Actively exploited vulnerabilities: October 2026

In short

In October 2026 CISA, the US cybersecurity agency, added 36 new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. A flaw only enters KEV when there is evidence of real-world exploitation, which makes it one of the best lists for deciding what to fix first. This brief is based on the official KEV data feed (catalog version 2026.10.30), the same feed our client platform uses for risk-based prioritization and CVE alerts.

1. Edge devices remain the main target

The key lesson of the month: VPN concentrators, firewalls, mail gateways and remote support products – devices that by design must be reachable from the internet – made up a large share of the entries. Ivanti Connect Secure appeared with three separate flaws within a single month.

Action: keep an up-to-date list of internet-facing devices, follow their vendor security advisories daily, and fix KEV-listed flaws within days. Management interfaces should never be reachable from the internet.

2. Web platforms: PHP, GitLab, Magento

• PHP (CVE-2026-109618, CVE-2026-109619, 26 October) – unauthenticated remote code execution on every web-facing PHP deployment. Detailed analysis: PHP2Shell: critical PHP vulnerabilities.
• GitLab CE/EE (CVE-2026-97229, 29 October) – integer overflow in the CI/CD regular expression compiler, CVSS 10.0; fixed in 19.2.8, 19.3.5 and 19.4.2. Self-managed GitLab instances must be updated.
• Adobe Commerce and Magento (CVE-2026-48356, 27 October) – unrestricted upload of dangerous file types; a particular risk for online shops.
• Atlassian (CVE-2026-21589), Collabora Online (CVE-2026-110447) and Zammad (two flaws) – collaboration and helpdesk systems that often hold sensitive internal data.

3. Industrial and operational relevance

• Siemens Software Center (CVE-2026-110936, 20 October) – uncontrolled search path element (DLL loading). According to public reports it was exploited in a "ClickFix"-style campaign. It runs on engineering and maintenance workstations, so it must be considered on the path into the OT network; fixed in version 4.0.9.8.
• VMware ESX (CVE-2026-41709) and Linux kernel (CVE-2026-46300) – the virtualization and server base layer; a compromised hypervisor affects every system running on it.
• Plex Media Server (four flaws, the "Plex2Shell" chain) – less of an enterprise product, but often internet-exposed in home and small-office networks; reportedly used to deploy cryptominers and proxy malware.

4. Old flaws do not go away

On 8 October five CVEs from 2015 to 2023 were added to the catalog (including ISC BIND, Apache Struts, ProFTPD, ONLYOFFICE and Strapi). This does not mean they were just discovered, but that there is fresh evidence of their exploitation. A forgotten server that has not been updated for years is still a real entry point today.

Takeaways

1. Prioritize with KEV: not every flaw with a critical CVSS score is urgent, but every KEV-listed flaw is, if it exists in your organization.
2. No patching without inventory: you need to know which products and versions run, especially internet-facing ones.
3. Internet-facing devices need their own process: shorter patch deadlines, locked-down management interfaces, MFA.
4. Assume breach: if a KEV flaw was exploited before the fix, a compromise assessment is needed after patching too.

Our client platform downloads the current KEV catalog every day, matches it against open findings and alerts when an actively exploited vulnerability affects a client's systems. About attack surface monitoring →

References

• CISA Known Exploited Vulnerabilities Catalog (JSON feed, catalog version 2026.10.30)
• CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (2026-10-28)
• Help Net Security: GitLab CVE-2026-97229
• Rapid7: Ivanti Connect Secure zero-day (CVE-2026-104935)
• BleepingComputer: Plex2Shell