Monthly roundups
A monthly summary of key incidents, vulnerabilities and CVEs, with a checklist.
Vulnerabilities to patch now
Every flaw added to the CISA KEV catalog (confirmed exploited) since August 2026 that affects servers, Windows and network devices, plus selected critical flaws, each with its fix. Updated automatically; details are in our monthly security roundups.
- Exploited
Ivanti Connect Secure
CVE-2026-111357CVE-2026-118527Fix: 2 flaws (missing authentication and predictable identifiers). The most severe lets a local attacker escalate privileges. Can be chained with CVE-2026-104935. Update to the latest version per the vendor advisory and keep management interfaces off the internet.
Vendor advisory Source: CISA KEV - ExploitedCVSS 9.2
PHP (PHP2Shell)
CVE-2026-109618CVE-2026-109619Fix: Broadly exploited, in KEV since 26 Oct. Update to PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, then restart PHP-FPM or the web server
Details - ExploitedCVSS 7.8
Linux kernel
CVE-2026-46300Fix: Chained with PHP2Shell for root. Update the kernel (e.g. 6.1.174, 6.6.141, 6.12.91, 6.18.33) and reboot
Details - ExploitedCVSS 8.8
Windows (October Patch Tuesday)
CVE-2026-96951Fix: Install the October 2026 cumulative updates
Details - ExploitedCVSS 8.6
Ivanti Connect Secure
CVE-2026-104935Fix: Update to 25.1.1.3 or 22.8R2.6 and hunt for compromise; even patched appliances were breached
Details - Exploited
Fortinet FortiOS
CVE-2025-61624Fix: Update per FG-IR-26-122, patch FortiManager, check for unknown admin accounts (PEERSTITCH implant)
Details - ExploitedCVSS 9.2
MikroTik RouterOS
CVE-2026-67277CVE-2026-86060Fix: Update per MikroTik's advisory; restrict the btest service and Winbox/WebFig/SSH access to trusted IPs
Details - Critical
cPanel & WHM
CVE-2026-87899Fix: Any cPanel account can become root. Run upcp --force (11.134.0.57 / 11.136.0.41 / 11.138.0.8)
Details - ExploitedCVSS 8.6
Palo Alto PAN-OS
CVE-2026-0322Fix: Update PAN-OS; no workaround, so restrict the management interface to internal IPs
Details - ExploitedCVSS 8.6
Cisco ASA / FTD
CVE-2026-76418Fix: SSL VPN can be forced to reboot without login. Update per Cisco's advisory; no workaround
Details - ExploitedCVSS 9.5
Citrix NetScaler ADC / Gateway
CVE-2026-88771CVE-2026-88772CVE-2026-88779Fix: Update to 14.1-73.41 or 13.1-64.28 (covers the September and October flaws), then check for compromise
Details - ExploitedCVSS 8.1
Roundcube Webmail
CVE-2026-48842Fix: Update to 1.6.16 or 1.7.1
Details - ExploitedCVSS 10
GitLab CE/EE
CVE-2026-97229Fix: Update to 19.4.2 / 19.3.5 / 19.2.8
Details - Exploited
Zimbra Collaboration
CVE-2026-73570Fix: Update to ZCS 10.1.20 or later; applies when zimbra-snmp and SNMP notifications are enabled
Details - Exploited
VMware ESX
CVE-2026-41709Fix: An insufficient logging flaw lets an attacker abuse the system. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
Google Brotli
CVE-2026-111497Fix: An improper input validation flaw lets an unauthenticated attacker remotely run code on the system. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
Adobe Commerce and Magento
CVE-2026-48356Fix: A malicious file upload flaw lets an attacker run code on the system. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
Collabora Online – Built-in CODE Server
CVE-2026-110447Fix: A command injection flaw lets an attacker remotely run code on the system. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
Arista VeloCloud Orchestrator
CVE-2026-114625Fix: A SQL injection flaw lets an attacker remotely abuse the system. Update to the latest version per the vendor advisory and keep management interfaces off the internet.
Vendor advisory Source: CISA KEV - Exploited
EG Secure Solutions SiteGuard Server Edition
CVE-2026-106931Fix: A command injection flaw lets an attacker escalate privileges. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
Plex Media Server
CVE-2026-96652CVE-2026-96654CVE-2026-96655CVE-2026-96656Fix: 4 flaws (SSRF). The most severe lets an attacker abuse the system. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
BeyondTrust Remote Support
CVE-2026-102764Fix: An authentication bypass flaw lets an attacker remotely bypass authentication. Update to the latest version per the vendor advisory and keep management interfaces off the internet.
