Audience: Vulnerability Managers, Security Operations, CISOs, DevSecOps Teams
Reading Time: Approximately 10 minutes

Subscribe to get these articles directly to your inbox when published

This Week's KEV Additions

EPSS scores and percentiles are the supplied snapshot for this report and are not updated after publication. Pending values remain pending until confirmed by FIRST.org. CVSS scores are shown only where a score has been established from the referenced record.

Analysis

CVE-2026-102764 — BeyondTrust Remote Support

• What it is: An authentication-bypass-by-spoofing vulnerability that may allow a remote attacker to perform file operations on the Remote Support appliance.

• Affected versions: Confirm the affected and fixed versions in BeyondTrust's advisory before deployment. Do not infer the affected release range from the CVE ID alone.

• Exploitation status: Included in the supplied weekly KEV data. Confirm the catalog entry and vendor statement for additional exploitation details.

• Patch available: Check BeyondTrust's current security advisory and apply the vendor-recommended fixed version or mitigation.

• CISA due date: Verify against the live CISA KEV catalog.

• Operational risk: Remote Support appliances provide privileged support access. Unauthorised file operations could undermine the support environment or expose data and create a route to further compromise. Prioritise exposed appliances and investigate unexpected file changes.

CVE-2025-61624 — Fortinet Products

• What it is: A path-traversal vulnerability affecting FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. The supplied description states that exploitation requires an authenticated attacker with an administrator profile and at least read-write permissions.

• Affected versions: Verify the exact affected releases and fixed versions in the relevant Fortinet advisory for each product family.

• Exploitation status: Included in the supplied weekly KEV data. Confirm the current vendor advisory for exploitation details and product-specific conditions.

• Patch available: Follow Fortinet's product-specific upgrade guidance and apply the applicable fixed release.

• CISA due date: Verify against the live CISA KEV catalog.

• Operational risk: File-system access through a privileged management account could expose or alter system files. Review privileged accounts and access rights, restrict management interfaces, and prioritise devices that administer critical network or security infrastructure.

CVE-2026-21589 — Atlassian Data Center Products

• What it is: An arbitrary file-access vulnerability affecting Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye. Atlassian states that an unauthenticated attacker may access specific files in the web application root if the exact file name and path are known.

• Affected versions: Atlassian identifies all versions of the listed Data Center products as affected before their respective fixed releases. Consult the vendor advisory for the exact fix version for each product. Atlassian states that affected Cloud products have been patched.

• Exploitation status: Added to the supplied weekly KEV list. Atlassian's advisory should be consulted for the latest exploitation assessment; KEV inclusion indicates that remediation should be prioritised. POTENTIAL FALSE POSITIVE - CHECK DIRECTLY WITH VENDOR

• Patch available: Atlassian provides fixed releases for the affected Data Center products. Upgrade each deployment to the applicable fixed release or later, following the vendor's instructions.

• CISA due date: Verify against the live CISA KEV catalog.

• Operational risk: Unauthorised access to application files may expose configuration or other sensitive information, depending on the deployment. Inventory all listed Data Center products, identify externally accessible instances, and prioritise those containing sensitive project, service-management or collaboration data.

CVE-2026-105134 — Ahsay AhsayCBS

• What it is: A command-injection vulnerability in AhsayCBS that can permit a remote attacker to execute operating-system commands through manipulation of a parameter in the Replication Receiver component.

• Affected versions: Ahsay's advisories identify affected AhsayCBS releases and provide separate hotfixes for version 9 and version 10. Confirm the deployed version and follow the current vendor instructions.

• Exploitation status: Ahsay reported unauthorised access incidents affecting partner environments. The vendor published urgent security guidance and recovery instructions for affected servers.

• Patch available: Yes. Ahsay's 12 October update identifies hotfix v10.3.4.45 for affected version 10 deployments and v9.15.2.70 for affected version 9 deployments. Earlier patches were reported as incomplete. Reboot after applying the appropriate hotfix and follow the vendor's recovery guidance.

• CISA due date: Verify against the live CISA KEV catalog.

• Operational risk: Backup-management infrastructure is highly sensitive because it controls access to backup data and recovery operations. Remote command execution could allow an attacker to compromise the backup server, tamper with backups or establish persistence. Patch immediately, restrict management access, and investigate for compromise rather than assuming that patching alone removes an existing foothold.

