Between September 27 and October 23, 2026, CISA added 30 entries to its Known Exploited Vulnerabilities (KEV) catalog. Twenty-six carry a three-day federal remediation deadline and 22 are flagged for forensic triage, CISA's way of saying "assume it may already have been used against you." Here is what landed, what the entries share, and what to do about it.

What landed in the catalog

CVE Product Flaw type Added to KEV
CVE-2026-88771 Citrix NetScaler Unauthenticated command execution September 27, 2026
CVE-2026-88772 Citrix NetScaler Memory corruption, RCE or DoS September 27, 2026
CVE-2026-88779 Citrix NetScaler Memory corruption, DoS (SAML) October 4, 2026
CVE-2026-104935 Ivanti Connect Secure Authentication bypass by spoofing October 13, 2026
CVE-2026-96951 Microsoft Windows Shell Command injection October 13, 2026
CVE-2026-0322 Palo Alto PAN-OS Code injection (management UI) October 14, 2026
CVE-2026-76519 Cisco Secure Email Gateway Arbitrary file write October 14, 2026
CVE-2026-105133 Ahsay AhsayCBS Improper authentication October 14, 2026
CVE-2026-105134 Ahsay AhsayCBS OS command injection October 14, 2026
CVE-2026-96652, -96654, -96655, -96656 Plex Media Server SSRF and file write chain October 20, 2026
CVE-2026-106931 SiteGuard Server Edition OS command injection October 20, 2026
CVE-2026-110936 Siemens Software Center DLL hijack October 20, 2026
CVE-2026-110447 Collabora Built-in CODE Server (Nextcloud app) OS command injection October 23, 2026
CVE-2026-114625 Arista VeloCloud Orchestrator SQL injection October 23, 2026

Edge appliances and gateways

Citrix NetScaler. CISA's September 27, 2026 alert covered NetScaler ADC and Gateway zero-days. CVE-2026-88771 gives an unauthenticated attacker command execution (CVSS 9.8) and is fixed in builds 14.1-73.37 and 13.1-64.23. On October 4 CISA added CVE-2026-88779, a denial of service in SAML configurations; on unpatched systems the crash can force a reboot and enable code injected through CVE-2026-88771. That one needs 14.1-73.41 or 13.1-64.28.

Ivanti Connect Secure. CVE-2026-104935 is an authentication bypass by spoofing that yields unauthenticated command execution (CVSS 8.6) in Connect Secure before 25.1.3.0; 22.7R2.14 and earlier are not affected. Ivanti said reliable indicators of compromise were not available.

Palo Alto PAN-OS. CVE-2026-0322 is code injection by an authenticated user of the management interface, yielding root on the firewall (CVSS 4.0 score 8.6). Palo Alto's October 14 advisory reports "very limited exploitation," offers no workaround, and recommends restricting management access to trusted internal addresses.

Cisco Secure Email Gateway. CVE-2026-76519 lets an unauthenticated attacker write arbitrary files on the appliance (CVSS 9.8) when File Reputation is enabled on a mail policy. Fixes are AsyncOS 15.5.5-014 and 16.5.0-780. Cisco confirmed active exploitation in October 2026.

Arista VeloCloud Orchestrator. Arista's advisory of October 22, 2026 rates CVE-2026-114625, a SQL injection in on-prem VCO, at 9.9: any authenticated user, down to the Enterprise Read Only role, can impersonate the local superuser operator. Fixed builds are 5.2.3.18, 6.1.3.10 and 6.4.2.12. CISA did add it: the widely linked October 23 alert covers only Collabora, but a second alert that day lists CVE-2026-114625, and catalog version 2026.10.23 records it as added October 23, due October 26.

A backup server

Ahsay's AhsayCBS pair chains an authentication bypass (CVE-2026-105133, via the random parameter in checkSysPwd) into OS command injection on the Replication Receiver endpoint /rps/api/json/UpdateReceivers.do (CVE-2026-105134, CVSS 10.0). Ahsay's October 12 notice admits its earlier patches, v9.15.2.59 and v10.3.4.0, "did not fully address" the flaws; the hotfixes are v10.3.4.45 and v9.15.2.70, partner-portal only, with a reboot required.

