KEV, October 2026: 25 exploited flaws in 17 days

From October 14 to 30, 2026, CISA added 25 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, according to our count of the catalog's JSON file (version 2026.10.30) and of the 11 alerts published during the period. Nothing was added on the 31st. The list covers almost everything an organisation runs: firewalls and VPNs, collaboration tools, web servers, a hypervisor, an industrial software tool and a home media server.

What the sources say

The KEV catalog. Each entry gives the date added, the due date, the ransomware use field and a forensic triage field tied to directive BOD 26-04. We group them by what you run:

Edge and remote access. Eight entries out of 25. We have already covered PAN-OS and Cisco Secure Email Gateway and Ivanti Connect Secure; the catalog states that the two Ivanti flaws of October 30 can be chained with CVE-2026-104935, added on the 13th. For BeyondTrust, alert AL26-025 from the Canadian Centre for Cyber Security confirms exploitation, targets self-hosted versions 26.2.3 and earlier, and states that SaaS customers have been patched since October 9. Advisories AV26-1080 (Arista) and AV26-1102 (Cisco ASA and FTD) relay the exploitation reported by the vendors.

Collaboration and IT tools. The catalog describes the Atlassian flaw as unauthenticated access to files in the Data Center editions of Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible and Fisheye. The Collabora flaw affects the built-in CODE server when used within Nextcloud. GitLab is fixed in 19.2.8, 19.3.5 and 19.4.2 according to advisory AV26-1028. Our article on AhsayCBS covers the backup console.

Servers and components. The PHP pair has its own article, PHP2Shell; the catalog adds that the Linux kernel flaw of October 28 can be chained with it. Alert AL26-027 from the Canadian Centre lists Node.js, .NET, PowerShell, Envoy, Istio and Python packages among the affected technologies for Brotli, with versions 1.0.10, 1.1.1 and 1.2.1 as fixes. For VMware ESX, the catalog describes a flaw that lets a malicious administrator act without leaving a log.

Industrial. Siemens describes Software Center as the tool used to download, install and activate its software. Its advisory SSA-580366 reports active exploitation and a fix in V4.0.9.8, applied automatically at the next startup.

Consumer software. Four flaws in Plex Media Server, a personal media server. We come back to it in a dedicated article, from the remote work angle.

Why it matters

October's catalog spills over the network perimeter. The edge remains the main target, but a patch list that only covers firewalls misses the wiki, the code repository, the online office suite, the compression library buried in other products and the software an employee installed at home.

The second point is about proof. For 14 entries out of 25, the catalog requires forensic triage: the question is no longer only "are we patched?" but "did someone get in before?". A ticket closed at patch time does not answer the second.

Finally, components. Brotli, PHP and the Linux kernel do not appear as products in most inventories. Without a software bill of materials, there is no way to say within an hour which systems embed them.

What we think at Sentrix

1. Sort the inventory by use, not by vendor. Edge, collaboration, servers, industrial, unmanaged devices: each category has its owner and its deadline, and the CTEM module keeps them current.
2. Trigger on KEV listing. The JSON feed is public; compare it with the inventory every day, then order by exposure, as our article on prioritizing with the KEV catalog explains.
3. Add compromise checks to the process. When the catalog requires forensic triage, the ticket closes only with the documented search, not just the patch.
4. Require a software bill of materials from your vendors to respond fast to component flaws like Brotli, see what to ask for in an SBOM.
5. Treat industrial and consumer software as assets. An engineering workstation or a home server that touches your access is part of your surface.

Our vulnerability and patch management service sets up this cycle and produces the evidence for the audit.

The next step

Take the 25 CVEs in the table and, for each one, note: affected or not, patch date, compromise check done or not. A row without an answer points to a gap in the inventory. To do this exercise with us, contact us.