CVE-2026-76519 — Cisco Secure Email Gateway

• What it is: A relative path-traversal vulnerability in the Advanced Malware Protection feature that may allow an unauthenticated remote attacker to write arbitrary files to the underlying operating system. Cisco states that successful exploitation could also allow command execution with root privileges.

• Affected versions: Affected Cisco AsyncOS releases are listed in Cisco's security advisory. Confirm the exact installed version and the corresponding fixed release using the vendor's affected-products and fixed-software tables.

• Exploitation status: Added to CISA KEV. Consult Cisco's current advisory and CISA's catalog for the latest exploitation information and response requirements.

• Patch available: Yes. Cisco has released software updates addressing the vulnerability and states that no workaround is available.

• CISA due date: 2026-10-17. This date has passed; treat remediation as overdue where applicable.

• Operational risk: A compromised email gateway could provide a route to operating-system-level access on a security boundary. Prioritise exposed appliances where the affected feature is enabled, apply the fixed software and investigate suspicious attachment processing and unexpected file changes.

CVE-2026-105133 — Ahsay AhsayCBS

• What it is: An improper-authentication vulnerability in the AhsayCBS API's checkSysPwd function. Manipulation of the random parameter may allow a remote attacker to bypass authentication.

• Affected versions: The vendor and NVD records identify older AhsayCBS releases as affected. Confirm the installed version and the current vendor hotfix instructions before deployment.

• Exploitation status: Ahsay has reported unauthorised access incidents affecting partner environments and has issued joint security guidance for this vulnerability and CVE-2026-105134.

• Patch available: Yes. Ahsay's 12 October update identifies hotfix v10.3.4.45 for affected version 10 deployments and v9.15.2.70 for affected version 9 deployments. Apply the appropriate hotfix and follow the vendor's recovery guidance.

• CISA due date: Verify against the live CISA KEV catalog.

• Operational risk: Authentication bypass can expose backup-management functions without the intended access checks. Because the same product is affected by a command-injection vulnerability, assess both issues together, restrict remote access and review for evidence of unauthorised activity.

CVE-2026-0322 — Palo Alto Networks PAN-OS

• What it is: An authenticated remote-code-execution vulnerability in the PAN-OS management interface. An attacker with network access and the required privileges could execute arbitrary code with root privileges on the firewall.

• Affected versions: Consult Palo Alto Networks' advisory for the affected PAN-OS releases and fixed versions applicable to the deployed firewall.

• Exploitation status: Palo Alto Networks marks the issue as ATTACKED in its security advisory. Review the vendor's current assessment and remediation guidance.

• Patch available: Follow the vendor's fixed-version guidance. Restrict access to the management interface to trusted internal IP addresses while remediation is arranged.

• CISA due date: Verify against the live CISA KEV catalog.

• Operational risk: Root-level execution on a firewall could undermine a critical network security control and affect network confidentiality, integrity and availability. Restrict management access, check administrative activity and prioritise firewalls that expose the management interface to less-trusted networks.

CVE-2026-104935 — Ivanti Connect Secure

• What it is: An authentication-bypass-by-spoofing vulnerability that may allow a remote, unauthenticated attacker to execute arbitrary commands on an affected Ivanti Connect Secure appliance.

• Affected versions: Confirm the affected and fixed releases in Ivanti's security advisory before making changes.

• Exploitation status: Added to CISA KEV. Check Ivanti's advisory for current exploitation information, required mitigations and any investigation guidance.

• Patch available: Apply the vendor-recommended fix or mitigation. Review the advisory for appliance-specific instructions and any post-remediation checks.

• CISA due date: 2026-10-16. This date has passed; treat remediation as overdue where applicable.

• Operational risk: Connect Secure appliances can provide remote access into enterprise environments. Unauthenticated command execution could compromise the remote-access boundary and provide a foothold for further intrusion. Prioritise exposed appliances, follow Ivanti's compromise-assessment guidance and do not assume that patching alone proves the system is clean.

CVE-2026-96951 — Microsoft Windows Shell

• What it is: A command-injection vulnerability in Windows Shell that may allow an unauthorised attacker to bypass a security feature over a network.

