CISA KEV · October 2026

CISA KEV October 2026: all 36 exploited vulnerabilities added

Mihai Marangoci, Gociux · covers October 2026 · generated from CISA KEV · 5 min read

In October 2026, CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, down from 43 in September 2026. None are known to be used in ransomware campaigns. The most affected vendors were Plex (4), Ivanti (3), Cisco (2). Every entry below has reliable evidence of exploitation in the wild, so if you run the product, patch or mitigate it first.

All 36 additions, newest first

By vendor

• Plex: 4
• Ivanti: 3
• Cisco: 2
• PHP Group: 2
• Fortinet: 2
• Ahsay: 2
• Zammad GmbH: 2
• GitLab: 1
• Broadcom: 1
• Linux: 1
• Adobe: 1
• Google: 1
• Arista: 1
• Collabora: 1
• EG Secure Solutions: 1
• Siemens: 1
• BeyondTrust: 1
• Atlassian: 1
• Palo Alto Networks: 1
• Microsoft: 1
• ISC: 1
• Apache: 1
• Strapi: 1
• ONLYOFFICE: 1
• ProFTPD: 1
• Citrix: 1

Check your own stack

Run your vendors and products through stack check, pre-filled with this month's vendors; it also gives you an RSS feed for new additions. The long-run picture is on CVE Trends.

Week-by-week detail, with EPSS scores and CISA's required action for each entry, is in the KEV digests: 17–23 Oct · 24–26 Oct · 27–29 Oct.

How this is made: generated automatically from the CISA KEV catalog, grouped by the date CISA added each entry. Vulnerability names are CISA's. Federal due dates apply to US agencies under BOD 22-01; for everyone else they are a sensible upper bound.