From 13 to 16 October 2026, CISA added nine vulnerabilities to its Known Exploited Vulnerabilities catalog. They come from eight vendors. Seven of the nine due dates have already passed, and two fall today. This page lists every entry, what the flaw is, the fix, and a reasoned order for patching.
All dates and flaw descriptions come from the CISA catalog feed (version 2026.10.16). The fixes come from the vendor advisories or from the NVD record where the advisory could not be opened. CISA marks the ransomware use of all nine entries as “Unknown”.
Which flaws did CISA add this week?
| Product and CVE | The flaw in plain words | Added to KEV | CISA due date | Fix |
|---|---|---|---|---|
| Ivanti Connect Secure, CVE-2026-104935 | A remote user with no login can fake an identity and run commands | 13 Oct | 16 Oct | Move to 25.1.1.2, 25.1.3.0 or later, or 22.8R2.5, the fixed versions in the NVD record |
| Microsoft Windows, CVE-2026-96951 | Bad input in the Windows Shell lets an attacker bypass a security feature over the network | 13 Oct | 16 Oct | Install the Microsoft update for your Windows version; the NVD record lists the fixed builds |
| AhsayCBS, CVE-2026-105133 | Login check can be bypassed | 14 Oct | 17 Oct | Apply hotfix 10.3.4.45 (version 10) or 9.15.2.70 (versions 7 to 9), then reboot |
| AhsayCBS, CVE-2026-105134 | An attacker can run operating system commands; CISA says it chains with the flaw above | 14 Oct | 17 Oct | Same hotfixes as above |
| Cisco Secure Email Gateway, CVE-2026-76519 | A crafted email attachment lets an unauthenticated attacker write files to the device | 14 Oct | 17 Oct | Update Content Scanner Tools to 25.3.0.5525 or later, or upgrade to 15.5.5-014 or 16.5.0-780 |
| PAN-OS, CVE-2026-0322 | Code injection lets a logged-in attacker run code as root on the firewall | 14 Oct | 17 Oct | Upgrade to the fixed release for your branch, for example 12.2.4, 11.2.16 or 11.1.16-h3 |
| Atlassian Data Center products, CVE-2026-21589 | An attacker with no login can read files in the web application folder | 15 Oct | 18 Oct | Patch to a fixed version, for example Confluence Data Center 9.2.26 or 10.2.19 |
| BeyondTrust Remote Support, CVE-2026-102764 | The product does not check where messages come from, so an attacker can run file operations on the appliance | 16 Oct | 19 Oct | Follow the vendor’s BT26-05 instructions; NVD lists versions up to 26.2.3 as affected |
| FortiOS and related products, CVE-2025-61624 | A path traversal lets an admin-level user write or delete files through special commands | 16 Oct | 19 Oct | Upgrade to 7.6.5 or later on FortiOS 7.6, or 7.4.10 or later on 7.4 |
The Atlassian advisory covers Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible and Fisheye, and says all versions before its fixed releases are affected. NVD currently marks its own record for this CVE as rejected. The vendor advisory and the CISA entry still stand.
What should you patch first?
Start with anything an outsider can reach without a login. Then move to devices that need a login or sit deeper in the network. The reasoning, not an exploitation report, drives this order.
- Ivanti Connect Secure. It is a remote access gateway, it faces the internet, and CISA describes the attacker as unauthenticated. Its due date was 16 October. Ivanti gateways have been on the list before, for example CVE-2025-0282. Our page on the new one is CVE-2026-104935.
- BeyondTrust Remote Support. Another remote access tool, and it controls access to other machines. Read the CVE-2026-102764 page and apply the vendor steps today.
- Cisco Secure Email Gateway. A mail gateway receives messages from anyone. Cisco lists no workaround, and the Content Scanner Tools update needs no restart.
- Atlassian Data Center. No login is needed, and the vendor says to take internet-facing instances off the internet if you cannot patch yet.
- AhsayCBS. Two flaws that CISA says can be chained: first bypass the login, then run commands. Patch both together.
- PAN-OS. The attacker needs network access and a login, and the vendor reports very limited exploitation against the management interface. Fix it soon, and make sure that interface is not open to the internet. Compare with CVE-2024-3400 and our page on CVE-2026-0322.
- Fortinet products. The attacker must already hold an admin profile with write rights. The vendor rates it medium. Still patch it, because it is on the list. Details are on the CVE-2025-61624 page; the older CVE-2024-55591 was an authentication bypass, a different kind of flaw.
- Windows. Most teams get this through the normal monthly update cycle. Check that the update reached every machine.
How do you use the due dates?
The due dates are set by CISA for US federal agencies. Other organizations can still use them as a clock. Each entry here gives three days from its KEV date.
Next steps for today: list which of these products you run, mark the ones reachable from the internet, and patch in the order above. For the method behind this kind of ranking, read CVSS, EPSS and CISA KEV: what each signal tells you.