CISA Adds Two Known Exploited Vulnerabilities to Catalog
2026-10-29T23:24:03Z•28e8e703c207bc7fe5dcd92ef55fa9d343c4854ee97ecae6c0ca7ad0926d4d13
CVE-2026-109618CVE-2026-109619CVE-2026-110447CVE-2026-111497CVE-2026-114625CVE-2026-41709CVE-2026-46300CVE-2026-48356CVE-2026-76418CVE-2026-97229Adobe CommerceArista VeloCloudBOD 26-04CISACiscoCollabora OnlineGitLabKEVKnown Exploited VulnerabilitiesLinux KernelMagentoOS command injectionPHPSQL injectionVMware ESXactive exploitationcritical vulnerabilitiesimmediate patchingremote code executionvulnerability management
What happened
CISA reports multiple additions to its Known Exploited Vulnerabilities (KEV) Catalog from October 23–29, 2026, citing evidence of active exploitation. The affected products include GitLab, Cisco Secure Firewall/FTD, VMware ESX, Linux Kernel, Adobe Commerce/Magento, Google Brotli, PHP, Collabora Online, and Arista VeloCloud Orchestrator. CISA urges immediate, risk-based remediation, prioritizing internet-facing systems and assessing for possible compromise. The PHP alert identifies unauthenticated remote code execution vulnerabilities (“php2shell”) and recommends upgrading to fixed PHP versions
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cisa_ncas_current_activity
- Record identifier
- 28e8e703c207bc7fe5dcd92ef55fa9d343c4854ee97ecae6c0ca7ad0926d4d13
- Enrichment time
- 2026-10-29T23:24:03Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.