Media and document servers

Plex Media Server. The four CVEs chain into unauthenticated code execution as the Plex process. Plex's notice, updated October 19, says the flaws are "being actively and widely exploited" and a public proof of concept appeared on October 16. Servers older than 1.43.3.10861 that are reachable from the internet should be treated as compromised. Plex recommends turning off Remote Access and not forwarding port 32400.

Collabora Online Built-in CODE Server. CVE-2026-110447 sits in richdocumentscode, the Nextcloud app. An unauthenticated request to proxy.php runs an OS command as the web server user, but only while the built-in CODE server is not running. CVSS 4.0 scores it 9.2; the fix is 26.4.303, and disabling the app is not enough.

Not in the catalog: PHP2Shell

On October 21, 2026 the PHP project shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix CVE-2026-109618 and CVE-2026-109619, two unauthenticated remote code execution flaws rated 9.2 each. The project says there are no complete mitigations; updating is the only safe choice. As of catalog version 2026.10.23 neither CVE is in KEV, but KEV lags; see our PHP2Shell write-up.

What they have in common

  • Reachable without credentials, or with the weakest ones. Citrix, Ivanti, Cisco, Collabora and Plex are unauthenticated. VeloCloud needs only a read-only tenant login. PAN-OS needs a login, but on the management plane.
  • Control planes, not data planes. Firewall management, SD-WAN orchestration, backup replication endpoints, Plex remote access.
  • Chains and unfinished patches. Citrix's denial of service becomes code execution alongside CVE-2026-88771; Ahsay's bypass feeds its injection, and its first patches did not hold.
  • Old software is still being exploited. On October 8, 2026 CISA also added CVE-2015-5477 (ISC BIND), CVE-2015-3306 (ProFTPD) and CVE-2016-3081 (Apache Struts), all still common on rented servers.

Deadlines: the federal clock, and a sensible one for a hosting shop

Since June 10, 2026 the federal deadlines come from BOD 26-04, which replaced BOD 22-01 with tiers based on KEV status, public exposure, automatability and whether exploitation gives total control. The top tier is three days plus forensic triage; the bottom is "fix on system upgrade." In this window, 26 entries got three-day due dates and four got 14 days. It binds federal agencies only; CISA encourages everyone else to follow it.

For a hosting operation, a defensible version is:

  • 72 hours for anything in KEV that is internet-exposed and exploitable without credentials. Day one is for cutting exposure; BOD 26-04 itself extends the clock when an asset leaves the internet.
  • 14 days for KEV entries that need local access or privileges, such as the Siemens and Windows Shell bugs.
  • The normal monthly cycle for everything else; a KEV listing or public proof of concept pulls an item forward.
  • Where the catalog flags forensic triage, add a compromise check; Citrix, Ivanti and Plex all say a patched box may already be owned.

Inventory and exposure reduction

  • Inventory appliances, hypervisors, backup servers and apps-inside-apps. Nobody tracks richdocumentscode as a server, but it is one.
  • Put management planes behind a VPN or an allowlist: PAN-OS management, the VCO web interface, NetScaler administration, Ahsay's API and replication ports.
  • Ship logs off the box; CISA's Citrix guidance warns local logs rotate too quickly to help.
  • After a suspected compromise, rebuild from a clean image and rotate every secret the host could reach.

What changes when a provider manages the box

With a managed server, the provider owns the firmware, hypervisor and OS patch cadence; you still own the application layer: PHP, Nextcloud, Plex, your backup software. BOD 26-04 keeps federal systems "hosted by third parties" in scope and tells agencies to review their contracts, and the same logic applies to a hosting agreement. Ask the provider: their turnaround for KEV entries on exposed systems, whether management interfaces face the public internet, how reboots are scheduled when a fix needs one, and what they will tell you if they find signs of compromise. If the patch window is not written down, it does not exist.

Sources