CISA Adds Two Known Exploited Vulnerabilities to Catalog
2026-10-02T21:24:02Z•11ee29a087764c19abb457c79a3c773f5282b290f64da26819f4a130329ca8a3
CVE-2026-102489CVE-2026-102490CVE-2026-104286CVE-2026-76504CVE-2026-86950CVE-2026-87902CVE-2026-88771CVE-2026-88772CVE-2026-88773CVE-2026-88774CVE-2026-88775CVE-2026-88776CVE-2026-88777CVE-2026-88778AppleCISACisco Catalyst SD-WAN ManagerCitrix NetScalerFortinet FortiMailKEVKnown Exploited VulnerabilitiesWordPressZammadactive exploitationremote code executionvulnerability managementzero-day
What happened
CISA advisories from September–October 2026 report multiple vulnerabilities added to the Known Exploited Vulnerabilities (KEV) Catalog based on confirmed active exploitation. Affected products include Zammad, Fortinet FortiMail, Cisco Catalyst SD-WAN Manager, Apple products, Citrix NetScaler ADC/Gateway, and WordPress Core. The Citrix NetScaler issues CVE-2026-88771 and CVE-2026-88772 are identified as critical zero-days capable of independent remote code execution and are being exploited globally. Organizations should prioritize remediation, investigate potential compromise, and follow vendor
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cisa_ncas_current_activity
- Record identifier
- 11ee29a087764c19abb457c79a3c773f5282b290f64da26819f4a130329ca8a3
- Enrichment time
- 2026-10-02T21:24:02Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.