October 2026 Exploited Vulnerabilities: The CISA KEV List, Ranked for Remediation

CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog in October 2026, and two more on November 3 and 4 (CISA KEV feed, catalog version 2026.11.04). CISA lists an entry only when it has evidence of exploitation. The federal deadlines are short: under BOD 26-04, issued June 10, 2026, entries marked for forensic triage must be fixed within three days, and the affected system checked for compromise. Of these 38 entries, 25 are marked for forensic triage and 30 carry a three-day deadline.

Not every entry matters to every business. The October 2026 exploited vulnerabilities a mid-size US company should look at first are a chain of zero-days in Ivanti Connect Secure, two email security gateways, a Windows zero-day that can be delivered as a crafted email or message attachment, WordPress core, and a supply-chain attack that reached Microsoft 365 tenants through a backup vendor’s app. This roundup ranks them by business risk, lists every addition, and says what to patch first.

If you want this triage done every month, our vulnerability management service ranks findings using the KEV catalog, EPSS and internet exposure, from $1,500 per validated scan.

October 2026 exploited vulnerabilities at a glance

• What happened: 36 KEV additions, the largest Patch Tuesday on record, exploited zero-days in a VPN and two email gateways, and an attack on Microsoft 365 tenants through a managed service provider (MSP) tool.
• Who is affected: anyone running internet-facing VPNs, email gateways, firewalls, remote-support or DevOps platforms; WordPress and PHP sites; and Microsoft 365 tenants that connected ConnectWise Cloud Backup (formerly SkyKick).
• What to do: work through the list below, internet-facing systems first, and confirm each fix took.

What to patch first

1. Ivanti Connect Secure. Patch now. If you suspect compromise, follow CISA’s reset steps, not only the upgrade.
2. FortiMail and Cisco Secure Email Gateway. Both allow unauthenticated file writes, and both were exploited.
3. The Windows October cumulative update (CVE-2026-96951), with Exchange servers and domain controllers first.
4. PHP, WordPress core 7.1.4 and Adobe Commerce.
5. Firewall, VPN and ADC fixes: PAN-OS management interface, Cisco ASA and FTD SSL VPN, NetScaler with SAML, VeloCloud Orchestrator.
6. BeyondTrust Remote Support, Atlassian Data Center, GitLab, AhsayCBS and Collabora CODE.
7. A Microsoft 365 app review if ConnectWise Cloud Backup (SkyKick) was ever connected to your tenant.
8. Everything else on the list, including the old CVEs added on October 8.

