Audience: Vulnerability Managers, Security Operations, CISOs, DevSecOps Teams
Reading Time: Approximately 10 minutes

Subscribe to get these articles directly to your inbox when published

34 KEV additions. 18 critical CVEs.

October 2026 saw an aggressive surge in CISA Known Exploited Vulnerabilities (KEV) catalog additions, accumulating 34 newly cataloged flaws spanning network infrastructure, virtualization platforms, application servers, and core libraries. This comprehensive priority report aggregates weekly intelligence, synthesises cumulative risk exposure, and provides strategic remediation guidance for security engineering teams based on all 34 catalog entries.

The Month in Numbers

Complete October 2026 KEV Additions Master Inventory

Notable Priority Vulnerabilities

Threat Landscape Context

October's KEV additions illustrate an aggressive diversification of attack surfaces, bridging legacy software architectures with modern cloud-native tooling. While edge devices like Ivanti and Cisco continue to serve as primary entry points for initial access, the inclusion of backup software (Ahsay) and developer collaboration tools (Collabora, Plex) highlights threat actor persistence in exploring unmonitored lateral channels. The prevalence of command injection and path traversal vulnerabilities indicates that adversaries are heavily weaponizing input sanitization oversights to achieve persistent operating system execution. Furthermore, legacy inclusions such as ProFTPD, ISC BIND, and Apache Struts demonstrate that historical vulnerabilities remain viable vectors when organizations fail to maintain complete asset visibility across secondary internal segments.

Sector Exposure Summary

Hackerstorm Analysis

October's data underscores a structural shift in how vulnerability intelligence must be operationalized: relying solely on CVSS severity metrics is actively failing defenders. The inclusion of widespread utility libraries (like Google Brotli) and application runtimes (PHP) with massive EPSS probabilities demonstrates that attackers are prioritizing ubiquity over complexity. Furthermore, the systematic targeting of secondary operational tooling—such as backup daemons and media servers—reveals that threat actors view perimeter hardening as a hurdle to be bypassed via shadow IT and internal service proliferation. Security programs must pivot from reactive patch management toward continuous attack surface mapping, ensuring that auxiliary systems receive identical scrutiny to core enterprise perimeters.

About This Report

Attribution Note

This analysis is based on publicly available reporting and security research summaries. Some technical details may change as additional information becomes available. 

Author Information

Timur Mehmet | Founder & Lead Editor

Timur is a veteran Information Security professional with a career spanning over three decades. Since the 1990s, he has led security initiatives across high-stakes sectors, including Finance, Telecommunications, Media, and Energy. Professional qualifications over the years have included CISSP, ISO27000 Auditor, ITIL and technologies such as Networking, Operating Systems, PKI, Firewalls. For more information including independent citations and credentials, visit our About page.

Contact: This email address is being protected from spambots. You need JavaScript enabled to view it.

Editorial Standards

This article adheres to Hackerstorm.com's commitment to accuracy, independence, and transparency:

• Fact-Checking: All statistics and claims are verified against primary sources and authoritative reports
• Source Transparency: Original research sources and citations are provided in the References section below
• No Conflicts of Interest: This analysis is independent and not sponsored by any vendor or organization
• Corrections Policy: We correct errors promptly and transparently. Report inaccuracies to This email address is being protected from spambots. You need JavaScript enabled to view it.

Editorial Policy: Ethics, Non-Bias, Fact Checking and Corrections

Learn More: About Hackerstorm.com | FAQs

Source Transparency

• CISA KEV Catalog & NVD:

  • CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

  • National Vulnerability Database (NVD) — https://nvd.nist.gov/

• Ivanti Connect Secure (CVE-2026-11852, CVE-2026-11135, CVE-2026-104935):

  • Ivanti Security Advisories — https://forums.ivanti.com/s/security-advisory

• GitLab Community/Enterprise Edition (CVE-2026-97229):

  • GitLab Security Release Advisories — https://about.gitlab.com/releases/

• Cisco Secure Firewall ASA / FTD & Email Gateway (CVE-2026-76418, CVE-2026-76519):

  • Cisco Security Advisories — https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/

• Linux Kernel (CVE-2026-46300):

  • Kernel.org Security & Documentation — https://www.kernel.org/doc/html/latest/process/embargoed-hardware-issues.html

• Broadcom VMware ESX (CVE-2026-41709):

  • Broadcom VMware Support & Security Advisories — https://support.broadcom.com/security-advisory

• Adobe Commerce and Magento (CVE-2026-48356):

  • Adobe Security Bulletins and Advisories — https://helpx.adobe.com/security.html

• Google Brotli (CVE-2026-11149):

  • Google Brotli GitHub Security Advisories — https://github.com/google/brotli/security/advisories

• PHP Group PHP (CVE-2026-109618, CVE-2026-109619):

  • PHP Official Releases and Security Security Page — https://www.php.net/downloads

• Arista VeloCloud Orchestrator (CVE-2026-11462):

  • Arista Product Security Advisories — https://www.arista.com/en/support/advisories-notices

• Collabora Online (CVE-2026-11044):

  • Collabora Office Security Updates — https://www.collaboraoffice.com/security-advisories/

• EG Secure Solutions SiteGuard (CVE-2026-10693):

  • EG Secure Solutions SiteGuard Bulletins — https://www.eg-secure.co.jp/

• Plex Media Server (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656):

  • Plex Security Release Notes — https://forums.plex.tv/c/release-notes/106

• Siemens Software Center (CVE-2026-110936):

  • Siemens ProductCERT Security Advisories — https://cert-portal.siemens.com/productcert/topics/

• BeyondTrust Remote Support (CVE-2026-102764):

  • BeyondTrust Security Advisories — https://www.beyondtrust.com/docs/release-notes/index.htm

• Fortinet (CVE-2025-61624, CVE-2026-104286):

  • Fortinet Product Security Advisories — https://www.fortiguard.com/psirt

• Atlassian (CVE-2026-21589):

  • Atlassian Security Advisory Bulletin — https://confluence.atlassian.com/security

• Ahsay AhsayCBS (CVE-2026-105133, CVE-2026-105134):

  • Ahsay Security Bulletins — https://www.ahsay.com/

• Palo Alto Networks PAN-OS (CVE-2026-0322):

  • Palo Alto Networks PSIRT Advisories — https://security.paloaltonetworks.com/

• Microsoft Windows Shell (CVE-2026-96951):

  • Microsoft Security Update Guide — https://msrc.microsoft.com/update-guide/

• ISC BIND (CVE-2015-5477):

  • ISC Knowledgebase & Security Advisories — https://www.isc.org/blogs/

• Apache Struts (CVE-2016-3081):

  • Apache Struts Security Bulletins — https://struts.apache.org/security.html

• Strapi (CVE-2023-22894):

  • Strapi Security Advisories — https://strapi.io/security

• ONLYOFFICE Docs (CVE-2021-3199):

  • ONLYOFFICE Security Updates — https://www.onlyoffice.com/security.aspx

• ProFTPD (CVE-2015-3306):

  • ProFTPD Project Security Notices — http://www.proftpd.org/security.html

• Citrix NetScaler ADC & Gateway (CVE-2026-88779):

  • Citrix Support Security Bulletins — https://support.citrix.com/security-bulletins

• Zammad GmbH Zammad (CVE-2026-102489, CVE-2026-102490):

  • Zammad Security Advisories — https://zammad.com/en/security