CISA Known Exploited Vulnerability Catalog : October 2026

CISA KEV Catalog

CISA Known Exploited Vulnerability Catalog: October 2026 | Hive Pro Threat Digest

Threat Digest/CISA KEV/October 2026

CISA Known Exploited Vulnerability Catalog: October 2026

36 vulnerabilities met the criteria for inclusion in CISA's KEV catalog in October 2026, including 18 zero-days and 19 exploited by threat actors in attacks.

36 KEV additions18 zero-days19 actor-linkedBOD 26-04

Published

November 05, 2026

Period

October 2026

KEV additions

Zero-days

Actor-linked

Report type

Digest

Source

CISA KEV

Latest due date

November 13, 2026

Earliest due date

October 04, 2026

01 / Overview

Summary

The Known Exploited Vulnerability (KEV) catalog, maintained by CISA, is the authoritative source of vulnerabilities that have been exploited in the wild. It is recommended that all organizations review and monitor the KEV catalog, prioritize remediation of listed vulnerabilities, and reduce the likelihood of compromise by threat actors. In October 2026, 36 vulnerabilities met the criteria for inclusion in the CISA's KEV catalog. Of these, 18 are zero-day vulnerabilities; 19 have been exploited by a threat actor and employed in attacks.

02 / Catalog

Vulnerability Details

CVE ID	Name	Affected products / versions / CPE	CVSS	Due	Status / actor	CWE / TTPs	Patch
CVE-2026-118527	Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability	Ivanti Connect Secure: Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 `cpe:2.3:a:ivanti:connect_secure::::::::`	`4.3`	Nov 13 2026	Zero-day Actor: UTA0576	`CWE-340` `T1190` `T1105` `T1068`	Patch
CVE-2026-111357	Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability	Ivanti Connect Secure: Ivanti Connect Secure before version 25.1.1.3, and 22.8R2.6 `cpe:2.3:a:ivanti:connect_secure::::::::`	`7`	Nov 02 2026	Zero-day Actor: UTA0576	`CWE-306` `CWE-862` `CWE-345` `T1068` `T1071` `T1190`	Patch
CVE-2026-97229	GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability	GitLab Community Edition and Enterprise Edition: GitLab CE/EE all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 `cpe:2.3:a:gitlab:gitlab:::::community:::` `cpe:2.3:a:gitlab:gitlab:::::enterprise:::`	`10`	Nov 01 2026	–	`CWE-190` `T1190`	Patch
CVE-2026-76418	Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability	Cisco Secure Firewall ASA Software and Cisco Secure FTD Software: Cisco Secure Firewall ASA Software (Before 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 / 9.24.10.1); Cisco Secure Firewall Threat Defense (FTD) Software (Before 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, 10.1.1) `cpe:2.3:a:cisco:adaptive_security_appliance_software::::::::` `cpe:2.3:a:cisco:firepower_threat_defense::::::::`	`8.6`	Nov 01 2026	Zero-day	`CWE-690` `T1190` `T1499` `T1499.004`	Patch
CVE-2026-41709	Broadcom VMWare ESX Insufficient Logging Vulnerability	Broadcom VMware ESX: VMware Cloud Foundation 9.1.x.x, 9.0.x.x, 5.x before 5.2.4, VMware vSphere Foundation 9.1.x.x, 9.0.x.x, VMware ESX 9.1.x.x before ESXi-9.1.0.0-25370933, 9.0.x.x before ESXi- 9.0.2.0100-25595025, 8.0 before ESXi80U3j-25429389, VMware Telco Cloud Platform 5.1.x, 5.0.x `cpe:2.3:o:vmware:esxi::::::::` `cpe:2.3:a:vmware:cloud_foundation::::::::`	`2.7`	Nov 11 2026	Zero-day Actor: WARP PANDA	`CWE-778` `T1211` `T1562` `T1562.003` `T1078`	Patch