• Affected versions: Confirm the affected Windows releases, prerequisites and fixed updates in Microsoft's security advisory for this CVE.

• Exploitation status: Included in the supplied weekly KEV data. Confirm the vendor's current exploitation assessment and any additional indicators before drawing conclusions about a particular environment.

• Patch available: Apply the applicable Microsoft security update and verify deployment across supported Windows systems.

• CISA due date: Verify against the live CISA KEV catalog.

• Operational risk: A security-feature bypass may undermine an existing Windows protection and increase the risk from malicious network activity. Establish the affected asset scope, deploy the relevant security update and review endpoint telemetry for suspicious command execution.

Exploitation Context

This week's additions span remote-support software, network and security appliances, backup management, enterprise collaboration platforms and Windows systems. Several vulnerabilities affect privileged management paths or permit access without the intended authentication controls. These weaknesses deserve attention because compromise of management infrastructure can provide access to sensitive systems or undermine controls intended to protect other assets. The supplied EPSS data also identifies a notable difference in estimated exploitation probability: Ivanti Connect Secure has the highest supplied score at 25.982% and the 98th percentile, followed by AhsayCBS command injection at 4.782% and the 92nd percentile.

The AhsayCBS vulnerabilities warrant joint handling. Ahsay has reported unauthorised access incidents and issued follow-up hotfixes after earlier patches were found incomplete. Cisco's Secure Email Gateway vulnerability can allow arbitrary file writes and root-level command execution, while Palo Alto Networks identifies the PAN-OS management-interface issue as actively attacked. For Atlassian, unauthenticated access to specific application files is the principal concern described by the vendor. KEV inclusion signals a need to prioritise remediation, but does not by itself prove that a particular organisation has been compromised.

Remediation Priorities

Detection and Monitoring Guidance

• CVE-2026-102764 (BeyondTrust):

  • Log Sources: Remote Support audit logs, authentication logs, appliance system logs and EDR or host telemetry where available.

  • Behavioral Indicators: Unusual remote-support sessions, unexpected file reads or writes, changes outside approved support activity and suspicious administrator actions.

  • Monitoring Gap / Detection Artifacts: File operations may appear legitimate when performed through support tooling. Correlate file changes with authenticated sessions and approved support tickets.

• CVE-2025-61624 (Fortinet):

  • Log Sources: Fortinet administrative audit logs, system events, configuration-change records and central security monitoring.

  • Behavioral Indicators: Unexpected privileged file operations, changes to system files and administrative activity outside normal change windows.

  • Monitoring Gap / Detection Artifacts: Detection depends on product-specific audit coverage. Verify which product and release are affected and retain administrator activity logs.

• CVE-2026-21589 (Atlassian):

  • Log Sources: Reverse-proxy and web-server access logs, Atlassian application logs, WAF telemetry and host-level file-access monitoring where available.

  • Behavioral Indicators: Unusual requests for application-root files, repeated requests to unusual paths and access to files that are not normally exposed to unauthenticated users.

  • Monitoring Gap / Detection Artifacts: The vendor states that exploitation requires knowledge of the target file's exact name and path. Standard access logs may not prove whether sensitive file contents were successfully retrieved.

• CVE-2026-105134 (AhsayCBS):

  • Log Sources: AhsayCBS application and web-server logs, operating-system security logs, EDR telemetry, process-creation records and file-integrity monitoring.

  • Behavioral Indicators: Unexpected child processes, suspicious command execution, unfamiliar files or scripts, abnormal outbound connections and unusual activity involving backup services.

  • Monitoring Gap / Detection Artifacts: Ahsay has published compromise-assessment and recovery guidance. Preserve evidence and follow that guidance; rebuilding a potentially compromised host may be necessary even after applying the hotfix.

• CVE-2026-76519 (Cisco):

  • Log Sources: Cisco Secure Email Gateway logs, mail-processing and attachment logs, system audit records, EDR or host telemetry where available and central network logs.

  • Behavioral Indicators: Unexpected file creation or modification, unusual process execution, suspicious attachment-processing activity and unexpected outbound connections from the appliance.

  • Monitoring Gap / Detection Artifacts: Network logs alone may not expose arbitrary file writes on the underlying operating system. Apply Cisco's fixed software and use the vendor's current investigation guidance.

