CISA Adds Two Known Exploited Vulnerabilities to Catalog
2026-10-28T21:24:04Z•6f2448a7077a80ea6ab88f2da28d77e9f7c8be64749f08753a1b8bbf6eb48c62
CVE-2026-106931CVE-2026-109618CVE-2026-109619CVE-2026-110447CVE-2026-110936CVE-2026-111497CVE-2026-114625CVE-2026-41709CVE-2026-46300CVE-2026-48356CVE-2026-96652CVE-2026-96654CVE-2026-96655CVE-2026-96656Adobe CommerceCISACollabora OnlineKEVKnown Exploited VulnerabilitiesLinux KernelMagentoOS command injectionPHPPlex Media ServerSQL injectionSSRFSiemens Software CenterVMware ESXVeloCloud Orchestratoractive exploitationremote code executionurgent patchingvulnerability management
What happened
CISA advisories from October 23–28, 2026 report 16 vulnerabilities added to the Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. Affected products include VMware ESX, Linux Kernel, Adobe Commerce/Magento, Brotli, PHP, Collabora Online, Arista VeloCloud Orchestrator, Plex Media Server, EG Secure Solutions SiteGuard, and Siemens Software Center. Notably, the PHP “php2shell” vulnerabilities enable unauthenticated remote code execution, while other issues include OS command injection, SQL injection, SSRF, unrestricted file upload, path manipulation, and explo
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cisa_ncas_current_activity
- Record identifier
- 6f2448a7077a80ea6ab88f2da28d77e9f7c8be64749f08753a1b8bbf6eb48c62
- Enrichment time
- 2026-10-28T21:24:04Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.