CVE-2026-46300	Linux Kernel Missing Initialization of a Variable Vulnerability	Linux Kernel: Linux Kernel (XFRM ESP-in-TCP / 'esp4', 'esp6', 'rxrpc' modules) – impacts AlmaLinux 8/9/10, AlmaLinux Kitten 10, Amazon Linux, CloudLinux, Debian, Fedora, Gentoo, openSUSE, Red Hat Enterprise Linux, SUSE, Ubuntu, and OpenShift `cpe:2.3:o:linux:linux_kernel::::::::`	`7.8`	Oct 31 2026	Celebrity: Fragnesia	`CWE-456` `T1068` `T1059`	Patch
CVE-2026-48356	Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability	Adobe Commerce and Magento: Adobe Commerce 2.4.9, 2.4.8- p5 and earlier, 2.4.7-p10 and earlier, 2.4.6-p15 and earlier, 2.4.5-p17 and earlier, 2.4.4-p18 and earlier, Adobe Commerce B2B 1.5.3, 1.5.2-p5 and earlier, 1.4.2-p10 and earlier, 1.3.4-p17 and earlier, 1.3.3-p18 and earlier, Magento Open Source, 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, 2.4.6-p15 and earlier, Adobe Commerce Events, 1.6.0 to 1.20.0 `cpe:2.3:a:adobe:commerce:-:::::::*`	`9.3`	Nov 10 2026	Celebrity: PolyShell	`CWE-434` `T1190` `T1105` `T1036` `T1036.008`	Patch
CVE-2026-111497	Google Brotli Unchecked Return Value Vulnerability	Google Brotli: Node.js (22.x before 22.23.4, 24.x before 24.22.1, 26.x before 26.12.1, and End-of-Life versions), Bun (before 1.4.4), Google Brotli (1.0.3 through 1.2.0) `cpe:2.3:a:nodejs:node.js::::::::` `cpe:2.3:a:google:brotli::::::::`	`9.8`	Nov 10 2026	Celebrity: Node2Shell/ HTTP2Shell/ Broccoli2Shell	`CWE-252` `CWE-787` `T1190` `T1059`	Patch 1 Patch 2 Patch 3 Patch 4
CVE-2026-109618	PHP Memory Corruption Vulnerability	PHP Group: PHP Group PHP (5.4 through 8.5.11) `cpe:2.3:a:php:php::::::::`	`9.8`	Oct 29 2026	Celebrity: PHP2Shell Actor: Lazarus	`CWE-416` `CWE-755` `CWE-824` `CWE-1325` `CWE-1419` `T1190` `T1059`	Patch
CVE-2026-109619	PHP Stale Internal Request-State Vulnerability	PHP Group: PHP Group PHP (5.4 through 8.5.11) `cpe:2.3:a:php:php::::::::`	`8.1`	Oct 29 2026	Celebrity: PHP2Shell	`CWE-416` `CWE-755` `CWE-824` `CWE-1325` `CWE-1419` `T1190` `T1059`	Patch
CVE-2026-114625	Arista VeloCloud Orchestrator SQL Injection Vulnerability	Arista VeloCloud Orchestrator: Arista VeloCloud Orchestrator (VCO) On-Prem (5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10, 6.4.x before 6.4.2.12) `cpe:2.3:a:arista:velocloud_orchestrator::::::::`	`9.9`	Oct 26 2026	Zero-day	`CWE-89` `T1190` `T1068`	Patch
CVE-2026-110447	Collabora Online –Built-in CODE Server OS Command Injection Vulnerability	Collabora Online – Built-in CODE Server: Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode) `cpe:2.3:a:collabora:collabora_online_-_built-in_code_server::::::nextcloud::*`	`9.8`	Oct 26 2026	Zero-day	`CWE-78` `T1190` `T1059` `T1059.004`	Patch
CVE-2026-106931	EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability	EG Secure Solutions SiteGuard Server Edition: SiteGuard Server Edition Affected Ver2.20 before Ver8.00 Update 5 (semver) for Apache httpd, Nginx, IIS, Apache httpd on FreeBSD, Nginx on FreeBSD `cpe:2.3:a:e-guardian:siteguard:::::server:apache::`	`7.8`	Oct 23 2026	–	`CWE-78` `T1068` `T1059` `T1059.004`	Patch
