CISA KEV report, October 2026: 36 exploited vulnerabilities, most with 3 days to fix

Every month we pull CISA's Known Exploited Vulnerabilities catalog and summarize what changed: how many CVEs were added, how long agencies were given to fix them, which products keep appearing, and how the new entries scored on EPSS. Every CVE below links to its own page with the KEV details, EPSS score and fix guidance.

Figures are from CISA's KEV JSON feed as of its 30 October 2026 update, and FIRST's EPSS API scores dated 1 November 2026. You are welcome to reuse them; a link back to this page is appreciated.

36 additions: the second busiest month of 2026

October's 36 additions follow 43 in September, the busiest month this year. From January to September CISA added 27 a month on average, and 282 CVEs have joined the catalog so far in 2026.

The fix window has shrunk from 21 days to 3

Each KEV entry carries a due date: the deadline for US federal civilian agencies under Binding Operational Directive 22-01. For years the usual window was 21 days. That has changed quickly.

In October, 29 entries had 3 days and the other 7 had 14. Across 2026 so far, 152 of 282 additions (54%) came with 3 days or less. If you use the KEV due date as your own benchmark, a weekly patch cycle is no longer fast enough for these.

Edge devices again

Eleven of the 36 were in equipment that faces the internet: Ivanti Connect Secure (3), Cisco Secure Firewall ASA and FTD, Cisco Secure Email Gateway, Fortinet FortiMail and other Fortinet products, Citrix NetScaler, Palo Alto Networks PAN-OS, BeyondTrust Remote Support and Arista VeloCloud Orchestrator. These are the devices nobody logs into day to day, and the ones attackers try first.

Plex Media Server had the most entries of any single product, with 4 added on 20 October. PHP, Ahsay AhsayCBS and Zammad had 2 each.

Old CVEs still count

On 8 October CISA added five much older vulnerabilities in one batch: CVE-2015-5477 (ISC BIND), CVE-2015-3306 (ProFTPD), CVE-2016-3081 (Apache Struts), CVE-2021-3199 (ONLYOFFICE Docs) and CVE-2023-22894 (Strapi). A CVE's age says nothing about whether it is safe to ignore. If an old finding keeps reappearing in your scans, check it against KEV before you accept the risk.

EPSS alone would have missed nearly half

EPSS estimates the chance a CVE is exploited in the next 30 days. On 1 November, 35 of October's 36 additions had a score (CVE-2026-118527 was too new). 19 scored 10% or more, but 16 scored under 10%, and 4 were under 1%, even though CISA had confirmed exploitation.

All 36 CVEs added in October 2026

None of October's additions was marked as used in ransomware campaigns when it was added. CISA often updates that field later, so check each CVE's page for the current value.

How we made this report

• Additions are KEV entries whose dateAdded falls in the month, from CISA's public JSON feed.
• The fix window is dueDate minus dateAdded, in calendar days.
• EPSS scores come from FIRST's public API and change daily; the table shows the 1 November 2026 score.
• Edge devices means VPN, firewall, email gateway, SD-WAN and remote-access products.
• Nothing here comes from customer data.

Common questions