• CVE-2026-105133 (AhsayCBS):

  • Log Sources: AhsayCBS API and web-server logs, authentication records, operating-system security logs and EDR telemetry.

  • Behavioral Indicators: Unusual API requests, suspicious authentication outcomes, unexpected backup-management activity and access from unfamiliar sources.

  • Monitoring Gap / Detection Artifacts: Authentication bypass may not produce a conventional failed-login sequence. Review successful requests and assess the host for compromise alongside CVE-2026-105134.

• CVE-2026-0322 (Palo Alto Networks):

  • Log Sources: PAN-OS system, configuration, authentication and management-interface logs; central network security and administrative audit records.

  • Behavioral Indicators: Unexpected administrator sessions, unusual management requests, configuration changes outside approved windows and suspicious system processes or outbound connections.

  • Monitoring Gap / Detection Artifacts: The issue requires authenticated access, so compromised or misused administrator credentials may be relevant. Restrict management access and follow Palo Alto Networks' current advisory for detection guidance.

• CVE-2026-104935 (Ivanti):

  • Log Sources: Ivanti Connect Secure system and authentication logs, available appliance audit records, network telemetry and relevant central security logs.

  • Behavioral Indicators: Unexpected administrative activity, unusual commands or configuration changes, unfamiliar outbound connections and anomalous remote-access activity.

  • Monitoring Gap / Detection Artifacts: Authentication bypass can evade ordinary failed-login detection. Follow Ivanti's current compromise-assessment guidance and do not rely solely on patch status to determine whether an appliance is clean.

• CVE-2026-96951 (Microsoft):

  • Log Sources: Windows Security logs, Microsoft Defender or other EDR telemetry, process-creation events, PowerShell logs where applicable and network security logs.

  • Behavioral Indicators: Unexpected command execution, unusual parent-child process relationships, suspicious network-originated activity and attempts to bypass existing Windows protections.

  • Monitoring Gap / Detection Artifacts: The exact trigger and relevant event coverage should be confirmed against Microsoft's advisory. Ensure endpoint telemetry is enabled and the affected Windows versions are patched.

Hackerstorm Analysis

Prioritisation should combine exploitation evidence, asset exposure, potential operational impact and the available EPSS estimate rather than relying on severity alone. Ivanti Connect Secure stands out in the supplied data with an EPSS score of 25.982% and a 98th-percentile ranking. AhsayCBS command injection is also a significant priority because remote command execution affects backup infrastructure, and the vendor has reported unauthorised access incidents and issued follow-up hotfixes. Cisco Secure Email Gateway and PAN-OS warrant urgent attention because their vulnerabilities affect systems that play important roles in enterprise security.

The EPSS percentages estimate the probability of exploitation activity and should not be interpreted as the probability that an individual organisation will be compromised. A lower EPSS score does not remove the need to remediate a KEV-listed vulnerability. Validate the affected product and version, check the current vendor remediation instructions, identify externally reachable or highly privileged systems, and investigate possible compromise where the vendor recommends it. The Atlassian EPSS and CVSS values remain pending in the supplied dataset and should be updated only when authoritative values are available.

What you should do next

Ensure you understand the latest KEV additions to cover off any potential gaps in your remediation activities.  View all weekly reports here

Further Reading

The following resources offer technical analysis to help integrate CISA KEV data into operational triage workflows and stay aligned with updated mitigation guidance.

About This Report

Attribution Note

This analysis is based on publicly available reporting and security research summaries. Some technical details may change as additional information becomes available. 

Author Information

Timur Mehmet | Founder & Lead Editor

Timur is a veteran Information Security professional with a career spanning over three decades. Since the 1990s, he has led security initiatives across high-stakes sectors, including Finance, Telecommunications, Media, and Energy. Professional qualifications over the years have included CISSP, ISO27000 Auditor, ITIL and technologies such as Networking, Operating Systems, PKI, Firewalls. For more information including independent citations and credentials, visit our About page.

Contact: This email address is being protected from spambots. You need JavaScript enabled to view it.

Editorial Standards

This article adheres to Hackerstorm.com's commitment to accuracy, independence, and transparency:

• Fact-Checking: All statistics and claims are verified against primary sources and authoritative reports
• Source Transparency: Original research sources and citations are provided in the References section below
• No Conflicts of Interest: This analysis is independent and not sponsored by any vendor or organization
• Corrections Policy: We correct errors promptly and transparently. Report inaccuracies to This email address is being protected from spambots. You need JavaScript enabled to view it.

