Automatic post. Built by KEH-TECH from CISA’s Known Exploited Vulnerabilities catalog, as read by the Patch Tuesday hub, and published without editing. The figures are the source’s own; follow the links for the full detail.
Between 12 October 2026 and 18 October 2026, CISA added 9 entries to its list of vulnerabilities being exploited in the wild, 1 of them Microsoft. US federal agencies must fix these by the deadline shown; everyone else should treat that date as the latest sensible one.
Added this week
CVE-2026-104935Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability. Added 13 Oct; federal deadline 16 October 2026.CVE-2026-96951Microsoft Windows Command Injection Vulnerability. Added 13 Oct; federal deadline 16 October 2026.CVE-2026-0322Palo Alto Networks PAN-OS Code Injection Vulnerability. Added 14 Oct; federal deadline 17 October 2026.CVE-2026-105133Ahsay AhsayCBS Improper Authentication Vulnerability. Added 14 Oct; federal deadline 17 October 2026.CVE-2026-105134Ahsay AhsayCBS Command Injection Vulnerability. Added 14 Oct; federal deadline 17 October 2026.CVE-2026-76519Cisco Secure Email Gateway Relative Path Traversal Vulnerability. Added 14 Oct; federal deadline 17 October 2026.CVE-2026-21589Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability. Added 15 Oct; federal deadline 18 October 2026.CVE-2025-61624Fortinet Multiple Products Path Traversal Vulnerability. Added 16 Oct; federal deadline 19 October 2026.CVE-2026-102764BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability. Added 16 Oct; federal deadline 19 October 2026.
Running any of these? Microsoft fixes are listed on the Patch Tuesday hub. Found one in your environment? The Patch Panel is the place to compare notes.