CISA Adds One Known Exploited Vulnerability to Catalog
2026-10-23T19:24:01Z•86fd975783b9fe799fc25616abf39ebe8b75d93b0bf0b526837c676d29c445a6
CVE-2025-61624CVE-2026-0322CVE-2026-102764CVE-2026-105133CVE-2026-105134CVE-2026-106931CVE-2026-109618CVE-2026-109619CVE-2026-110936CVE-2026-114625CVE-2026-21589CVE-2026-76519CVE-2026-96652CVE-2026-96654CVE-2026-96655CVE-2026-96656AtlassianBeyondTrustCISAFortinetKEVKnown Exploited VulnerabilitiesPAN-OSPHPPlexSQL injectionactive exploitationauthentication bypasscommand injectioncritical vulnerabilitiespath traversalremote code executionserver-side request forgery
What happened
CISA advisories from October 15–23, 2026 identify multiple actively exploited vulnerabilities added to the KEV Catalog, including issues in Arista VeloCloud Orchestrator, Plex Media Server, EG Secure Solutions SiteGuard, Siemens Software Center, BeyondTrust Remote Support, Fortinet products, Atlassian products, Palo Alto PAN-OS, Cisco Secure Email Gateway, and AhsayCBS. CISA also urges immediate patching of two critical unauthenticated PHP remote-code-execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619), although exploitation had not yet been observed. Organizations should inventory
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cisa_ncas_current_activity
- Record identifier
- 86fd975783b9fe799fc25616abf39ebe8b75d93b0bf0b526837c676d29c445a6
- Enrichment time
- 2026-10-23T19:24:01Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.