Flaws added in October 2026
From Exploited flaws, HARD’s guide to the flaws being used in attacks · Updated
This article lists the flaws CISA added in October 2026. For the newest, see Exploited flaws.
So far in October 2026, CISA added 36 flaws to its list of vulnerabilities being used in attacks, 5 of them in things people have at home. Most came from Plex (4), Ivanti (3) and Cisco (2).[1]
Most let an attacker take over the product, running their own code or taking full control. It was the second most CISA added in any month of 2026 so far.
List of flaws
Every flaw CISA added in October 2026, newest first, in plain English, each with an article of its own.[2]
Show
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-118527At work |
Ivanti Connect Secure. Attackers are using a flaw in Ivanti Connect Secure. | At work |
CVE-2026-111357At work |
Ivanti Connect Secure. Someone who already has a foothold can use Ivanti Connect Secure to take full control of the machine. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-97229At work |
GitLab Community Edition and Enterprise Edition. Attackers can run their own code on GitLab Community Edition and Enterprise Edition from anywhere, without logging in. | At work |
CVE-2026-76418At work |
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software. Attackers can corrupt memory in Cisco Secure Firewall ASA Software and Cisco Secure FTD Software from anywhere, without logging in, which they use to take it over. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-46300At work |
Linux Kernel. Attackers are using a flaw in Linux Kernel. | At work |
CVE-2026-41709At work |
Broadcom VMware ESX. Attackers are using a flaw in Broadcom VMware ESX. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-48356At work |
Adobe Commerce and Magento. A booby-trapped web page can run an attacker's code through Adobe Commerce and Magento. | At work |
CVE-2026-111497At work |
Google Brotli. Attackers can run their own code on Google Brotli from anywhere, without logging in. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-109619At work |
PHP. Attackers can run their own code on PHP from anywhere, without logging in. | At work |
CVE-2026-109618At work |
PHP. Attackers can run their own code on PHP from anywhere, without logging in. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-114625At work |
Arista VeloCloud Orchestrator. Attackers can read or change the database behind Arista VeloCloud Orchestrator. | At work |
CVE-2026-110447At work |
Collabora Online – Built-in CODE Server. Attackers can run their own code on Collabora Online – Built-in CODE Server. | At work |
6 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-96656At home |
Plex Media Server. Attackers are using a flaw in Plex Media Server. | At home |
CVE-2026-96655At home |
Plex Media Server. Attackers can make Plex Media Server send requests into the network behind it. | At home |
CVE-2026-96654At home |
Plex Media Server. Attackers are using a flaw in Plex Media Server. | At home |
CVE-2026-96652At home |
Plex Media Server. Attackers can make Plex Media Server send requests into the network behind it. | At home |
CVE-2026-110936At work |
Siemens Software Center. Someone who already has a way in can use Siemens Software Center to run their own code. | At work |
CVE-2026-106931At work |
EG Secure Solutions SiteGuard Server Edition. Attackers can run commands on EG Secure Solutions SiteGuard Server Edition. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-102764At work |
BeyondTrust Remote Support. Attackers can get into BeyondTrust Remote Support without a valid password. | At work |
CVE-2025-61624At work |
Fortinet products. Attackers can reach parts of Fortinet products that should be locked to them. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-21589At work |
Atlassian products. Attackers can read files on Atlassian products that should be out of reach from anywhere, without logging in. | At work |
4 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-76519At work |
Cisco Secure Email Gateway. Attackers can run commands on Cisco Secure Email Gateway from anywhere, without logging in. | At work |
CVE-2026-105134At work |
AhsayCBS. Attackers can run commands on AhsayCBS. | At work |
CVE-2026-105133At work |
AhsayCBS. Attackers can get into AhsayCBS without a valid password. | At work |
CVE-2026-0322At work |
Palo Alto Networks PAN-OS. Someone who already has a way in can use Palo Alto Networks PAN-OS to run their own code. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-96951At home |
Microsoft Windows. Attackers can run commands on Microsoft Windows. | At home |
CVE-2026-104935At work |
Ivanti Connect Secure. Attackers can run commands on Ivanti Connect Secure from anywhere, without logging in. | At work |
5 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-22894At work |
Strapi. Attackers can run their own code on Strapi. | At work |
CVE-2021-3199At work |
ONLYOFFICE Docs. Attackers can run their own code on ONLYOFFICE Docs. | At work |
CVE-2016-3081At work |
Apache Struts. Attackers can run their own code on Apache Struts. | At work |
CVE-2015-5477At work |
ISC BIND. Attackers can crash ISC BIND or stop it working. | At work |
CVE-2015-3306At work |
ProFTPD. Attackers can reach parts of ProFTPD that should be locked to them. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-88779At work |
Citrix NetScaler. Attackers can crash Citrix NetScaler or stop it working. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-102490At work |
Zammad GmbH Zammad. Someone who already has a foothold can use Zammad GmbH Zammad to take full control of the machine. | At work |
CVE-2026-102489At work |
Zammad GmbH Zammad. Attackers can run their own code on Zammad GmbH Zammad. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-104286At work |
Fortinet FortiMail. Attackers can reach parts of Fortinet FortiMail that should be locked to them from anywhere, without logging in. | At work |
Companies
The flaws were in 26 companies’ products; the most were in Plex’s (4).
| Company | Flaws | Ransomware |
|---|---|---|
| Plex | 4 | – |
| Ivanti | 3 | – |
| Ahsay | 2 | – |
| Cisco | 2 | – |
| Fortinet | 2 | – |
| PHP Group | 2 | – |
| Zammad GmbH | 2 | – |
| Adobe | 1 | – |
| Apache | 1 | – |
| Arista | 1 | – |
| Atlassian | 1 | – |
| BeyondTrust | 1 | – |
| Broadcom | 1 | – |
| Citrix | 1 | – |
| Collabora | 1 | – |
| 11 others | 11 |
Other months
Every month since CISA started the list; October 2026 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.