CISA KEV October 2026: every addition, October 1 to November 4

Date added	CVE	Vendor and product	Weakness	Federal due date
Oct 1	CVE-2026-104286	Fortinet FortiMail	Path traversal (unauthenticated file write)	Oct 4
Oct 2	CVE-2026-102489	Zammad	Session fixation leading to code execution	Oct 5
Oct 2	CVE-2026-102490	Zammad (DEB/RPM packages)	Privilege escalation to root	Oct 5
Oct 4	CVE-2026-88779	Citrix NetScaler ADC and Gateway	Memory overflow (denial of service)	Oct 7
Oct 8	CVE-2015-5477	ISC BIND	Denial of service (TKEY)	Oct 11
Oct 8	CVE-2016-3081	Apache Struts	Command injection	Oct 11
Oct 8	CVE-2023-22894	Strapi	Cleartext storage of sensitive data	Oct 11
Oct 8	CVE-2021-3199	ONLYOFFICE Docs	Path traversal	Oct 11
Oct 8	CVE-2015-3306	ProFTPD	Improper access control (mod_copy)	Oct 11
Oct 13	CVE-2026-104935	Ivanti Connect Secure	Authentication bypass by spoofing	Oct 16
Oct 13	CVE-2026-96951	Microsoft Windows Shell	Mark of the Web bypass (command injection)	Oct 16
Oct 14	CVE-2026-0322	Palo Alto Networks PAN-OS	Code injection (management interface, authenticated)	Oct 17
Oct 14	CVE-2026-76519	Cisco Secure Email Gateway	Path traversal (file write as root)	Oct 17
Oct 14	CVE-2026-105133	Ahsay AhsayCBS	Improper authentication	Oct 17
Oct 14	CVE-2026-105134	Ahsay AhsayCBS	Command injection	Oct 17
Oct 15	CVE-2026-21589	Atlassian Data Center (8 products)	Unauthenticated file access	Oct 18
Oct 16	CVE-2025-61624	Fortinet FortiOS, FortiPAM, FortiProxy, FortiSwitchManager	Path traversal (admin required)	Oct 19
Oct 16	CVE-2026-102764	BeyondTrust Remote Support	Authentication bypass by spoofing	Oct 19
Oct 20	CVE-2026-106931	EG Secure Solutions SiteGuard Server Edition	OS command injection	Oct 23
Oct 20	CVE-2026-96652	Plex Media Server	Server-side request forgery	Nov 3
Oct 20	CVE-2026-96654	Plex Media Server	Encoded URI scheme handling	Oct 23
Oct 20	CVE-2026-96655	Plex Media Server	Server-side request forgery	Nov 3
Oct 20	CVE-2026-96656	Plex Media Server	External control of file path	Oct 23
Oct 20	CVE-2026-110936	Siemens Software Center	DLL search path	Nov 3
Oct 23	CVE-2026-114625	Arista VeloCloud Orchestrator (on-premises)	SQL injection	Oct 26
Oct 23	CVE-2026-110447	Collabora Online built-in CODE server	OS command injection	Oct 26
Oct 26	CVE-2026-109618	PHP (PHP2Shell)	Memory corruption	Oct 29
Oct 26	CVE-2026-109619	PHP (PHP2Shell)	Stale request state	Oct 29
Oct 27	CVE-2026-48356	Adobe Commerce and Magento	Unrestricted file upload	Nov 10
Oct 27	CVE-2026-111497	Google Brotli	Unchecked return value (out-of-bounds write)	Nov 10
Oct 28	CVE-2026-41709	Broadcom VMware ESX	Insufficient logging	Nov 11
Oct 28	CVE-2026-46300	Linux kernel	Missing initialization (chains with PHP2Shell, per CISA)	Oct 31
Oct 29	CVE-2026-97229	GitLab CE/EE	Integer overflow leading to code execution	Nov 1
Oct 29	CVE-2026-76418	Cisco Secure Firewall ASA and FTD	NULL pointer dereference (SSL VPN denial of service)	Nov 1
Oct 30	CVE-2026-111357	Ivanti Connect Secure	Missing authentication for critical function (root)	Nov 2
Oct 30	CVE-2026-118527	Ivanti Connect Secure	Predictable file names (file upload)	Nov 13
Nov 3	CVE-2026-119977	WordPress Core	Race condition during core upgrades	Nov 6
Nov 4	CVE-2024-27834	Apple (multiple products)	Pointer authentication bypass	Nov 18

• The known ransomware use field reads “Unknown” for every entry.
• Federal deadlines bind federal civilian agencies. For everyone else, CISA’s guidance is to use the catalog as one input to your own vulnerability prioritization (CISA).
• For comparison, September 2026 had 43 additions.

Ivanti Connect Secure zero-day chain (CVE-2026-104935, CVE-2026-111357, CVE-2026-118527)

Volexity reported on October 13 that a previously unknown actor it tracks as UTA0576 had been exploiting Ivanti Connect Secure since October 3, 2026. The victim appliance ran 22.8R2.4 and was fully patched. The attacker installed no web shell. It sent each command through the exploit chain itself, which leaves little on disk.

Once inside, the attacker went after Active Directory. It extracted stored domain credentials, used the appliance’s service account to query for LAPS passwords, BitLocker recovery keys and password-bearing attributes, ran Kerberoasting and password spraying, captured LDAP traffic and edited the appliance’s debug and audit logs.

CVE	What it allows	CVSS	Fix	Added to KEV
CVE-2026-104935	Unauthenticated authentication bypass leading to command execution	8.6	Patched October 13	Oct 13
CVE-2026-111357	Privilege escalation to root	7.0	Patched October 29, per Volexity	Oct 30
CVE-2026-118527	Authenticated upload of files to a predictable location	4.3	25.1.1.3 and 22.8R2.6	Oct 30

CISA’s revised alert lists 25.1.1.2 and earlier, 25.1.2.2 and earlier, and 22.8R2.5 and earlier as affected. The individual CVE records differ on some builds, so take the current fixed release for your branch from Ivanti’s advisory. Version 22.8 reaches end of life on January 31, 2027.