Vendor advisory Source: CISA KEV - Exploited
Atlassian Multiple Products
CVE-2026-21589Fix: A sensitive data exposure flaw lets an unauthenticated attacker abuse the system. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
AhsayCBS
CVE-2026-105133CVE-2026-105134Fix: 2 flaws (authentication bypass and command injection). The most severe lets an attacker remotely bypass authentication. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
Cisco Secure Email Gateway
CVE-2026-76519Fix: A path traversal flaw lets an unauthenticated attacker remotely abuse the system. Update to the latest version per the vendor advisory and keep management interfaces off the internet.
Vendor advisory Source: CISA KEV - Exploited
ProFTPD
CVE-2015-3306Fix: A weak access control flaw lets an attacker remotely read sensitive data. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
ISC BIND
CVE-2015-5477Fix: An improper input validation flaw lets an attacker remotely crash or reload the device (DoS). Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
Apache Struts
CVE-2016-3081Fix: A command injection flaw lets an attacker remotely run code on the system. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
ONLYOFFICE Docs
CVE-2021-3199Fix: A path traversal flaw lets an attacker remotely run code on the system. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
Strapi
CVE-2023-22894Fix: A sensitive data exposure flaw lets an attacker remotely run code on the system. Can be chained with CVE-2023-22621. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
Zammad
CVE-2026-102489CVE-2026-102490Fix: 2 flaws (session fixation and privilege escalation). The most severe lets an attacker remotely run code on the system. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
Fortinet FortiMail
CVE-2026-104286Fix: A path traversal flaw lets an unauthenticated attacker abuse the system. Update to the latest version per the vendor advisory and keep management interfaces off the internet.
Vendor advisory Source: CISA KEV - Exploited
Cisco Catalyst SD-WAN Manager
CVE-2026-76504Fix: An improper input validation flaw lets an unauthenticated attacker remotely abuse the system. Update to the latest version per the vendor advisory and keep management interfaces off the internet.
Vendor advisory Source: CISA KEV - Exploited
Microsoft SharePoint
CVE-2026-65660Fix: A code injection flaw lets an attacker run code on the system. Install the latest Microsoft security update and reboot.
Vendor advisory Source: CISA KEV - Exploited
MikroTik RouterOS
CVE-2026-67279Fix: A security flaw lets an unauthenticated attacker abuse the system. Can be chained with CVE-2026-86060. Update to the latest version per the vendor advisory and keep management interfaces off the internet.
Vendor advisory Source: CISA KEV - Exploited
WordPress Core
CVE-2026-87902Fix: A remote file inclusion flaw lets an unauthenticated attacker run code on the system. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
WSO2 Multiple Products
CVE-2026-5430Fix: A path traversal flaw lets an attacker remotely run code on the system. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
Adobe Commerce and Magento
CVE-2026-71362Fix: A weak access control flaw lets an attacker escalate privileges. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
Check Point Multiple Products
CVE-2026-85102CVE-2026-93616Fix: 2 flaws (improper certificate validation and path traversal). The most severe lets an unauthenticated attacker remotely run code on the system. Update to the latest version per the vendor advisory and keep management interfaces off the internet.
Vendor advisory Source: CISA KEV - Exploited
Arista VeloCloud Orchestrator
CVE-2026-93952Fix: An improper input validation flaw lets an attacker remotely abuse the system. Update to the latest version per the vendor advisory and keep management interfaces off the internet.
Vendor advisory Source: CISA KEV - Exploited
F5 BIG-IP APM
CVE-2026-94127Fix: A memory corruption flaw lets an unauthenticated attacker remotely run code on the system. Update to the latest version per the vendor advisory and keep management interfaces off the internet.
Vendor advisory Source: CISA KEV - Exploited
Zyxel GS1900 Series Switches
CVE-2026-7273Fix: A command injection flaw lets an unauthenticated attacker abuse the system. Update to the latest version per the vendor advisory and keep management interfaces off the internet.
Vendor advisory Source: CISA KEV - Exploited
Linux Kernel
CVE-2025-39682CVE-2025-39964CVE-2026-53266Fix: 3 flaws (improper input validation, race condition and memory corruption). The most severe lets an attacker bypass authentication. Install the kernel update from your distro, then reboot the server.
Vendor advisory Source: CISA KEV - Exploited
Cisco Identity Services Engine
CVE-2026-76460Fix: A misuse of privileged APIs flaw lets an unauthenticated attacker remotely bypass authentication. Update to the latest version per the vendor advisory and keep management interfaces off the internet.