CVE-2026-96656	Plex Media Server External Control of File Name or Path Vulnerability	Plex Media Server: Plex Media Server (Before 1.43.3.10861) `cpe:2.3:a:plex:media_server::::::::myawesomeproxy`	`7.2`	Oct 23 2026	Celebrity: Plex2Shell Attack: XMRig	`CWE-73` `T1190` `T1129` `T1574`	Patch 1 Patch 2
CVE-2026-96655	Plex Media Server Server- Side Request Forgery (SSRF) Vulnerability	Plex Media Server: Plex Media Server (Before 1.43.3.10861) `cpe:2.3:a:plex:media_server::::::::myawesomeproxy`	`4.3`	Nov 03 2026	Celebrity: Plex2Shell Attack: XMRig	`CWE-918` `T1190` `T1550.001` `T1105`	Patch 1 Patch 2
CVE-2026-96654	Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability	Plex Media Server: Plex Media Server (Before 1.43.3.10861) `cpe:2.3:a:plex:media_server::::::::myawesomeproxy`	`6.5`	Oct 23 2026	Celebrity: Plex2Shell Attack: XMRig	`CWE-84` `T1190`	Patch 1 Patch 2
CVE-2026-96652	Plex Media Server Server- Side Request Forgery (SSRF) Vulnerability	Plex Media Server: Plex Media Server (Before 1.43.3.10861) `cpe:2.3:a:plex:media_server::::::::myawesomeproxy`	`4.3`	Nov 03 2026	Celebrity: Plex2Shell Attack: XMRig	`CWE-918` `T1190`	Patch 1 Patch 2
CVE-2026-110936	Siemens Software Center Uncontrolled Search Path Element Vulnerability	Siemens Software Center: Siemens Software Center All versions before V4.0.9.8 `cpe:2.3:a:siemens:software_ceplatformnter::::::::`	`6.7`	Nov 03 2026	Zero-day Attack: Romulus multi- ClickFix campaign	`CWE-427` `T1608` `T1608.001` `T1204` `T1204.004` `T1059` `T1059`	Patch 1 Patch 2
CVE-2026-102764	BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability	BeyondTrust Remote Support: ARMORY BeyondTrust Remote Support UNC5221, (26.2.3 and prior) `cpe:2.3:a:beyondtrust:remote_support::::::::`	`9.8`	Oct 19 2026	Zero-day Actor: CASTLE (aka WARP PANDA) Attack: SAWFLY BARECLAW	`CWE-290` `T1190` `T1059`	Patch
CVE-2025-61624	Fortinet Multiple Products Path Traversal Vulnerability	Fortinet Multiple Products: Fortinet FortiOS, FortiPAM, FortiProxy, FortiSwitch Manager `cpe:2.3:o:fortinet:fortios::::::::` `cpe:2.3:a:fortinet:fortiproxy::::::::` `cpe:2.3:o:fortinet:fortipam::::::::` `cpe:2.3:a:fortinet:fortiswitchmanager::::::::`	`6.5`	Oct 19 2026	Actor: CL-STA-0954 Attack: PEERSTITCH	`CWE-22` `T1190` `T1068`	Patch
CVE-2026-21589	Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability	Atlassian Multiple Products: Atlassian Bitbucket Data Center Version before 9.4.26,10.2.8, 10.5.1, Confluence Data Center Version before 9.2.26, 10.2.19, Jira Service Management Data Center Version before 5.12.40,10.3.26, 11.3.12, Jira Software Data Center Version before 9.12.40, 10.3.26,11.3.12, Bamboo Data Center Versions before 10.2.24,12.1.12, Crowd Data Center Version before 6.3.7, 7.0.3,7.1.7,7.2.4, Crucible Version before 4.9.15 and Fisheye Version before 4.9.15 `cpe:2.3:a:atlassian:bitbucket:::::data_center:::` `cpe:2.3:a:atlassian:confluence:::::data_center:::` `cpe:2.3:a:atlassian:jira_service_management:::::data_center:::` `cpe:2.3:a:atlassian:jira_software:::::data_center:::` `cpe:2.3:a:atlassian:bamboo:::::data_center:::` `cpe:2.3:a:atlassian:crowd:::::data_center:::` `cpe:2.3:a:atlassian:crucible::::::::` `cpe:2.3:a:atlassian:fisheye::::::::`	`7.5`	Oct 18 2026	–	`CWE-552` `T1190` `T1552`	Patch