CISA warns that Ivanti’s Integrity Checker Tool may not detect CVE-2026-104935, because the attacker’s commands run in memory. If you suspect compromise, CISA’s steps are:

1. Back up the configuration.
2. Factory reset and upgrade (rebuild cloud and virtual appliances).
3. Restore the configuration.
4. Reset passwords for all domain, administrator and local accounts, revoke and reissue stored certificates, and reset stored API keys and license-server credentials.

Detection. Volexity’s indicators include a high volume of requests to the public login handler, mismatches between the requested URL path and the internal handler path, unexpected files in /tmp and gaps in the appliance logs. On the network, look for unusual LDAP queries from the appliance’s service account to domain controllers.

The question that matters after this chain is what a stolen VPN service account can read. Our Active Directory security assessment answers it from one standard user account, from $6,000 with a free retest, and our Active Directory hardening checklist covers LAPS, Kerberoasting and service-account settings.

October 2026 Patch Tuesday: a record month and CVE-2026-96951

Microsoft’s October 13 release fixed more than 1,400 CVEs: Tenable counts 1,407 and BleepingComputer 1,411. SecurityWeek notes that this one month exceeds Microsoft’s total for all of 2025 and links the rise largely to AI-driven discovery. Counts of zero-days differ (two per Tenable, three per BleepingComputer), but one was exploited.

CVE-2026-96951 is a Windows Shell security feature bypass, CVSS 8.8. A crafted file sent by email or instant message can evade Mark of the Web, the tag Windows uses to show the “downloaded from the internet” warning and to open Office files in Protected View. The user still has to open the file. CISA added it to KEV the same day, and Microsoft has published no attack details. Microsoft’s acknowledgments for it include Benoit Sevens, credited as using Claude with Anthropic.

Two critical bugs deserve priority even though they are not known to be exploited. Exchange Server CVE-2026-70571 (CVSS 8.1, rated “Exploitation More Likely”) can be reached by an unauthenticated attacker with a crafted email. Active Directory Domain Services CVE-2026-70229 (CVSS 8.1) can be reached with a crafted network packet. Microsoft rates attack complexity high for both.

What to do:

• Deploy the October cumulative updates, Exchange servers and domain controllers first.
• Block archive, ISO and LNK attachments at the mail gateway where the business allows it.
• Enforce Attack Surface Reduction rules on endpoints.

A phishing simulation is a reasonable place to check this in practice: send a harmless test file and confirm it arrives with Mark of the Web and triggers the warning. Our phishing testing starts at $3,600.

Email security gateways: FortiMail and Cisco

Both gateways sit on the internet by design, and both bugs let an unauthenticated attacker write files on the appliance.

	FortiMail	Cisco Secure Email Gateway
CVE	CVE-2026-104286	CVE-2026-76519
CVSS	9.8	9.8
How it is reached	Crafted HTTP or HTTPS requests	An email with a crafted attachment
Vulnerable when	8.0.0 to 8.0.1, 7.6.0 to 7.6.6, 7.4.0 to 7.4.8, 7.2.0 to 7.2.9, all of 7.0	File Reputation (AMP) is enabled on a mail policy and Content Scanner Tools is older than 25.3.0.5525
Fixed in	8.0.2, 7.6.7, 7.4.9; 7.2.10 upcoming; 7.0 must migrate	15.5.5-014, 16.5.0-780, or Content Scanner Tools 25.3.0.5525; 16.0 must migrate
Added to KEV	October 1	October 14

FortiMail vulnerability CVE-2026-104286

Fortinet’s advisory FG-IR-26-175 says the path traversal has been reported as exploited in the wild. FortiMail Cloud was fixed on October 5. Until you can upgrade, disable the IBE (Identity-Based Encryption) service, keep webmail off the internet, and, if a WAF sits in front, block POST requests to /ibe that contain traversal sequences. Fortinet’s indicators include a root cron job referencing /migadmin, an archive account added through the CLI that sends archives to a remote server, and IBE decrypter errors about invalid Base64.

Cisco Secure Email Gateway vulnerability CVE-2026-76519

A crafted attachment can write files and run commands as root (Cisco advisory). Cisco confirmed exploitation in October. Check the Content Scanner Tools version with the contentscannerstatus command; the update needs no restart. If an appliance may be compromised, Cisco says to record forensic data before upgrading, because the upgrade destroys it.

