The one document every company that runs IT should read each month.

The month on a page

October 2026 added 36 flaws to CISA's list, 7 fewer than September's 43, but the due dates stayed short: the median is 3 days against 14 over the last twelve months, and 29 of the 36 are due within 7 days. Plan for a patch window of days, not weeks. First decision: name who can approve an emergency change on internet-facing systems.

Our reading of the figures below, not a statement by CISA.

Added to CISA's list

36

September 2026: 43 (-16.3%). October 2025: 31 (+16.1%).

Median window to fix

3 days

The twelve months before: 14 days. 29 of 36 gave 7 days or fewer.

Ransomware use recorded

0 of 36

10.4% over the twelve months before. “Not recorded” is not “none”.

Network edge and remote access

16.7%

6 of 36. The twelve months before: 11.7%.

Older than three years

13.9%

5 of 36. The twelve months before: 16.9%.

Entries that name a chain

12 of 36

CISA's description says the flaw can be chained with another.

Your five pain points this month

What a security leader loses sleep over, what this month’s figures say about each, what to do, and the proof to keep. The wording is ours, written from the figures; the figures are CISA’s.

1. 1. We cannot fix things in days.

   The figures

   October 2026: 36 entries, a median of 3 days from CISA adding an entry to its due date, against 14 over the twelve months before. 29 of 36 gave 7 days or fewer. For a federal agency, CISA's rule (BOD 26-04, Table 1) is 3 days, with a check for compromise, when an exposed system carries a listed flaw that an attacker can automate and that gives total control.

   Do

   Name the person who can approve an emergency change and write down the route. Then take the last entry that applied to you and time it from the day it was listed to the day it was fixed.

   Keep

   The dated record: listed on, fixed on, version, who approved.

2. 2. We do not know what we run.

   The figures

   A list of 36 new entries a month cannot be matched to systems nobody has counted. BOD 26-04 asks agencies to identify and tag every asset reachable from outside, with its environment, its exposure (public or internal) and its type (server, application or network device).

   Do

   One line per system: what it is, the version, who owns it, whether it is reachable from the internet, production or not. Start with what faces the internet.

   Keep

   The list, with the date it was last reviewed.

3. 3. What faces the internet is what gets hit first.

   The figures

   6 of 36 entries (16.7%) were in network-edge and remote-access products, against 11.7% over the twelve months before. CISA's own text for BOD 26-04 counts removing a system from the internet as a valid mitigation, because that changes the timeline that applies to it.

   Do

   List every firewall, VPN, gateway, router and remote-access product you run. Ask of each: does it need to face the internet, and who patches it?

   Keep

   The list of internet-facing products, with versions and the date each was last updated.

4. 4. Old software nobody remembers.

   The figures

   5 of 36 entries (13.9%) named a CVE from three or more years earlier; the oldest was CVE-2015-3306. The twelve months before: 16.9%. An old flaw on the list means an unpatched or unsupported system somewhere.

   Do

   Find what is past end of support or has not been updated in a year. Retire it, replace it, or take it off the network, and write down which.

   Keep

   The decision for each old system, with a date.

5. 5. We cannot show an auditor, an insurer or a customer that we acted.

   The figures

   Questionnaires, audits and cyber-insurance forms ask what you run, how fast you fix, and what proof you hold. The answer that survives is a dated record, not a statement. BOD 26-04 itself asks agencies for internal tracking and reporting, and for a written forensic triage report on the fastest cases.

   Do

   For each entry that applied to you this month, write one line: listed on, fixed on, version fixed in, proof (a command's output or a screenshot, with the date).

   Keep

   A single monthly record, kept where an auditor can be given it.

For your IT manager: what CISA’s BOD 26-04 asks, and what to do this week

This section is the part of the document to forward. CISA’s own pages, read 1 November 2026.

CISA’s Table 1: how fast, by four questions

Days are calendar days. “& forensic triage” means the fix or mitigation and a check for compromise, both inside the timeline. Removing a system from the internet changes “publicly exposed” and so the timeline that applies. Read the directive.

