Topic
CISA's KEV catalog and the binding remediation deadlines it imposes on US federal agencies, with advisory weight for private organizations.
CISA added Atlassian's CVE-2026-21589, rated CVSS 9.3, to its Known Exploited Vulnerabilities catalog on October 15. An attacker needs a file's exact path, and in one watchTowr test that was enough to reach Jira administrator access.
Reality
Palo Alto Networks patched CVE-2026-0322 (CVSS 8.6), a PAN-OS management RCE it says is under limited exploitation. CISA gave federal agencies until October 17; exploiting it takes a valid login and network access to the management interface.
Perspective Coverage
5 publishersReality
CISA added four exploited flaws in PAN-OS, Cisco Secure Email Gateway and AhsayCBS to KEV with an October 17 federal deadline. We would take the Cisco gateway first, then AhsayCBS servers already patched once, then PAN-OS.
Perspective Coverage
3 publishersReality
Cisco Talos counts more than 70,000 CVEs by the end of September, up 105% on a year earlier, while CISA's KEV catalog grew 37%. Its newsletter says the backlog of exploited bugs from older CVEs is where the patching work sits.
Reality
CISA added CVE-2026-93616, a 9.8-rated Check Point management flaw, to its Known Exploited Vulnerabilities catalog on September 22, 2026. A dev.to write-up says no final patch covers every release yet, so port exposure is the control.
Reality
CISA added five exploited flaws in BIND, ProFTPD, Struts, ONLYOFFICE and Strapi to its KEV catalog on 8 October, each due 11 October. All five run on self-hosted servers, so the work starts with an inventory and a compromise check.
Reality
CISA gave federal agencies until October 11 to fix five flaws China-linked Flax Typhoon has exploited, the oldest carrying 2015 CVE numbers. For other operators, each bug's preconditions decide which old servers need the patch first.
Perspective Coverage
3 publishersReality
F5 published CVE-2026-94127, a CVSS 9.8 heap overflow in BIG-IP APM that lets an attacker run code without credentials. Only virtual servers that pair an access policy with an OAuth Authorization Server profile are exposed, so the configuration check comes first.
Reality
Cisco disclosed CVE-2026-76504, a CVSS 9.8 authentication bypass in Catalyst SD-WAN Manager that is already exploited and has no workaround. A dev.to analysis says one Manager can administer up to 6,000 devices, so patching is the only defense.
Reality
Cisco rated a flaw in Identity Services Engine's management API CVSS 10.0 because one crafted, unauthenticated request could reach root. A dev.to analysis traces the likely gap to route coverage in the Kong-derived gateway that authenticates the API, a risk any proxy-authenticated service shares.
Reality
Atlassian disclosed a 9.3-rated flaw, CVE-2026-21589, that lets attackers with no login read known files in 8 self-hosted Data Center products. It wants internet-facing instances taken offline or cut off from outside access until they are upgraded or behind a blocking rule.
Perspective Coverage
15 publishersReality
The FBI and six other governments said on October 8 that hackers tied to Integrity Technology Group run a portal giving third parties access to stolen email. The firm, sanctioned by the US and UK, denies the accusations.
Reality
WordPress shipped 7.1.2 on 22 September 2026 to patch CVE-2026-87902, an unauthenticated path-traversal flaw rated 9.2 that reaches every release since 4.7.0. CISA listed it as known-exploited three days later.
Reality
CISA listed WSO2's maximum-severity JWT bypass, CVE-2026-5430, as exploited, with a September 27 federal fix deadline. The public evidence so far is forged-token attempts from one IP against the wrong WSO2 product, a thinner record than Sansec's sighting of live Magento attacks.
Perspective Coverage
4 publishersReality
Suspected Cl0p operators chain a FlexPLM WSDL disclosure to CVE-2026-12569 for unauthenticated code execution. No encryption stage means ransomware-tuned detections stay silent.
Perspective Coverage
7 publishersReality
Federal agencies now have three separate patch deadlines inside twelve days. The lowest-scoring pair of the five flaws added to KEV is the one with a documented 24-day intrusion campaign behind it.
Reality
SonicWall's CVSS 10.0 SSRF chains into command execution on remote access appliances, and JFrog Artifactory hands unauthenticated attackers admin under default configuration. Reverse shells and miners are already landing.
Perspective Coverage
4 publishersReality
CISA added two JFrog Artifactory access-control flaws and one ConnectWise ScreenConnect privilege flaw to the Known Exploited Vulnerabilities catalog on 11 September, and by the catalog's own criteria published mitigation guidance already exists for each.
Perspective Coverage
13 publishersReality
CISA added Kestra's unauthenticated code-execution flaw CVE-2026-49869, rated 10.0, to its exploited list on 2 September, three months after the fix. Orchestrators hold their workflows' credentials, so any reachable unpatched instance needs a compromise check as well as an upgrade.
Reality
Cisco says attackers are exploiting CVE-2026-76504, a 9.8-rated flaw that gives unauthenticated requests admin access to the Catalyst SD-WAN Manager API. Every configuration is affected, leaving exposed on-premises Managers needing an out-of-cycle upgrade and a check for earlier intrusion.
Perspective Coverage
12 publishersReality
Product · September 14, 2026 · Confirmed3 publishers
Leadership · September 29, 2026 · Confirmed2 publishers
Security · August 18, 2026 · Confirmed4 publishers
Security · August 18, 2026 · Confirmed5 publishers
Security · August 26, 2026 · Confirmed7 publishers
Security · August 28, 2026 · Confirmed7 publishers
Security · August 29, 2026 · Confirmed4 publishers
Security · August 28, 2026 · Confirmed10 publishers
Security · September 7, 2026 · Confirmed7 publishers
Security · September 10, 2026 · Confirmed2 publishers
Security · September 10, 2026 · Confirmed4 publishers
Security · September 9, 2026 · Confirmed6 publishers
Security · September 16, 2026 · Confirmed2 publishers
Security · September 22, 2026 · Confirmed6 publishers
Security · September 21, 2026 · Confirmed5 publishers
Security · September 11, 2026 · One report1 publisher
Security · September 10, 2026 · Confirmed2 publishers