Firewalls, VPNs and ADCs

Product	CVE	Exposed when	Fixed in	KEV
Palo Alto PAN-OS	CVE-2026-0322 (CVSS 4.0: 8.6)	An authenticated attacker can reach the management interface; result is code execution as root	12.2.4, 12.1.10-h2, 11.2.16, 11.1.16-h3, 10.2.18-h12, plus hotfixes in the advisory	Oct 14
Cisco ASA and FTD	CVE-2026-76418 (8.6)	SSL VPN is enabled and a tunnel group, including DefaultWEBVPNGroup, uses secondary authentication; result is a reload	See Cisco’s table per release train	Oct 29
Citrix NetScaler ADC and Gateway	CVE-2026-88779 (CVSS 4.0: 8.7)	SAML is configured; result is denial of service	14.1-73.41, 13.1-64.28, 13.1-37.282	Oct 4
Arista VeloCloud Orchestrator	CVE-2026-114625 (9.9)	On-premises; any authenticated user can become a superuser operator	5.2.3.18, 6.1.3.10, 6.4.2.12	Oct 23
SonicWall SMA1000	CVE-2026-102255	Pre-authentication server-side request forgery in the WorkPlace interface	Hotfix 12.4.3-03670 or 12.5.0-03082 and later	Not in KEV

• PAN-OS. Palo Alto reports very limited exploitation and no workaround (advisory). Restrict management access to trusted internal addresses or a jump box. Cloud NGFW and Prisma Access are not affected.
• ASA and FTD. No VPN login is needed to reach the bug, and Cisco saw exploitation in October (advisory).
• NetScaler. Citrix (CTX697174) describes denial of service only. BleepingComputer reported log entries showing download attempts alongside crashes; whether more than denial of service is possible is unconfirmed. If you upgraded for CVE-2026-88771 to CVE-2026-88778, you need to upgrade again.
• VeloCloud. Arista has already patched hosted orchestrators (advisory); on-premises customers must upgrade.
• SMA1000. SonicWall saw no exploitation at release on October 7 (SNWLID-2026-0017). Help Net Security reported that Defused saw exploitation attempts from October 8; whether any succeeded is unknown.

Cisco Catalyst SD-WAN Manager CVE-2026-76504, an unauthenticated route to admin access, went into KEV just before the month began, on September 30.

All of these are internet-facing by role. An external network penetration test inventories exposed VPN portals, management interfaces and gateways and checks their versions, from $4,200 with a free retest. Our guide to external attack surface management covers keeping that inventory current between tests.

Remote access, backup and DevOps platforms

BeyondTrust Remote Support CVE-2026-102764

The flaw lets an attacker perform file operations on the appliance (CVSS 4.0: 9.3, version 26.2.3 and earlier). SaaS customers were patched by October 9. Self-hosted versions 24.3.1 to 26.2.3 need the BT26-05-RS patch; older versions must upgrade first (Canadian Centre for Cyber Security). Rapid7 reports that BeyondTrust dates two known compromises, one SaaS and one self-hosted, to August 29, 2026, and that a public exploit module now exists.

Atlassian Data Center CVE-2026-21589

An unauthenticated attacker can read specific files in the web root of eight Data Center products, including Jira, Confluence, Bitbucket and Crowd (CVSS 4.0: 9.3). Cloud is already patched (Atlassian). Help Net Security reported attempts about a day after the October 5 advisory, and watchTowr showed that reading Crowd’s configuration file can lead to admin access.

GitLab CVE-2026-97229

A crafted regular expression in CI/CD configuration can give an unauthenticated user code execution on the server (CVSS 10.0). It is fixed in 19.2.8, 19.3.5 and 19.4.2, released October 12 (GitLab). On October 23, Ruby released 4.0.9, 3.4.12 and 3.3.13 with related fixes. Any Ruby application that compiles a regular expression from attacker-controlled input is exposed, and Regexp.timeout does not help.

Also exploited

• AhsayCBS (CVE-2026-105133 and -105134): fixed in hotfixes 9.15.2.70 and 10.3.4.45. The first v10 fix was incomplete. Huntress saw JSP web shells and a cryptominer from October 7.
• Collabora built-in CODE server for Nextcloud (CVE-2026-110447): fixed in 26.4.303; standalone Collabora servers are not affected. Users reported finding web shells.
• Zammad (CVE-2026-102489 and -102490): versions 6.5 and older are out of support and exposed to the code execution bug. Follow Zammad’s advisory.
• VMware ESX (CVE-2026-41709): lets an administrator perform some operations without them being logged. Its KEV listing suggests attackers who already hold hypervisor admin rights are using it to stay out of the logs.