This week, in order

1. List what faces the internet: product, version, owner, production or not. CISA defines 'publicly exposed' as reachable by unauthenticated or untrusted parties over a public network.
2. Compare that list with Appendix A, and with the weekly and daily lists linked in this document. Mark every match.
3. For each match, find its row in Table 1 and write the timeline next to it. If the row says forensic triage, collect evidence before you patch (steps 1 and 2).
4. Fix or mitigate within that timeline, or take the system off the internet and write down that you did. Keep the version output or a screenshot, with the date.
5. Sign up for CISA's email alerts for new entries, and name who reads them. The sign-up is on CISA's directive page.
6. At the end of the week, write the month's record: entries that applied, listed on, fixed on, proof. File it where an auditor can be given it.

Keep it current: the week and the day

The month is one document; the week and the day are where the next entry shows up first. Each page links to our note and analysis report for every CVE it names.

• Weekly highlight and guideline, 1 November 2026: 10 exploited CVEs, 6 new critical records, and your week in order
• Daily threat watch, 31 October 2026: 10 exploited CVEs added this week, 6 to act on now
• Daily threat watch, 30 October 2026: 10 exploited CVEs added this week, 6 to act on now
• Daily threat watch, 29 October 2026: eight exploited CVEs in seven days, five that need action today
• Daily CVE highlight, 31 October 2026: 3 new critical CVEs worth reading
• Daily CVE highlight, 30 October 2026: 3 new critical CVEs worth reading
• Daily CVE highlight, 28 October 2026: four 9.8s, and each one turns on a different question
• Today’s mission: every exploited vulnerability from the last seven days, in the order their deadlines fall
• All the weekly highlights and guidelines

The two charts that carry the month

Chains: an exploit trend

12 of 36 entries added in October 2026 (33.3%) say in CISA’s description that the flaw can be chained with another, against 2.3% over the twelve months before. A chain means fixing one flaw of the set is not the end of the work: the entry flaw gets an attacker in, and the next one gives them more.

The chains of October 2026

• Plex Media Server · 4 entries, one product
  CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656

  This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.

  Our reading. All four are Plex Media Server flaws added on 20 October 2026. CISA describes two server-side request forgeries, a way to call other plugins' functions, and an admin file write where files may run on load. Fix all four. Start with CVE-2026-96654 and CVE-2026-96656, which have the 3-day deadlines. No fixed version is in our record.

• Ivanti Connect Secure · 3 entries, one product
  CVE-2026-104935, CVE-2026-118527, CVE-2026-111357

  This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.

  Our reading. Three Ivanti Connect Secure flaws. CVE-2026-104935 lets a remote unauthenticated attacker run commands, per CISA. CVE-2026-118527 lets an authenticated attacker upload files to a known location. CVE-2026-111357 is a local privilege escalation. Fix the entry point CVE-2026-104935 first, then the other two.

• PHP Group PHP + Linux Kernel · 3 entries, across products
  CVE-2026-109618, CVE-2026-109619, CVE-2026-46300

  This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.

  Our reading. Two PHP flaws, CVE-2026-109618 and CVE-2026-109619, each allow unauthenticated remote code execution, per CISA. CVE-2026-46300 is a Linux kernel flaw. CISA says the three can be chained to implant PHP webshells and run commands as root. Fix PHP first, then the kernel.

• Zammad GmbH Zammad · 2 entries, one product
  CVE-2026-102489, CVE-2026-102490

  This vulnerability can be chained with CVE-2026-102489.

  Our reading. Zammad, two flaws. CVE-2026-102489, a session fixation, can lead to remote code execution as the zammad user. CVE-2026-102490 lets that local user escalate to root. Together they run from entry to root on the Zammad server. Fix CVE-2026-102489 first, then CVE-2026-102490. Both were added on 2 October 2026.

• Ahsay AhsayCBS · 2 entries, one product
  CVE-2026-105133, CVE-2026-105134

  This vulnerability can be chained with CVE-2026-105133.

  Our reading. Ahsay AhsayCBS, two flaws added on 14 October 2026. CVE-2026-105133 is an authentication bypass. CVE-2026-105134 is a command injection that lets a remote attacker run operating system commands. CISA says they can be chained. Fix both together. No fixed version is in our record.

• Strapi Strapi · 1 entry, one product
  CVE-2023-22894

  This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.

  Our reading. One Strapi entry. CISA says CVE-2023-22894 lets someone with admin panel access discover sensitive user details, and can be chained with CVE-2023-22621 for remote code execution. CVE-2023-22621 is not on this month's list. CISA warns the product may be end-of-life. Check who can reach the admin panel first.