Editorial Policy: Ethics, Non-Bias, Fact Checking and Corrections

Learn More: About Hackerstorm.com | FAQs

Source Transparency

• CVE-2026-102764:

  • CISA (KEV catalog) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

  • NIST NVD (Vulnerability record) — https://nvd.nist.gov/vuln/detail/CVE-2026-102764

  • BeyondTrust (Vendor security information) — https://www.beyondtrust.com/trust-center/security-advisories

  • FIRST.org (EPSS API) — https://api.first.org/data/v1/epss?cve=CVE-2026-102764

• CVE-2025-61624:

  • CISA (KEV catalog) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

  • NIST NVD (Vulnerability record) — https://nvd.nist.gov/vuln/detail/CVE-2025-61624

  • Fortinet FortiGuard PSIRT (Vendor advisories) — https://www.fortiguard.com/psirt

  • FIRST.org (EPSS API) — https://api.first.org/data/v1/epss?cve=CVE-2025-61624

• CVE-2026-21589:

  • Atlassian (Vendor security advisory) — https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html

  • NIST NVD (Vulnerability record) — https://nvd.nist.gov/vuln/detail/CVE-2026-21589

  • CISA (KEV catalog) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

• CVE-2026-105134:

  • Ahsay (Vendor security alert and follow-up hotfix instructions) — https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update

  • Ahsay (Vulnerability status and recovery guidance) — https://www.ahsay.com/en/company/announcements/ahsaycbs-vulnerability-status-update

  • NIST NVD (Vulnerability record) — https://nvd.nist.gov/vuln/detail/CVE-2026-105134

  • FIRST.org (EPSS API) — https://api.first.org/data/v1/epss?cve=CVE-2026-105134

• CVE-2026-76519:

  • Cisco (Vendor security advisory) — https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-esa-afw-zqYJkjxp.html

  • NIST NVD (Vulnerability record) — https://nvd.nist.gov/vuln/detail/CVE-2026-76519

  • CISA (KEV catalog) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

  • FIRST.org (EPSS API) — https://api.first.org/data/v1/epss?cve=CVE-2026-76519

• CVE-2026-105133:

  • Ahsay (Vendor security alert and follow-up hotfix instructions) — https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update

  • Ahsay (Vulnerability status and recovery guidance) — https://www.ahsay.com/en/company/announcements/ahsaycbs-vulnerability-status-update

  • NIST NVD (Vulnerability record) — https://nvd.nist.gov/vuln/detail/CVE-2026-105133

  • FIRST.org (EPSS API) — https://api.first.org/data/v1/epss?cve=CVE-2026-105133

• CVE-2026-0322:

  • Palo Alto Networks (Vendor security advisory) — https://security.paloaltonetworks.com/CVE-2026-0322

  • NIST NVD (Vulnerability record) — https://nvd.nist.gov/vuln/detail/CVE-2026-0322

  • FIRST.org (EPSS API) — https://api.first.org/data/v1/epss?cve=CVE-2026-0322

• CVE-2026-104935:

  • Ivanti (Vendor security advisory) — https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935

  • NIST NVD (Vulnerability record and CISA KEV information) — https://nvd.nist.gov/vuln/detail/CVE-2026-104935

  • FIRST.org (EPSS API) — https://api.first.org/data/v1/epss?cve=CVE-2026-104935

• CVE-2026-96951:

  • Microsoft (Security update and vulnerability information) — https://msrc.microsoft.com/update-guide/

  • NIST NVD (Vulnerability record) — https://nvd.nist.gov/vuln/detail/CVE-2026-96951

  • CISA (KEV catalog) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

  • FIRST.org (EPSS API) — https://api.first.org/data/v1/epss?cve=CVE-2026-96951

Analyst Notes

• No ransomware attribution was publicly associated with this week's KEV additions at the time of publication.
• No confirmed threat actor attribution was available beyond CISA's confirmation of active exploitation for the majority of entries.
• Where vendor advisory details or EPSS values were unavailable at publication time, placeholders were retained pending analyst validation and vendor updates prior to final publication.