WordPress and e-commerce

WordPress 7.1.4 and CVE-2026-119977

Predictable, web-reachable staging paths during full core upgrades let an unauthenticated attacker run code during the upgrade window. It affects WordPress 4.7 through 7.1.3 and is scored CVSS 8.1 by Wordfence (CVE record). WordPress 7.1.4 fixed it on October 28, with fixes being backported to branches back to 4.7. CISA added it to KEV on November 3 with a November 6 deadline. The same release credits Anthropic for two stored cross-site scripting reports.

Rank Math SEO PRO 3.0.123 backdoor (CVE-2026-111862)

Rank Math PRO 3.0.123 packages fetched between 20:02 UTC on October 15 and 07:12 UTC on October 16 carried malware that could compromise a site once activated, create rogue administrators and recreate its own backdoor (Rank Math). The clean version is 3.0.124. Rank Math says a site that activated the bad package should be treated as compromised: restore from a backup made before the window and rotate all passwords, database credentials, API keys and salts. It is not in KEV.

UpdraftCentral connection keys

TeamUpdraft found unauthorized access on October 17 to 18. The attacker used stolen UpdraftCentral connections to create administrator accounts and install plugins that hide themselves. UpdraftPlus 1.26.13 and 2.26.13 revoke the affected keys. Inspect wp-content/plugins and wp-content/mu-plugins over SFTP or SSH, and remove suspicious plugin folders by hand rather than from the dashboard, because some contain removal logic. Then reset salts and admin passwords, and restore from a backup taken before October 17 if anything looks wrong.

Adobe Commerce CVE-2026-48356

The fix shipped in APSB26-73 on July 14, 2026. CISA added it to KEV on October 27, so any store still unpatched since July should treat it as urgent.

PHP2Shell sits underneath all of these sites. Our PHP2Shell guide covers affected versions, how to check exposure and how to fix it.

ConnectWise Cloud Backup and Storm-0940

Between 06:13 and 08:34 UTC on October 15, stolen ConnectWise Cloud Backup application credentials were used to sign in to customer Microsoft 365 and Entra ID tenants as a trusted service principal (SpecterOps). An app-only sign-in involves no user, so user MFA never applies.

Microsoft attributes the campaign to Storm-0940, which it describes as China-state aligned and active since 2021. The group used ARTEX, an open-source multi-agent AI penetration testing framework, and in several cases reached privileged cloud access less than three hours after first targeting. Microsoft observed:

• Microsoft Graph reconnaissance.
• Credentials added to other applications for persistence.
• A ConnectWise application assigning itself Global Administrator.
• Bulk Azure Key Vault secret reads.

Microsoft says the actor attempted sign-ins to more than 2,250 tenants. How many were compromised is not confirmed: Huntress, as cited by SpecterOps, saw sign-in activity in nearly 1,000 tenants and about 300 successful sign-ins as of October 19, and Microsoft has not disclosed a count. ConnectWise disabled its Cloud Backup, SaaS Security and Cloud Management services (The Register), and how the credentials were obtained has not been disclosed. Microsoft says the activity did not come from a flaw in its products.

Hunting steps (Microsoft and SpecterOps):

• Find the ConnectWise apps by application ID, not display name. Older tenants may still show SkyKick names.
• Review service principal sign-ins and Graph activity from at least October 15, and back to October 1 where logs exist.
• Check every application for credentials added since October 13, plus new owners, consents and role assignments.
• Disable the apps rather than delete them, and preserve evidence first. Tokens already issued can stay valid for up to 90 minutes after disabling.

Our Microsoft 365 security assessment reviews enterprise app permissions and paths from app-only access to admin roles, with a configuration review from $4,200. For background, see our post on malicious connected apps and OAuth risk.

A second supply-chain incident hit AI infrastructure: on October 21, LiteLLM 1.107.0 on PyPI and Docker shipped a stealer for cloud credentials and AI provider keys, and the last safe version is 1.106.2 (Wiz). Our post on LLMjacking and stolen AI keys covers it.

Old bugs, new listings

On October 8, CISA added five old CVEs: ISC BIND CVE-2015-5477, Apache Struts CVE-2016-3081, Strapi CVE-2023-22894, ONLYOFFICE Docs CVE-2021-3199 and ProFTPD CVE-2015-3306. On November 4 it added Apple CVE-2024-27834. An old CVE on KEV means attackers are still finding systems that never got the fix, and those are usually systems missing from the asset inventory.