The five entries to know this month

Chosen by a printed rule: EPSS 0.90 or more 4 points, 0.50 or more 3, 0.10 or more 2, otherwise 0; named in a chain by CISA 3; network edge or remote access 2; ransomware use known 1. One entry per product; ties go to the higher EPSS, then the lower CVE number. EPSS is FIRST’s estimate of the chance of exploitation in the next 30 days, as scored on 31 October 2026.

1. 1. Ivanti Connect Secure CVE-2026-104935

   8 points · EPSS 0.868 · chain · edge

   Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.

   Our reading. Ivanti Connect Secure authentication bypass by spoofing, which CISA says lets a remote unauthenticated attacker run commands. It ranks first with 8 points: 3 for EPSS, 3 for being in a chain, 2 for being an edge product. Anyone running Connect Secure looks first. It sits in a chain with CVE-2026-118527 and CVE-2026-111357. We have no note on it, and no fixed version is in our record.

   CVE record

2. 2. PHP Group PHP CVE-2026-109618

   7 points · EPSS 1.000 · chain

   PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.

   Our reading. A PHP out-of-memory corruption flaw that CISA says allows unauthenticated remote code execution. It ranks second with 7 points: 4 for EPSS, 3 for being in a chain. Anyone running PHP on a public site looks first. CVE-2026-109619 was added the same day. Our note covers which versions fix them, how to check a server without being fooled by your package manager, and what to do if you cannot patch today.

   Read our note · Analysis report

3. 3. Ahsay AhsayCBS CVE-2026-105134

   6 points · EPSS 0.818 · chain

   Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.

   Our reading. An AhsayCBS command injection that CISA says lets a remote attacker run operating system commands. It ranks third with 6 points: 3 for EPSS, 3 for being in a chain. CISA says it can be chained with the authentication bypass CVE-2026-105133. Anyone running AhsayCBS looks first and patches both. We have no note on it, and no fixed version is in our record.

   CVE record

4. 4. Zammad GmbH Zammad CVE-2026-102489

   5 points · EPSS 0.225 · chain

   Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.

   Our reading. A Zammad session fixation that CISA says can lead to remote code execution as the zammad user. It ranks fourth with 5 points: 2 for EPSS, 3 for being in a chain. CISA says it chains with CVE-2026-102490, a privilege escalation to root. Anyone running Zammad looks first and fixes both. We have no note on it, and no fixed version is in our record.

   CVE record

5. 5. Linux Kernel CVE-2026-46300

   5 points · EPSS 0.161 · chain

   Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can …

   Our reading. A Linux kernel local privilege escalation. Our note says it dates from May, scores 7.8 and was added on 28 October 2026. It ranks fifth with 5 points: 2 for EPSS, 3 for being in a chain. CISA says it chains with the two PHP flaws to plant a webshell and run commands as root. Anyone running PHP on Linux looks first. Patch the kernel and PHP together; our note gives the order.

   Read our note · Analysis report

What is in each issue

Written for a security leader who has ten minutes before a meeting and an auditor who has the document open next to it.

• 1
  The month on a page

  The bottom line, six figures with their comparisons, and the decisions for the next thirty days, each with an owner and a date.

• 2
  Your five pain points

  The five things a security leader loses sleep over, what the month's figures say about each, what to do, and the proof to keep.

• 3
  For your IT manager

  What CISA's BOD 26-04 asks, its Table 1 of fix times, a checklist for the week, and the six forensic triage steps, written to forward.

• 4
  What changed

  Twelve months of additions to CISA's exploited list, set against last month, the same month a year ago and the average.

• 5
  The patching clock

  How long CISA gives to fix an entry, month by month, and what changed in the wording of its required action.

• 6
  Where the pressure was

  Which vendors, which product families and which weaknesses, how old the flaws are, and the exploit trend: the chains CISA names, with a sample attack path.

• 7
  The five entries to know

  The month's five entries by a printed rule, each with what it is, why it ranks, who looks first and where to read more.

• 8
  For your next leadership meeting

  Questions to put to your IT team or provider, what to watch next month, and what the figures cannot tell you.

• 9
  Appendices

  Every entry for the month, and the method: each rule, definition and limit, so you can disagree with a rule instead of trusting a label.

Issues

• October 202636 entries · median window 3 days · issued 1 November 2026Download · 19 pages