Exploited in October 2026: Ivanti, Windows, PAN-OS, Cisco and Ahsay lead 26 additions
Black Shard advisories cover the five products in the headline. PHP2Shell is not in the catalogue at this release.
Threat intelligence
Covers to 23 Oct 2026
Lead source CISA, Known Exploited Vulnerabilities Catalog (release 2026.10.23)
October so far
These are the additions to catalogue release 2026.10.23. Six of the 26 carry identifiers from 2025 or earlier, among them a 2015 ISC BIND flaw and a 2016 Apache Struts flaw added on 8 October.
Added: 1 Oct
- Product
- Fortinet FortiMail
- CVE
- CVE-2026-104286
- Flaw
- Path traversal
Added: 4 Oct
- Product
- Citrix NetScaler
- CVE
- CVE-2026-88779
- Flaw
- Memory buffer flaw
Added: 13 Oct
- Product
- Ivanti Connect Secure
- CVE
- CVE-2026-104935
- Flaw
- Authentication bypass, command execution
Added: 13 Oct
- Product
- Microsoft Windows
- CVE
- CVE-2026-96951
- Flaw
- Windows Shell security feature bypass
Added: 14 Oct
- Product
- Palo Alto Networks PAN-OS
- CVE
- CVE-2026-0322
- Flaw
- Management interface code injection
Added: 14 Oct
- Product
- Cisco Secure Email Gateway
- CVE
- CVE-2026-76519
- Flaw
- File write from a crafted attachment
Added: 14 Oct
- Product
- AhsayCBS
- CVE
- CVE-2026-105133, CVE-2026-105134
- Flaw
- Authentication bypass chained to command injection
Added: 15 Oct
- Product
- Atlassian, multiple products
- CVE
- CVE-2026-21589
- Flaw
- Files exposed to external parties
Added: 16 Oct
- Product
- BeyondTrust Remote Support
- CVE
- CVE-2026-102764
- Flaw
- Authentication bypass by spoofing
Added: 16 Oct
- Product
- Fortinet, multiple products
- CVE
- CVE-2025-61624
- Flaw
- Path traversal
Added: 23 Oct
- Product
- Arista VeloCloud Orchestrator
- CVE
- CVE-2026-114625
- Flaw
- SQL injection
Added: 23 Oct
- Product
- Collabora Online built-in CODE server
- CVE
- CVE-2026-110447
- Flaw
- OS command injection
| Added | Product | CVE | Flaw |
|---|---|---|---|
| 1 Oct | Fortinet FortiMail | CVE-2026-104286 | Path traversal |
| 4 Oct | Citrix NetScaler | CVE-2026-88779 | Memory buffer flaw |
| 13 Oct | Ivanti Connect Secure | CVE-2026-104935 | Authentication bypass, command execution |
| 13 Oct | Microsoft Windows | CVE-2026-96951 | Windows Shell security feature bypass |
| 14 Oct | Palo Alto Networks PAN-OS | CVE-2026-0322 | Management interface code injection |
| 14 Oct | Cisco Secure Email Gateway | CVE-2026-76519 | File write from a crafted attachment |
| 14 Oct | AhsayCBS | CVE-2026-105133, CVE-2026-105134 | Authentication bypass chained to command injection |
| 15 Oct | Atlassian, multiple products | CVE-2026-21589 | Files exposed to external parties |
| 16 Oct | BeyondTrust Remote Support | CVE-2026-102764 | Authentication bypass by spoofing |
| 16 Oct | Fortinet, multiple products | CVE-2025-61624 | Path traversal |
| 23 Oct | Arista VeloCloud Orchestrator | CVE-2026-114625 | SQL injection |
| 23 Oct | Collabora Online built-in CODE server | CVE-2026-110447 | OS command injection |
Where the month points
Remote access gateways, firewalls, email gateways and remote support tools account for 7 of the 12 selected entries. Each sits on the internet by design and is often outside the patch tooling that covers laptops and servers.
PHP2Shell, CVE-2026-109618 and CVE-2026-109619, has an advisory of its own.
- Match each entry against the internet-facing inventory
- Patch perimeter and remote access devices first
- Check each patched device for access that predates the fix
Sources
- PrimaryCISA, Known Exploited Vulnerabilities Catalog (release 2026.10.23)Retrieved 25 Oct 2026
- PrimaryNVD, CVE-2026-109618Retrieved 25 Oct 2026
- PrimaryNVD, CVE-2026-109619Retrieved 25 Oct 2026
