November Threat Roundup: What October Added to the KEV Catalog

Each month we look at the vulnerabilities the Cybersecurity and Infrastructure Security Agency (CISA) added to its Known Exploited Vulnerabilities (KEV) catalog. A KEV entry means there is reliable evidence that attackers are exploiting the flaw in the wild, which makes the catalog one of the best inputs for deciding what to patch first.

In October 2026, CISA added 36 vulnerabilities. Here is what stood out.

Edge devices led again

About a third of October's additions affect systems that sit at the edge of a network and face the internet:

• Ivanti Connect Secure: three entries (CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527). CISA notes that they can be chained: an unauthenticated authentication bypass that allows command execution, a privilege escalation, and a flaw that lets an attacker write files to a predictable location.
• Palo Alto Networks PAN-OS (CVE-2026-0322): code injection that can give an authenticated attacker root on the firewall.
• Cisco Secure Firewall ASA and FTD (CVE-2026-76418) and Cisco Secure Email Gateway (CVE-2026-76519).
• Fortinet FortiMail (CVE-2026-104286) and a path traversal across multiple Fortinet products (CVE-2025-61624).
• Citrix NetScaler ADC and Gateway (CVE-2026-88779), BeyondTrust Remote Support (CVE-2026-102764) and Arista VeloCloud Orchestrator (CVE-2026-114625).

This is the same pattern we described in Edge Devices Under Attack. VPNs, firewalls and gateways are reachable from anywhere, often run as appliances that endpoint tools cannot see into, and grant immediate access to the internal network when compromised. If you run any of these products, confirm you are on a fixed version and then look for signs of compromise, because patching does not remove an attacker who is already in.

Old flaws, new entries

On October 8, CISA added five vulnerabilities that were anywhere from three to eleven years old, including:

• ISC BIND (CVE-2015-5477)
• ProFTPD (CVE-2015-3306)
• Apache Struts (CVE-2016-3081)
• ONLYOFFICE Docs (CVE-2021-3199)
• Strapi (CVE-2023-22894)

A new KEV entry for an old vulnerability usually means exploitation was confirmed against systems that were never updated. These are the servers nobody remembers: a legacy DNS server, an FTP service left running for one partner, an application built on an old framework. An accurate asset inventory is the only reliable defense.

Self-hosted collaboration and media tools

Attackers also targeted the self-hosted applications teams install for convenience:

• Plex Media Server: four entries, including two server-side request forgery (SSRF) flaws.
• GitLab (CVE-2026-97229), Atlassian (CVE-2026-21589), Collabora Online (CVE-2026-110447) and Zammad (two entries).
• Ahsay AhsayCBS backup software: two entries, an authentication bypass and a command injection.

Code repositories, wikis, help desks and backup consoles hold credentials, source code and sensitive records. They deserve the same patching discipline as production systems, and they should not be exposed to the internet without a strong reason.

Platform and infrastructure components

October also brought entries for the Linux kernel (CVE-2026-46300), PHP (CVE-2026-109618 and CVE-2026-109619), Broadcom VMware ESX (CVE-2026-41709), Microsoft Windows (CVE-2026-96951), Google Brotli (CVE-2026-111497), Adobe Commerce and Magento (CVE-2026-48356) and Siemens Software Center (CVE-2026-110936). Flaws in shared components like PHP and Brotli reach far beyond a single product, so check what your applications bundle, not only what you installed directly.

Short deadlines

Since June 2026, federal civilian agencies have patched under Binding Operational Directive 26-04, which replaced BOD 22-01. Instead of one fixed due date per vulnerability, BOD 26-04 sets timelines based on risk: whether the vulnerability is in the KEV catalog, whether exploitation can be automated, its technical impact, and whether the affected asset is exposed to the internet. The most urgent tier requires remediation within three days, plus a forensic triage to check whether the system was already compromised.

Many of October's entries carried that three-day deadline. Organizations outside the federal government are not bound by these timelines, but the logic is worth borrowing: internet-facing systems with known exploitation come first, and patching them should be followed by a check for compromise.

What to do this month

1. Match the list against your inventory. Download the KEV catalog and compare it to what you run, including appliances and self-hosted tools.
2. Patch the edge first. Remote access, firewalls and email gateways come before everything else.
3. Hunt after you patch. For edge devices with known exploitation, check logs and integrity tools for signs of earlier compromise.
4. Retire what you cannot patch. Old services that are no longer needed should be shut down, not left for next quarter.
5. Use KEV with other signals. We explain how to combine KEV with EPSS and CVSS in Prioritizing Vulnerabilities.

How CDT can help

CDT's vulnerability research and cyber hunt teams help organizations find exposed systems, verify fixes and look for attackers who got in before the patch. If you think you are already compromised, visit our under attack page.

Sources

• Known Exploited Vulnerabilities Catalog (CISA)
• BOD 26-04: Prioritizing Security Updates Based on Risk (CISA)