CVE-2026-105134	Ahsay AhsayCBS Command Injection Vulnerability	Ahsay AhsayCBS: Ahsay AhsayCBS (v10 builds before hotfix 10.3.4.45) `cpe:2.3:a:ahsay:ahsaycbs::::::::`	`10`	Oct 17 2026	Zero-day Attack: XMRig	`CWE-77` `CWE-78` `T1190` `T1059`	Patch
CVE-2026-76519	Cisco Secure Email Gateway Relative Path Traversal Vulnerability	Cisco Secure Email Gateway: Cisco Secure Email Gateway (AsyncOS 15.5 before 15.5.5-014, 16.0 all releases, 16.5 before 16.5.0-780; Content Scanner Tools before 25.3.0.5525) `cpe:2.3:a:cisco:secure_email_gateway::::::::`	`9.8`	Oct 17 2026	Zero-day	`CWE-23` `T1190` `T1059` `T1068`	Patch
CVE-2026-105133	Ahsay AhsayCBS Improper Authentication Vulnerability	Ahsay AhsayCBS: Ahsay AhsayCBS (v10 builds before hotfix 10.3.4.45) `cpe:2.3:a:ahsay:ahsaycbs::::::::`	`7.3`	Oct 17 2026	Zero-day Attack: XMRig	`CWE-287` `T1190` `T1059`	Patch
CVE-2026-0322	Palo Alto Networks PAN- OS Code Injection Vulnerability	Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS 12.2 (Before 12.2.4), 12.1 (Before 12.1.4-h12, 12.1.7-h8, 12.1.10-h2), 11.2 (Before 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16), 11.1 (Before 11.1.4- h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3), 10.2 (Before 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12) on PA-Series, VM- Series and Panorama `cpe:2.3:o:palo_alto_networks:pan-os::::::::`	`7.2`	Oct 17 2026	Zero-day	`CWE-94` `T1190` `T1059` `T1068`	Patch
CVE-2026-104935	Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability	Ivanti Connect Secure: Ivanti Connect Secure (22.8R2.4 and prior; 25.1.1.1 on ISA6000/ISA8000; 25.1.2.2 and prior) `cpe:2.3:a:ivanti:connect_secure::::::::`	`8.6`	Oct 16 2026	Zero-day Actor: UTA0576	`CWE-290` `T1190` `T1059` `T1068`	Patch
CVE-2026-96951	Microsoft Windows Command Injection Vulnerability	Microsoft Windows: Windows 10 -11 26H2, Windows Server 2012, 2016, 2019, 2025, 2022, Outlook.com `cpe:2.3:a:microsoft:outlook_web:-:::::::` `cpe:2.3:o:microsoft:windows:::::::` `cpe:2.3:o:microsoft:windows_server:::::::*`	`8.8`	Oct 16 2026	Zero-day	`CWE-77` `T1059` `T1068`	Patch
CVE-2015-5477	ISC BIND Data Processing Errors Vulnerability	ISC BIND: ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 `cpe:2.3:o:juniper:junos::::::::`	`7.5`	Oct 11 2026	Actor: Flax Typhoon	`CWE-19` `T1499` `T1499.004` `T1588` `T1588.005`	Patch
CVE-2016-3081	Apache Struts Command Injection Vulnerability	Apache Struts: Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28 `cpe:2.3:o:huawei:agile_controller-campus_firmware:-:::::::` `cpe:2.3:h:huawei:agile_controller-campus:-:::::::`	`8.1`	Oct 11 2026	Actor: Flax Typhoon	`CWE-77` `T1588` `T1588.005` `T1190`	Patch
CVE-2023-22894	Strapi Cleartext Storage of Sensitive Information Vulnerability	Strapi: Strapi through 4.5.5 `cpe:2.3:a:strapi:strapi::::::::`	`4.9`	Oct 11 2026	Actor: Flax Typhoon	`CWE-312` `T1588` `T1588.005` `T1190` `T1212`	Patch
