Exploited this week: 9 vulnerabilities added to CISA’s KEV list (12 Oct to 18 Oct 2026)

Automatic post. Built by KEH-TECH from CISA’s Known Exploited Vulnerabilities catalog, as read by the Patch Tuesday hub, and published without editing. The figures are the source’s own; follow the links for the full detail.

Between 12 October 2026 and 18 October 2026, CISA added 9 entries to its list of vulnerabilities being exploited in the wild, 1 of them Microsoft. US federal agencies must fix these by the deadline shown; everyone else should treat that date as the latest sensible one.

Added this week

• CVE-2026-104935 Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability. Added 13 Oct; federal deadline 16 October 2026.
• CVE-2026-96951 Microsoft Windows Command Injection Vulnerability. Added 13 Oct; federal deadline 16 October 2026.
• CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection Vulnerability. Added 14 Oct; federal deadline 17 October 2026.
• CVE-2026-105133 Ahsay AhsayCBS Improper Authentication Vulnerability. Added 14 Oct; federal deadline 17 October 2026.
• CVE-2026-105134 Ahsay AhsayCBS Command Injection Vulnerability. Added 14 Oct; federal deadline 17 October 2026.
• CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Vulnerability. Added 14 Oct; federal deadline 17 October 2026.
• CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability. Added 15 Oct; federal deadline 18 October 2026.
• CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability. Added 16 Oct; federal deadline 19 October 2026.
• CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability. Added 16 Oct; federal deadline 19 October 2026.

Running any of these? Microsoft fixes are listed on the Patch Tuesday hub. Found one in your environment? The Patch Panel is the place to compare notes.