The rest of the list includes Plex Media Server (four CVEs, fixed in 1.43.3.10861), SiteGuard Server Edition, Siemens Software Center and Google Brotli CVE-2026-111497, a decoder flaw fixed in 1.0.10, 1.1.1 and 1.2.1. Brotli is a library built into many products, so check software bills of materials (SBOMs) and vendor advisories rather than one package.

October breaches and how attackers got in

Organization	Disclosed	Scale	Initial access, per the organization
Binance	October 29 (preliminary)	About $6.3 billion	A DevOps engineer’s compromised laptop, then a service container that submitted withdrawals; Binance later cited additional points of breach
Oracle Health (Cerner)	Count reported October 5	Nearly 20 million people, per Bloomberg citing Texas filings	Stolen credentials used on legacy Cerner servers not yet moved to Oracle Cloud, January 22 to April 1, 2025
ETS (California Department of Education contractor)	Notices from October 16	No official count	Student data copied through an ETS secure file transfer site using an account ETS has since disabled; access from May 22 to September 18
Florida Department of Education	October 29	About 4.9 million potentially affected	Not disclosed
Quest Diagnostics	8-K dated October 21	Not disclosed	Not disclosed

Sources: BleepingComputer on Binance, HIPAA Journal on Oracle Health, The Record on ETS, The Record on Florida, Quest’s 8-K. Binance’s root cause is still preliminary. The North Korea attribution comes from TRM Labs and Chainalysis, not Binance.

Where the organization has said how it happened, the answer was a stolen or misused login, or a compromised workstation, not a zero-day. Oracle Health and Quest involve patient records. If you hold them, our HIPAA penetration testing page explains how testing maps findings to the Security Rule as evidence for your risk analysis.

sshhole and PHP2Shell

sshhole (CVE-2026-123158) is a password authentication bypass in OpenSSH before 10.6p2 on Linux builds that use musl libc without PAM, with Alpine Linux the main example. It was fixed on November 5 and was not in KEV as of November 6, 2026. Our sshhole guide covers how to check your hosts.

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) went into KEV on October 26. The fixes are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CISA’s entry for Linux kernel CVE-2026-46300 says it can be chained with both to plant PHP web shells and run commands as root. See our PHP2Shell guide.

October also brought fixes for AI coding agents and MCP tooling, covered in our roundup of Claude Code and MCP vulnerabilities.

How to use the KEV list without drowning in it

KEV is an input, not a to-do list. Use it in three steps:

1. Map each entry to your inventory, including appliances and libraries built into other products.
2. Fix internet-facing systems first: VPNs, email gateways, management interfaces and remote-support tools.
3. Confirm the fix took. Restart services, follow the vendor’s integrity or reset steps, and rescan.

Our vulnerability remediation guide covers fix deadlines and proof of fix in more detail. Testing adds what a feed cannot. An external test finds exposed management interfaces and old versions. An Active Directory assessment measures what a stolen VPN service account could reach. A Microsoft 365 review checks app-only permissions. Vulnerability management tracks KEV against your assets month to month.

Every service has a fixed starting price on our pricing page, agreed in writing before work begins, with a free retest on every penetration test.

Frequently asked questions

What is the CISA KEV catalog? It is CISA’s list of vulnerabilities with evidence of exploitation in the wild. Each entry names the CVE, the product, the required action and a deadline for federal agencies.

How many vulnerabilities did CISA add to KEV in October 2026? 36 in October, plus two more on November 3 and 4: WordPress core CVE-2026-119977 and Apple CVE-2024-27834.

Do KEV deadlines apply to private companies? No. BOD 26-04 binds federal civilian executive branch agencies. CISA recommends that every other organization use the catalog as an input to its own prioritization.

What was the most serious vulnerability of October 2026 for businesses? For organizations that run it, the Ivanti Connect Secure chain: unauthenticated access to a fully patched VPN appliance, followed by theft of Active Directory credentials that Ivanti’s integrity tool may not detect.

Was sshhole added to KEV? Not as of November 6, 2026. CVE-2026-123158 was disclosed and fixed on November 5.

Fixed price, fixed scope, free retest. Scope your assessment and get the price in writing.