CISA KEV in October 2026: all 30 additions, 1–27 Oct

October 2026 was a busy month for CISA's Known Exploited Vulnerabilities catalog. Between 1 and 27 October, 30 CVEs were added, spanning backup servers, media servers, SD-WAN orchestrators, security appliances, an e-commerce platform, a compression library and the PHP interpreter itself. Most carry fresh 2026 identifiers; five are older, from 2015 to 2023, and were added together on 8 October alongside a nation-state advisory that documented them in active use.

This is the full list as CISA records it, with the catalog's own date-added and vulnerability names, followed by the patterns worth drawing out and links to our deep dives where we wrote one. The point of a roundup is triage: not every exploited CVE threatens you, so the table is there to be filtered against what you actually run and expose.

What CISA added

The rows below come from the KEV catalog and the October alert pages. Dates are the catalog's date-added.

Deep dives: Plex2Shell, Arista VeloCloud, AhsayCBS, php2shell, Node2Shell, Collabora CODE, Windows Shell, FortiMail, PAN-OS, Cisco Secure Email Gateway, Atlassian, Citrix NetScaler, Ivanti Connect Secure, BeyondTrust Remote Support, FortiOS CVE-2025-61624, PolyShell in Adobe Commerce and Magento, Siemens Software Center, SiteGuard Server Edition and Zammad.

Patterns this month

A few themes run through the list, and they are more useful for prioritising than the raw count.

Edge and management devices lead. Citrix NetScaler, Ivanti Connect Secure, the FortiMail and FortiOS entries, Cisco Secure Email Gateway, BeyondTrust Remote Support and Arista VeloCloud Orchestrator are all perimeter or control-plane systems. These sit where an attacker can reach them and often where an authentication weakness or file-write turns into a foothold. On an exposed estate, they are the rows to clear first.

File-path and injection bugs dominate. Path traversal appears for FortiMail, ONLYOFFICE Docs, Cisco Secure Email Gateway and the Fortinet multi-product entry; command or code injection for Apache Struts, Microsoft Windows Shell, PAN-OS, AhsayCBS, SiteGuard, Collabora CODE and PHP; and an unrestricted file upload for Adobe Commerce and Magento. The recurring shape is untrusted input reaching a file path or a command, which is worth remembering when you review your own code, not just when you patch someone else's.

Auth bypass keeps showing up in appliances. Ivanti Connect Secure, BeyondTrust Remote Support and AhsayCBS were all added with authentication-bypass or improper-authentication flaws, in two cases chained straight into code execution. Appliances that front sensitive services remain a favourite because one spoofed check can skip the whole login.

Chains, not single bugs. Several entries are explicitly chainable: the four Plex CVEs combine into the Plex2Shell remote-code-execution chain, the two Zammad bugs chain to RCE and then root, and the two AhsayCBS bugs chain from auth bypass to SYSTEM. KEV lists the components separately, so a one-line-per-CVE reading understates how they are actually used.

Older CVEs added on 8 October. Five entries dated 2015, 2016, 2021 and 2023 — ProFTPD, ISC BIND, Apache Struts, ONLYOFFICE Docs and Strapi — were added together on 8 October. They accompany the joint advisory AA26-281A on Chinese government-linked actors who pair large-scale scanning with hands-on exploitation, and CISA flagged them as newly added to KEV in that advisory's exploited-CVE table. There was no separate same-day KEV alert page, which is why they are easy to miss. Some of these affect open-source components that ship inside other products, so check your software bill of materials, not just named installs.

How to use this list

A KEV entry is a prioritisation signal with a deadline, not proof your instance is under attack. Our guide to prioritizing with KEV, EPSS and CVSS covers the full method; for this list, work in this order:

• Match against exposure. Internet-facing and unauthenticated entries first, then internal management tools, then workstation-class bugs. The Windows Shell command-injection entry matters, but a public NetScaler or VeloCloud Orchestrator matters sooner.
• Mind the chains. Where CISA lists several CVEs for one product, patch to the build that closes all of them rather than cherry-picking a single ID.
• Watch for incomplete fixes. The AhsayCBS entries are a reminder that an early patch build can fall short; confirm you are on a vendor-confirmed fixed version, not merely a newer one.
• Check components, not just products. The 8 October additions include libraries and servers embedded in other software. A clean list of installed applications can still hide a vulnerable dependency.

Where exploitation evidence is strong — a vendor statement, a named responder with indicators — treat the deadline as real and hunt as well as patch. Where it is thinner, the patch is usually still routine, so the cost of acting is low either way.

Beyond this month

The month's shape is the recurring one: perimeter devices, input-to-path-or-command bugs, and chains that read as separate CVEs. The practical response is a current inventory of what you expose and a way to confirm that a patch actually removed the weakness rather than renamed it. For how continuous testing catches that kind of exposure as code changes, see AI pentesting on every pull request.