Skip to content

Data collected

CVEs Live

Added to CISA KEV, 12 Oct 2026 to 18 Oct 2026

9 vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog in this week. Listed by risk: highest EPSS first.

Build snapshot collected · KEV catalog 2026.10.21 · EPSS of 21 Oct 2026 · not a live feed: collected once, at build time

  1. CVE-2026-104935Exploited · KEV: listed in the CISA Known Exploited Vulnerabilities catalog

    Ivanti · Connect Secure

    Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

    Severity

    8.6HIGHCVSS 3.1 · ivanti

    Attack probability (EPSS)

    26.0%98th pct

    KEV dates

    added due
  2. CVE-2026-21589Exploited · KEV: listed in the CISA Known Exploited Vulnerabilities catalog

    Atlassian · Multiple Products

    Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

    Severity

    9.3CRITICALCVSS 4.0 · atlassian

    Attack probability (EPSS)

    12.7%96th pct

    KEV dates

    added due
  3. CVE-2026-105134Exploited · KEV: listed in the CISA Known Exploited Vulnerabilities catalog

    Ahsay · AhsayCBS

    Ahsay AhsayCBS Command Injection Vulnerability

    Severity

    10.0CRITICALCVSS 4.0 · VulDB

    Attack probability (EPSS)

    4.78%92th pct

    KEV dates

    added due
  4. CVE-2026-76519Exploited · KEV: listed in the CISA Known Exploited Vulnerabilities catalog

    Cisco · Secure Email Gateway

    Cisco Secure Email Gateway Relative Path Traversal Vulnerability

    Severity

    9.8CRITICALCVSS 3.1 · cisco

    Attack probability (EPSS)

    1.57%75th pct

    KEV dates

    added due
  5. CVE-2026-96951Exploited · KEV: listed in the CISA Known Exploited Vulnerabilities catalog

    Microsoft · Windows

    Microsoft Windows Command Injection Vulnerability

    Severity

    8.8HIGHCVSS 3.1 · microsoft

    Attack probability (EPSS)

    1.51%74th pct

    KEV dates

    added due
  6. CVE-2026-0322Exploited · KEV: listed in the CISA Known Exploited Vulnerabilities catalog

    Palo Alto Networks · PAN-OS

    Palo Alto Networks PAN-OS Code Injection Vulnerability

    Severity

    8.6HIGHCVSS 4.0 · palo_alto

    Attack probability (EPSS)

    1.21%68th pct

    KEV dates

    added due
  7. CVE-2026-102764Exploited · KEV: listed in the CISA Known Exploited Vulnerabilities catalog

    BeyondTrust · Remote Support

    BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

    Severity

    9.3CRITICALCVSS 4.0 · BT

    Attack probability (EPSS)

    1.18%67th pct

    KEV dates

    added due
  8. CVE-2025-61624Exploited · KEV: listed in the CISA Known Exploited Vulnerabilities catalog

    Fortinet · Multiple Products

    Fortinet Multiple Products Path Traversal Vulnerability

    Severity

    5.4MEDIUMCVSS 3.1 · fortinet

    Attack probability (EPSS)

    1.08%65th pct

    KEV dates

    added due
  9. CVE-2026-105133Exploited · KEV: listed in the CISA Known Exploited Vulnerabilities catalog

    Ahsay · AhsayCBS

    Ahsay AhsayCBS Improper Authentication Vulnerability

    Severity

    6.9MEDIUMCVSS 4.0 · VulDB

    Attack probability (EPSS)

    0.85%58th pct

    KEV dates

    added due

All entries are in KEV, so the order is EPSS probability, then published CVSS. Scores are shown as each source published them.

The week in numbers

8 vendors had products added: Ahsay (2), Ivanti (1), Atlassian (1), Cisco (1), Microsoft (1), Palo Alto Networks (1), BeyondTrust (1), Fortinet (1). CISA marks none of the 9 as known to be used in ransomware campaigns.

Due dates in this batch run from 16 Oct 2026 to 19 Oct 2026. They bind US federal civilian agencies; for everyone else they indicate how urgent CISA considers each fix.

Other weeks

Questions

How many vulnerabilities were added to CISA KEV in the week of 12 Oct 2026?

9, between 12 Oct 2026 and 18 Oct 2026, according to catalog version 2026.10.21 collected on 22 Oct 2026.

Why do additions come in batches?

CISA updates the catalog on US business days and often adds several CVEs in one notice, for example a set of vulnerabilities in the same product that are chained in an attack. Weeks with no additions also happen.

How is the week defined?

By the "dateAdded" field of each entry, grouped in ISO 8601 weeks, Monday to Sunday.

Related sections