CVE-2021-3199	ONLYOFFICE Docs Server Path Traversal Vulnerability	ONLYOFFICE Docs: ONLYOFFICE Document Server before 5.6.3 `cpe:2.3:a:onlyoffice:document_server::::::::`	`9.8`	Oct 11 2026	Actor: Flax Typhoon	`CWE-22` `T1588` `T1588.005` `T1190`	Patch
CVE-2015-3306	ProFTPD Improper Access Control Vulnerability	ProFTPD: ProFTPD 1.3.5 `cpe:2.3:a:proftpd:proftpd:1.3.5:::::::*`	`10`	Oct 11 2026	Actor: Flax Typhoon	`CWE-284` `T1588` `T1588.005` `T1190`	Patch
CVE-2026-88779	Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability	Citrix NetScaler: Citrix NetScaler ADC and NetScaler Gateway 14.1 (Before 14.1-73.41), Citrix NetScaler ADC and NetScaler Gateway 13.1 (Before 13.1-64.28), Citrix NetScaler ADC 14.1-FIPS (Before 14.1-73.41 FIPS), Citrix NetScaler ADC 13.1-FIPS and 13.1-NDcPP (Before 13.1-37.282) `cpe:2.3:a:citrix:netscaler_application_delivery_controller::::::::` `cpe:2.3:a:citrix:netscaler_gateway::::::::` `cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::fips:::` `cpe:2.3:a:citrix:netscaler_application_delivery_controller:::::ndcpp:::`	`7.5`	Oct 07 2026	Zero-day	`CWE-119` `T1190` `T1059` `T1059.004` `T1105` `T1505`	Patch
CVE-2026-102490	Zammad GmbH Zammad Improper Privilege Management Vulnerability	Zammad GmbH: Zammad GmbH Zammad Affected 1.5.0 before 7.2.2 (semver) `cpe:2.3:a:zammad:zammad::::::::`	`7.8`	Oct 05 2026	Zero-day	`CWE-269` `T1190` `T1059` `T1059.004`	Patch
CVE-2026-102489	Zammad GmbH Zammad Session Fixation Vulnerability	Zammad GmbH Zammad: Zammad versions 6.3.0 to 6.5.4 `cpe:2.3:a:zammad:zammad::::::::`	`9.8`	Oct 05 2026	Zero-day	`CWE-384` `T1190` `T1539`	Patch 1 Patch 2
CVE-2026-104286	Fortinet FortiMail Path Traversal Vulnerability	Fortinet FortiMail: Fortinet FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, 7.2.0 through 7.2.9 `cpe:2.3:a:fortinet:fortimail::::::::`	`9.8`	Oct 04 2026	Zero-day	`CWE-22` `CWE-158` `T1190` `T1059`	Patch

03 / Actions

Recommendations

01
Patch Before the Due Date
Organizations should prioritize the vulnerabilities listed above and promptly apply patches to them before the due date provided.
02
Comply with BOD 26-04
It is essential to comply with Binding Operational Directive 26-04 provided by the Cybersecurity and Infrastructure Security Agency (CISA). This directive outlines the minimum cybersecurity standards that all federal agencies must follow to protect their organization from cybersecurity threats.
03
Use Affected-Product Data to Find Assets
The affected products listed in the report can help organizations identify assets that have been affected by KEVs, even without conducting a scan. These assets should be patched with priority to reduce the risk.

04 / Sources

References & Patch Links

https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Patch links for each CVE appear in the table above. Due Date is the CISA-recommended deadline for prioritizing remediation. Celebrity vulnerabilities are software vulnerabilities that have gained significant attention and been branded with catchy names due to their wide impact.

What Next?

At Hive Pro, it is our mission to detect the most likely threats to your organization and to help you prevent them from happening.

Book a Demo of HivePro