Fortinet
Fortinet fixed CVE-2025-61624 in April and rated it Medium. In October, CISA added it to KEV after Unit 42 showed it helping deploy PEERSTITCH, a memory-only implant on FortiGate firewalls. Here are the fixed versions and what to hunt for.
Linux
A Linux kernel flaw, CVE-2026-99999 (PwnEscape), lets code inside a guest VM read host memory. It scores 9.3, needs a foothold in a guest, and has no reported exploitation. Fixed kernels are available for every stable branch.
Cisco
CISA added four CVEs to KEV on October 14: Cisco Secure Email Gateway, AhsayCBS, and Palo Alto PAN-OS. All were exploited before a full fix existed, and the due date for every one is October 17.
Ivanti
Ivanti warned that CVE-2026-104935, an authentication bypass in Connect Secure, is exploited in the wild. Volexity saw a three-flaw chain reach root on a fully patched VPN, and the third flaw still has no fix.
Patch Tuesday
Microsoft's October 2026 Patch Tuesday is the largest ever, with roughly 1,400 fixes. One Windows Shell flaw, CVE-2026-96951, was exploited and has an October 16 CISA deadline. Here is what to patch first.
Active Exploitation
CISA added five CVEs to KEV on October 8, all from 2015 to 2023: ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND. A joint advisory ties them to a China-linked campaign, and EPSS scores range from 3.6 to 99.5 percent.
Weekly Digest
Six exploited CVEs reached CISA's KEV catalog between September 29 and October 4, covering Apple, Cisco, Fortinet, Zammad, and NetScaler. Each calls for a different first move, from a simple upgrade to a workaround because no patch exists.
Citrix
Citrix calls CVE-2026-88779 a NetScaler denial of service, but admins logged shell commands in SAML login requests and a patched honeypot ran a malware binary. Citrix has not confirmed code execution. Appliances with the earlier fixes need this update too.
Zammad
DIVD, the nonprofit that discloses vulnerabilities for a living, was breached through its own Zammad helpdesk in what it calls an agentic AI-powered attack chaining CVE-2026-102489 and CVE-2026-102490. The RCE half is patchable. The root-level flaw still has no fix.
Zero-Day
Fortinet disclosed CVE-2026-104286, a CVSS 9.8 path traversal flaw in FortiMail, with active exploitation already underway and no fixed release available for any affected branch. Here's the mechanism, the IOCs to check, and the workaround Fortinet is recommending until patches ship.
Cisco
A CVSS 9.8 authentication bypass in Cisco Catalyst SD-WAN Manager, found by Cisco's own support team during a TAC case and now under active exploitation. No workaround exists. Here's the mechanism, who's affected, and what to check in your logs.
Zero-Day
Citrix confirmed active exploitation of two NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, after a weekend of quiet shutdown warnings and NCSC pre-notifications. Here's the mechanism, who's affected, and the September 30 deadline.