Week of Oct 16, 2026
Seven things this week, sorted by how fast you should act. Everything below was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog between Oct 8 and Oct 16, which means attackers are already using these flaws. The EPSS score is FIRST’s estimate of how likely a flaw is to be exploited in the next 30 days. No KEV entries this week hit Proxmox, TrueNAS, UniFi, pfSense/OPNsense, MikroTik, Synology, QNAP or Plex. If that’s your stack, you can relax this week.
The rule: anything you can reach from the internet gets patched first. Anything that’s only reachable on your LAN or over a VPN can wait for your normal patch day.
1. Ivanti Connect Secure: CVE-2026-104935 — 🔴 PATCH NOW
What it is: An authentication bypass that lets a remote attacker with no login run commands.
Exposure: It’s a VPN gateway, so it’s internet-facing by design.
Scores: EPSS 0.26 (98th percentile). Added to KEV Oct 13.
Fix: Upgrade to 25.1.1.2 (25.1.1 line), 25.1.3.0/25.1.3.1 (25.1.2 line), or 22.8R2.5 (22.8 line; Ivanti recommends moving to 25.1.1.2+). 22.7R2.14 and older are not affected. Patching does not undo a prior break-in: follow CISA’s compromise steps (factory reset, restore config, reset all credentials). → Ivanti advisory · CISA alert
2. Microsoft Windows Shell: CVE-2026-96951 — 🔴 PATCH NOW
What it is: A command injection flaw that lets a crafted file or link bypass Mark of the Web, the warning Windows shows on downloaded files. The user has to open it. Microsoft says it’s being exploited.
Exposure: Every supported Windows 10/11 and Server 2012 R2–2025 machine. It arrives by email or chat, not through an open port.
Scores: EPSS 0.015 (74th percentile). Added to KEV Oct 13.
Fix: Install the Oct 13, 2026 Patch Tuesday update. → MSRC
3. Palo Alto PAN-OS: CVE-2026-0322 — 🔴 PATCH NOW (if the management interface is reachable)
What it is: Code injection. An attacker who is logged in and can reach the device can run code as root on the firewall.
Exposure: High if the management interface is open to the internet or untrusted networks.
Scores: EPSS 0.012 (68th percentile). Added to KEV Oct 14.
Fix: Upgrade to the fixed hotfix for your branch (e.g. 12.2.4, 11.2.16, 11.1.16-h3, 10.2.18-h12; full table in advisory). There’s no workaround; locking the management interface to trusted internal IPs greatly reduces risk. Cloud NGFW/Prisma Access unaffected. → Palo Alto advisory
4. Cisco Secure Email Gateway: CVE-2026-76519 — 🔴 PATCH NOW
What it is: A crafted email attachment can write files and run commands as root (CVSS 9.8). Only affects gateways with the File Reputation (AMP) service enabled on a mail policy and Content Scanner Tools older than 25.3.0.5525.
Exposure: Mail gateways receive internet email by design.
Scores: EPSS 0.016 (75th percentile). Added to KEV Oct 14.
Fix: Update Content Scanner Tools to 25.3.0.5525+
contentscannerupdate, no reboot) or upgrade AsyncOS to 15.5.5-014 / 16.5.0-780. Check for compromise withgrep “System Security” system_logs. Cloud gateway customers: no action. → Cisco advisory
5. Fortinet FortiOS / FortiProxy / FortiPAM / FortiSwitchManager: CVE-2025-61624 — 🟡 BATCH (Patch now if the admin interface is exposed)
What it is: Path traversal. An admin who already has read-write access can write or delete files on the device.
Exposure: The attacker needs admin credentials first. The risk climbs if the admin GUI or SSH is open to the internet.
Scores: EPSS 0.006 (47th percentile). Added to KEV Oct 16.
Fix: FortiOS 7.6.5+ or 7.4.10+ (7.2/7.0/6.4: migrate to a fixed branch). FortiProxy 7.6.5+/7.4.12+; FortiPAM 1.7.1+; FortiSwitchManager 7.2.8+/7.0.7+. Also close admin access from the WAN and review admin accounts. Fortinet first published this in April 2026 and now marks it known exploited. → FortiGuard FG-IR-26-122
6. ProFTPD (mod_copy): CVE-2015-3306 — 🟡 BATCH (Patch now if FTP is exposed)
What it is: An old bug that lets an attacker with no login read and write files using the
SITE CPFRandSITE CPTOcommands. It was just added to KEV.Exposure: Older NAS boxes and Linux servers running FTP. EPSS 0.995 (99.9th percentile).
Fix: Upgrade to ProFTPD 1.3.5a or later (Debian: 1.3.4a-5+deb7u3 / 1.3.5-1.1+deb8u1 or newer). On 1.3.5a+ you can also set
CopyEngine offor drop mod_copy. Better yet, turn FTP off and use SFTP. → ProFTPD bug 4169 · Debian DSA-3263-1
7. ISC BIND: CVE-2015-5477 — 🟢 WATCH (Batch if you run BIND)
What it is: A crafted TKEY query can crash the
namedDNS server (denial of service).Exposure: Only matters if you run BIND as a self-hosted DNS server, especially one open to the internet. EPSS 0.994.
Fix: Affects BIND 9.1.0 through 9.9.7-P1 and 9.10.0 through 9.10.2-P2 (both recursive and authoritative; ACLs don’t block it, no workaround). Fixed in 9.9.7-P2 and 9.10.2-P3; any currently supported BIND release is fine. Check with
named -v. → ISC advisory
Not on this list: Atlassian, BeyondTrust, AhsayCBS, Citrix NetScaler and a few others were also added to KEV this week. They’re less common in homelabs and small offices. The full list is in the KEV catalog.
Data: CISA KEV catalog and FIRST EPSS API, pulled Oct 16, 2026.
Disclaimer: This newsletter is general information, not professional security advice. Calls are conservative and based on public data. Always follow the vendor’s advisory and check your own exposure. No warranty; you are responsible for your systems.