticated attacker upload files with attacker-controlled content to a known location on disk, rated CVSS 4.3, with a 13 November deadline.

Ivanti lists 25.1.1.2 and earlier and 22.8R2.5 and earlier as affected by both, and fixed them in 25.1.1.3 and 22.8R2.6, released on 29 October. Don't rely on Ivanti's Integrity Checker Tool to clear an appliance. CISA warned on 13 October that the tool "may not detect evidence of exploitation" because the attackers' commands run in memory. For appliances that may have been hit, CISA advises a factory reset and new passwords, certificates and API keys.

29 October: GitLab and Cisco ASA

• CVE-2026-97229, GitLab Community and Enterprise Edition: unauthenticated code execution on self-managed servers. Upgrade to 19.4.2, 19.3.5 or 19.2.8.
• CVE-2026-76418, Cisco Secure Firewall ASA and FTD: an unauthenticated attacker can make firewalls with SSL VPN and secondary authentication reload, per Cisco's advisory. For the fixed ASA and FTD releases and the interim mitigation, see the GitLab and Cisco ASA report, which also carries GitLab's detection rules.

28 October: the Linux kernel and VMware ESX

• CVE-2026-46300, Linux kernel: the Fragnesia bug, which CISA says can be chained with PHP2Shell "to implant PHP webshells and run commands as root". Attackers used that chain to root 25 Palo Alto firewalls and management servers. A server already patched for PHP still needs its distribution's kernel update, and the deadline for agencies is 31 October.
• CVE-2026-41709, VMware ESX: a malicious actor with admin access can "perform certain operations without being logged". Broadcom rated it CVSS 2.7 in advisory VMSA-2026-0006 in July, and the fixed builds are ESXi 9.1.0.0-25370933, 9.0.2.0100-25595025 and 8.0U3j-25429389, plus VCF 5.2.4.

27 October: Adobe Commerce and Google Brotli

• CVE-2026-48356, Adobe Commerce and Magento Open Source: an unrestricted file upload flaw rated 9.6, exploitable without logging in, fixed on 14 July in Adobe's bulletin APSB26-73. Commerce 2.4.4 to 2.4.9 and Magento Open Source 2.4.6 to 2.4.9 need the "-2026-jul" builds.
• CVE-2026-111497, Google Brotli: an unchecked return value flaw in the compression library. Fixed builds: see the Brotli patch list.

26 October: PHP2Shell

• CVE-2026-109618 and CVE-2026-109619, PHP: a memory corruption flaw and a stale request-state flaw that together allow remote code execution. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to CISA's 21 October warning on PHP. CISA listed both on 26 October. To find and patch exposed builds, follow the PHP2Shell check-and-patch guide; how the two flaws chain is in the PHP2Shell report.

23 October: Arista VeloCloud and Collabora in Nextcloud

• CVE-2026-114625, Arista VeloCloud Orchestrator: SQL injection in the on-premises orchestrator. It's being exploited, says Arista's advisory 0199. Fixed builds are 5.2.3.18, 6.1.3.10 and 6.4.2.12, and hosted orchestrators are already patched. CISA listed it on 23 October.
• CVE-2026-110447, Collabora Online Built-in CODE Server: OS command injection in richdocumentscode, the Nextcloud app that runs Collabora inside Nextcloud. The fix is richdocumentscode 26.4.303, and Collabora says disabling the app isn't enough: upgrade it or remove it. Standalone Collabora Online servers aren't affected. Admins were reporting web shells in a Nextcloud forum thread opened on 3 October, 11 days before Collabora published the advisory on 14 October. CISA added it in a second 23 October alert.

20 October: Plex, Siemens and SiteGuard

CISA added six flaws on 20 October.

• CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, Plex Media Server: the "Plex2Shell" chain. Together they let an unauthenticated attacker run code as the server process, and builds from 1.43.3.10861 on aren't affected. Plex says compromised servers have been used to run cryptocurrency miners and proxy software; the signs of compromise to look for are in the Plex2Shell report.
• CVE-2026-110936, Siemens Software Center: a DLL sideloading flaw open to an authenticated local attacker. Siemens advisory SSA-580366 points to active exploitation and fixes it in V4.0.9.8, which existing installs pick up on their next start.
• CVE-2026-106931, EG Secure Solutions SiteGuard Server Edition: command injection in the statistics feature of the Japanese web application firewall. The vendor's alert confirms exploitation, says the feature is on by default from Ver2.20, and gives Ver8.00 Update5 (Apache, Nginx, IIS) and Ver7.00 Update6 (FreeBSD) as fixed. The vendor says to save the diagnostic data first, because the update can erase traces of an attack.

16 October: BeyondTrust Remote Support

• CVE-2026-102764, BeyondTrust Remote Support: an authentication bypass that ARMORY CASTLE, a suspected China-nexus espionage group, exploited as a zero-day in late August, according to Mandiant's incident report. CISA tells self-hosted customers to apply the BT26-05-RS patch, upgrading first if they run a version older than 24.3.1. Who was hit, and what to do now, is in the BeyondTrust zero-day report.

14 October: firewalls, email gateways and backup servers

• CVE-2026-0322, Palo Alto Networks PAN-OS: code injection in the management interface. An authenticated attacker with network access can run code as root, says Palo Alto's advisory, which recommends limiting the interface to trusted internal addresses.
• CVE-2026-76519, Cisco Secure Email Gateway: a relative path traversal flaw. Cisco's advisory says its PSIRT learned of active exploitation in October. Fixed releases are AsyncOS 15.5.5-014 and 16.5.0-780; customers on 16.0 have to move to one of them.
• CVE-2026-105133 and CVE-2026-105134, AhsayCBS: an authentication bypass and a command injection flaw in the backup server. Ahsay's 12 October notice says its earlier v9.15.2.59 and v10.3.4.0 patches didn't fully fix them. Partners need hotfix v10.3.4.45 or v9.15.2.70, and the server has to be rebooted once it's applied.

13 October: Ivanti Connect Secure and Windows

• CVE-2026-104935, Ivanti Connect Secure: a zero-day authentication bypass. No credentials needed. CISA's Ivanti alert lists 25.1.1.1, 25.1.2.2 and 22.8R2.4 and earlier as affected and tells owners to update to the latest version.
• CVE-2026-96951, Microsoft Windows: a command injection flaw that lets a malicious file skip the Mark of the Web warning, patched in October's Patch Tuesday and added to KEV the same day as Ivanti.

8 October: five old flaws

None of these is new. They appear in CISA advisory AA26-281A among the bugs Chinese government-linked actors exploited, and all five went into the catalogue on 8 October:

• CVE-2015-3306, ProFTPD: improper access control.
• CVE-2015-5477, ISC BIND: a data processing error that crashes the name server.
• CVE-2016-3081, Apache Struts: command injection.
• CVE-2021-3199, ONLYOFFICE Docs: path traversal.
• CVE-2023-22894, Strapi: sensitive information stored in cleartext.

Also added this month

Six more flaws went in this month. For their fixed versions, check each vendor's advisory against CISA's catalogue entry:

• CVE-2026-104286, Fortinet FortiMail (1 October): unauthenticated file write through crafted HTTP requests.
• CVE-2026-102489 and CVE-2026-102490, Zammad (2 October): a session fixation flaw and a privilege flaw that chain to root on the help desk server.
• CVE-2026-88779, Citrix NetScaler ADC and Gateway (4 October): a memory buffer flaw that can cause a denial of service.
• CVE-2026-21589, Atlassian Data Center products (15 October): unauthenticated file reads from the web root of Bitbucket, Confluence, Jira, Bamboo and Crowd.
• CVE-2025-61624, Fortinet FortiOS, FortiPAM, FortiProxy and FortiSwitchManager (16 October): file writes and deletes by an admin with read-write rights.