Vendor advisory Source: CISA KEV - Exploited
Acronis Backup
CVE-2026-87886Fix: A privilege escalation flaw lets an attacker abuse the system. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
Cisco Secure Email Gateway
CVE-2026-76461Fix: A SQL injection flaw lets an unauthenticated attacker remotely run code on the system. Update to the latest version per the vendor advisory and keep management interfaces off the internet.
Vendor advisory Source: CISA KEV - Exploited
JFrog Artifactory
CVE-2026-42016CVE-2026-42018Fix: 2 flaws (privilege escalation and authentication bypass). The most severe lets an unauthenticated attacker abuse the system. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
ConnectWise ScreenConnect
CVE-2026-84869Fix: A privilege escalation flaw lets an attacker remotely abuse the system. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
GitLab CE/EE
CVE-2026-85706Fix: A path traversal flaw lets an unauthenticated attacker read sensitive data. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
Fortinet Multiple Products
CVE-2025-25249Fix: A memory corruption flaw lets an attacker abuse the system. Update to the latest version per the vendor advisory and keep management interfaces off the internet.
Vendor advisory Source: CISA KEV - Exploited
Citrix NetScaler
CVE-2026-19490Fix: An authentication bypass flaw lets an unauthenticated attacker remotely bypass authentication. Update to the latest version per the vendor advisory and keep management interfaces off the internet.
Vendor advisory Source: CISA KEV - Exploited
Cisco Secure Firewall Management Center (FMC)
CVE-2026-20079Fix: An authentication bypass flaw lets an unauthenticated attacker remotely bypass authentication. Update to the latest version per the vendor advisory and keep management interfaces off the internet.
Vendor advisory Source: CISA KEV - Exploited
Adobe Commerce and Magento
CVE-2026-75650Fix: A security flaw lets an attacker run code on the system. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
Microsoft Windows
CVE-2026-81963CVE-2026-85880Fix: 2 flaws (link following and memory corruption). The most severe lets a local attacker escalate privileges. Install the latest Microsoft security update and reboot.
Vendor advisory Source: CISA KEV - Exploited
N-able N-central
CVE-2026-86218Fix: A code injection flaw lets an unauthenticated attacker remotely run code on the system. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
Kludex Starlette
CVE-2026-48710Fix: An authentication bypass flaw lets an attacker bypass authentication. Can be chained with CVE-2026-42271. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
Kestra OSS
CVE-2026-49869Fix: A command injection flaw lets an unauthenticated attacker remotely abuse the system. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
BerriAI LiteLLM
CVE-2026-59822Fix: An authentication bypass flaw lets an unauthenticated attacker abuse the system. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
JFrog Artifactory
CVE-2026-82329Fix: An authentication bypass flaw lets an unauthenticated attacker read sensitive data. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
SonicWall SMA1000 Appliances
CVE-2026-83548CVE-2026-83549Fix: 2 flaws (SSRF and command injection). The most severe lets an authenticated attacker remotely run code on the system. Update to the latest version per the vendor advisory and keep management interfaces off the internet.
Vendor advisory Source: CISA KEV - Exploited
Sangoma Switchvox
CVE-2026-9586Fix: A SQL injection flaw lets an unauthenticated attacker remotely run code on the system. Update to the latest version per the vendor advisory and keep management interfaces off the internet.
Vendor advisory Source: CISA KEV - Exploited
PaperCut NG/MF
CVE-2026-81578CVE-2026-82078Fix: 2 flaws (missing authentication and unsafe reflection). The most severe lets an unauthenticated attacker remotely abuse the system. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
ownCloud
CVE-2023-49105Fix: An authentication bypass flaw lets an unauthenticated attacker abuse the system. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
Linux Kernel
CVE-2026-53362Fix: A privilege escalation flaw lets an attacker abuse the system. Install the kernel update from your distro, then reboot the server.
Vendor advisory Source: CISA KEV - Exploited
JFrog Artifactory
CVE-2026-66384Fix: A security flaw lets an authenticated attacker remotely abuse the system. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
Red Hat Libuser
CVE-2015-3246Fix: A privilege escalation flaw lets a local attacker crash or reload the device (DoS). Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
Red Hat Automatic Bug Reporting Tool
CVE-2015-5287Fix: A predictable identifiers flaw lets a local attacker abuse the system. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
Microsoft SQL Server
CVE-2019-1068Fix: A security flaw lets an attacker remotely run code on the system. Install the latest Microsoft security update and reboot.
