Exploited in October: The Vulnerabilities CISA Says Attackers Are Using Now

The US Cybersecurity and Infrastructure Security Agency (CISA) adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when it has evidence that attackers are using it. The deadlines in the catalogue bind US federal agencies, but the list is widely used elsewhere as a short answer to the question of what to patch first.

October has been a busy month. These are the additions so far, grouped by the date CISA added them.

1 and 2 October: FortiMail and Zammad

• CVE-2026-104286, Fortinet FortiMail: a path traversal flaw in the email security appliance, added on 1 October.
• CVE-2026-102489 and CVE-2026-102490, Zammad: a session fixation flaw and an improper privilege management flaw in the open-source help desk platform, added on 2 October.

14 October: firewalls, email gateways and backup servers

• CVE-2026-0322, Palo Alto Networks PAN-OS: code injection in the management interface of PA-Series and VM-Series firewalls and Panorama. Exploitation requires an authenticated attacker with network access to the management interface.
• CVE-2026-76519, Cisco Secure Email Gateway: a relative path traversal flaw. Cisco's PSIRT said it became aware of active exploitation in October. Fixed releases are AsyncOS 15.5.5-014 and 16.5.0-780, and customers on 16.0 are advised to move to a fixed release.
• CVE-2026-105133 and CVE-2026-105134, AhsayCBS: an authentication bypass and a command injection flaw in the backup server, used together. Reported impacts include web shells and cryptocurrency mining. Fixed in v10.3.4.45 and v9.15.2.70; earlier v10.3.4 and v9.15.2.59 builds did not close the flaw.

All four had a federal deadline of 17 October, three days after they were added.

16 October: BeyondTrust Remote Support

• CVE-2026-102764, BeyondTrust Remote Support: an authentication bypass rated 9.3 on CVSS v4.0, exploited as a zero-day since 29 August. Mandiant attributes the activity to a suspected China-nexus espionage group it calls ARMORY CASTLE. Self-hosted appliances need the BT26-05-RS patch. Our full report.

20 October: Plex, Siemens and SiteGuard

• CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, Plex Media Server: the "Plex2Shell" chain, which its finder says allows remote code execution without credentials. Fixed in build 1.43.3.10861. Our full report.
• CVE-2026-110936, Siemens Software Center: a DLL sideloading flaw, reported as used in ClickFix attacks.
• CVE-2026-106931, EG Secure Solutions SiteGuard Server Edition: a command injection flaw in the Japanese web application firewall product. The vendor confirmed exploitation.

Not on the list yet

Two of the month's biggest stories were not in the catalogue as of 22 October. The PHP2Shell flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, are already drawing exploitation attempts, and fixed versions have been out since 21 October. Our report on PHP2Shell. Absence from KEV means only that CISA has not yet confirmed exploitation, not that a flaw is safe to leave.

How to use the list

For most organisations the practical step is to check the catalogue against an inventory of what is exposed to the internet: email gateways, firewalls, VPN and remote access appliances, backup servers and media servers. Products in that position are the ones attackers reach first, and several of this month's additions are exactly that kind of equipment.