CISA Adds One Known Exploited Vulnerability to Catalog
2026-10-26T15:24:03Z•23727620b0c157965c97a5b0fc484eb58b5bde0dea96c27d705ee4835c614131
CVE-2025-61624CVE-2026-102764CVE-2026-106931CVE-2026-109618CVE-2026-109619CVE-2026-110447CVE-2026-110936CVE-2026-114625CVE-2026-21589CVE-2026-96652CVE-2026-96654CVE-2026-96655CVE-2026-96656Arista VeloCloudAtlassianBeyondTrustCISACollabora OnlineFortinetKEVKnown Exploited VulnerabilitiesOS command injectionPHPPlex Media ServerSQL injectionSSRFSiemensactive exploitationauthentication bypasspatchingpath traversalremote code executionvulnerability management
What happened
CISA advisories from October 16–23, 2026 report active exploitation of multiple vulnerabilities added to the Known Exploited Vulnerabilities catalog, including BeyondTrust Remote Support authentication bypass, Fortinet path traversal, Atlassian exposure of files or directories, Collabora Online OS command injection, Arista VeloCloud Orchestrator SQL injection, Plex Media Server flaws, EG SiteGuard OS command injection, and Siemens Software Center search-path hijacking. CISA separately urges immediate patching of critical unauthenticated remote-code-execution vulnerabilities in PHP (CVE-2026--?
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cisa_ncas_current_activity
- Record identifier
- 23727620b0c157965c97a5b0fc484eb58b5bde0dea96c27d705ee4835c614131
- Enrichment time
- 2026-10-26T15:24:03Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.