Top 25 Critical Vulnerabilities in October 2026

This shortlist gives security teams 25 CVEs to review. It comes from 1,468 October records with CVSS base scores above 9.0. It includes every matching CISA Known Exploited Vulnerabilities record. It also covers serious flaws in business, cloud, identity, network, security, and build systems.

How The 25 Were Selected

This is an editorial shortlist, not a score-based ranking. The first rule was fixed. We included every CISA KEV record in the frozen October set with an NVD CVSS base score above 9.0. That produced ten CVEs.

We chose the other fifteen for their likely impact on security teams. We favored common business products and public services. We also favored identity, network, security, cloud, and build systems.

Each choice weighed vendor guidance and possible harm. That harm includes code run without a login, admin access, sandbox escape, or backup takeover.

Venom signals helped surface records and compare attention. They did not set NVD scores, release dates, or KEV status.

The source window runs from October 1 to October 29, 2026 at 16:28:26 Europe/Istanbul. NVD and CVE Program records set the date and score checks. Records can change. Confirm the latest vendor fix before acting.

CISA KEV Records Need The First Review

Ten selected CVEs were in CISA’s Known Exploited Vulnerabilities catalog at the cutoff. This is proof of known exploitation. Review them before flaws chosen only for severity.

The set goes beyond edge devices. It includes PHP and Brotli flaws, a backup tool, team software, mail gateways, remote support, and an SD-WAN control server.

The PHP pair, CVE-2026-109618 and CVE-2026-109619, needs one joint response. Both can lead to remote code run through request-state faults. PHP may also sit inside devices or packed apps. A normal software list may not show those copies.

CVE-2026-111497 creates a similar supply-chain problem. A direct package search may miss Brotli in runtimes and operating-system packages.

For device CVEs, patching is only one step. FortiMail, Cisco Secure Email Gateway, BeyondTrust Remote Support, and VeloCloud Orchestrator hold admin roles and useful logs. Check admin events, odd files, new accounts, changed links, and outbound traffic. Focus on the likely exposure period.

For Collabora’s built-in CODE Server, the vendor scope matters. The affected Nextcloud setup differs from standalone Collabora Online servers.

Priority rule: KEV status shows known exploitation. It does not prove that every organization was targeted. Check product presence, exposure, affected versions, and signs of compromise at the same time.

Internet-Facing Enterprise Systems Carry Direct Operational Risk

Start the non-KEV review with systems open to users, admins, or the public internet. Oracle E-Business Suite CVE-2026-101767 can allow takeover of the Application Object Library through HTTP without a login. FortiSIEM CVE-2026-106173 affects a security system.

GitLab’s two October fixes cover separate code-run paths that need no login. The later CVE-2026-110264 update matters. The first patch is not enough when the later affected range applies.

Cisco Expressway CVE-2026-76466 can lead to root command execution when an attacker has the needed persistent cookies. Patch the system and end active sessions. Then review access to the database service.

The two NGINX CVEs need a check of each server setup. They affect specific alias, rewrite, request-filename, AIO, and SSI combinations. Do not dismiss an exposed reverse proxy only because an attack needs those settings.

Veeam Backup & Replication CVE-2026-108142 affects a key recovery system. The flaw can bypass access checks on the CDP Coordinator Service without a login. Keep backup admin systems apart from other networks after the fix. This can block a path from a breached app network into recovery systems.

Cloud And Developer Infrastructure Expand The Blast Radius

Several records affect tools that build, deploy, or run other software. Microsoft’s Azure Kubernetes Configuration Service flaw lacks a key sign-in check. A remote attacker can gain more rights. HashiCorp’s Consul Kubernetes flaw crosses namespace bounds through ACL binding rules.

These are not only patch tasks. Review recent roles, service IDs, namespace trust, and cluster setup changes.

MLflow CVE-2026-116692 matters when AI or model build services are exposed. The flaw can run code only when the selected scorer package is writable.

If authentication is off, an attacker needs no login. If basic authentication is on, the attacker needs an account that can upload artifacts. The writable-package condition applies in both cases.

Google Cloud MCP Toolbox CVE-2026-93328 shows a related gap in agent tools.

For the MCP Toolbox flaw, crafted inputs can move host files to cloud storage or overwrite local files. Require endpoint sign-in. Use narrow service accounts and limit writable paths.

Wasmtime CVE-2026-115893 can let a crafted WebAssembly module escape the sandbox on affected AArch64 engines. Adobe Campaign Classic CVE-2026-104351 gives a low-privileged user a path to run code. Chrome CVE-2026-118306 uses a crafted page and may run code outside the browser sandbox.

These products sit in different layers. Update them, then confirm the fixed version runs on each managed endpoint or service.

Compact Review Table

The table groups related product findings so teams can scan it fast. All 25 CVE IDs remain visible and link to NVD. Each fix link opens the official vendor or project page.

Action Checklist For Security Teams

• 1. Match assets before sorting scores. For each CVE, record exposure, business impact, sensitive data, and other controls.
• 2. Put KEV and exposed management systems first. Start with known exploitation. Next, review public email, remote access, team, backup, and orchestration systems.
• 3. Patch product families as a unit. Treat the PHP, GitLab, and NGINX pairs as coordinated work so one related CVE is not left behind.
• 4. Hunt where the product has high access. Review new accounts, file writes, commands, setup changes, sessions, tokens, and odd outbound traffic.
• 5. Search for hidden dependencies. Use software bills of materials, container lists, package locks, and vendor notices to find Brotli, PHP, and runtime copies.
• 6. Confirm the running version. Check service restarts, browser relaunches, cluster rollouts, appliance upgrades, and managed endpoints.
• 7. Reduce exposure after patching. Limit management interfaces to trusted networks. Isolate backup and security systems, require sign-in, and keep service-account rights low.
• 8. Record exceptions with owners. If a fix must wait, record the exposed asset, other controls, alert coverage, owner, and review date.

Continue The Investigation With Brandefense

Brandefense is an AI-driven threat intelligence platform that unifies Cyber Threat Intelligence, Digital Risk Protection and External Attack Surface Management. Teams that want to review their workflow can request a Brandefense demonstration.

Scope note: This article covers the frozen set through October 29, 2026 at 16:28:26 Europe/Istanbul. It does not replace asset tests, vendor guidance, or incident response. Venom was used only to find records and add context.