Vendor advisory Source: CISA KEV - Exploited
Ajax.NET Professional
CVE-2021-23758Fix: An unsafe deserialization flaw lets an attacker remotely run code on the system. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
Linux Kernel
CVE-2022-0995Fix: A memory corruption flaw lets a local attacker crash or reload the device (DoS). Install the kernel update from your distro, then reboot the server.
Vendor advisory Source: CISA KEV - Exploited
Citrix NetScaler ADC and NetScaler Gateway
CVE-2026-8452Fix: An improper input validation flaw lets an attacker crash or reload the device (DoS). Update to the latest version per the vendor advisory and keep management interfaces off the internet.
Vendor advisory Source: CISA KEV - Exploited
Gitea
CVE-2026-60004Fix: A code injection flaw lets an attacker abuse the system. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in
CVE-2026-21962Fix: A weak access control flaw lets an attacker abuse the system. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
TrueConf Server
CVE-2026-72529CVE-2026-72530Fix: 2 flaws (missing authentication and code injection). The most severe lets an attacker remotely run code on the system. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
MLflow
CVE-2026-64849Fix: A SSRF flaw lets an attacker abuse the system. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
Microsoft Internet Key Exchange (IKE) Service Extensions
CVE-2026-33824Fix: A double free flaw lets an attacker remotely run code on the system. Install the latest Microsoft security update and reboot.
Vendor advisory Source: CISA KEV - Exploited
Microsoft SharePoint
CVE-2026-55040Fix: A weak access control flaw lets an attacker bypass authentication. Install the latest Microsoft security update and reboot.
Vendor advisory Source: CISA KEV - Exploited
VMware vCenter
CVE-2026-59310Fix: A path traversal flaw lets an attacker run code on the system. Used by ransomware groups. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
Ray-Project Ray
CVE-2025-62593Fix: A code injection flaw lets an attacker remotely run code on the system. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
Cisco Secure Firewall ASA / FTD
CVE-2026-20349Fix: A security flaw lets an unauthenticated attacker remotely crash or reload the device (DoS). Update to the latest version per the vendor advisory and keep management interfaces off the internet.
Vendor advisory Source: CISA KEV - Exploited
Microsoft Windows Ancillary Function Driver for WinSock
CVE-2026-68820Fix: An use-after-free flaw lets an attacker escalate privileges. Install the latest Microsoft security update and reboot.
Vendor advisory Source: CISA KEV - Exploited
Metabase
CVE-2026-72898Fix: A SQL injection flaw lets an unauthenticated attacker remotely read sensitive data. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
Progress LoadMaster
CVE-2026-8037Fix: A command injection flaw lets an authenticated attacker run code on the system. Update to the latest version per the vendor advisory and keep management interfaces off the internet.
Vendor advisory Source: CISA KEV - Exploited
JetBrains TeamCity
CVE-2026-63077Fix: An unsafe deserialization flaw lets an unauthenticated attacker remotely run code on the system. Used by ransomware groups. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
N-able N-central
CVE-2026-18556Fix: An authentication bypass flaw lets an attacker bypass authentication. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
Apache Tomcat
CVE-2026-34486Fix: A sensitive data exposure flaw lets an attacker bypass authentication. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
IBM Langflow
CVE-2026-9198Fix: A code injection flaw lets an unauthenticated attacker remotely run code on the system. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV - Exploited
N-able N-central
CVE-2026-18577Fix: An authentication bypass flaw lets an attacker bypass authentication. Can be chained with CVE-2026-18556. Apply the vendor update, then restart the affected service.
Vendor advisory Source: CISA KEV
No matching vulnerabilities.
Security Roundup October 2026: PHP2Shell, a Wave of VPN Zero-Days and Breached VPS Platforms
The key incidents and vulnerabilities of October 2026: PHP2Shell, a 1,413-CVE Patch Tuesday, Ivanti, Palo Alto, Fortinet and Cisco zero-days, the Fore Coffee breach and Q3 DDoS trends.
Read articleSecurity Roundup September 2026: cPanel, MikroTik, Citrix and the Biggest Patch Tuesday Yet
The key incidents and vulnerabilities of September 2026: a cPanel root flaw, MikroTik RouterOS, the Acronis backup plugin, Citrix and Check Point VPNs, Roundcube and Indonesia's PDP agency.
Security Roundup August 2026: cPanel, Zimbra, vCenter and a Ransomware Record
The key incidents and vulnerabilities of August 2026: two critical cPanel flaws, Zimbra servers breached, vCenter attacks ending in ransomware, Patch Tuesday and DDoS trends.
