CISA stopped reliably sending KEV alerts.
We didn't.
CyberComply monitors the CISA Known Exploited Vulnerabilities catalog 24/7 and alerts you the moment a new KEV drops — before the deadline clock starts ticking without you knowing.
KEV Intelligence Brief: October 16, 2026
Eight KEV entries are due or overdue this week, and the pattern is familiar: edge devices and file-handling services with unauthenticated or low-barrier paths to code execution. Note the compressed deadlines. Every entry carries a three-day remediation window under BOD 26-04, and several have already lapsed or expire within hours. Two of them also come with a warning the catalog entry does not carry: for Ivanti and AhsayCBS, the standard "patch and check" response is not enough.
Edge and Perimeter Appliances: Root-Level Access at the Network Boundary
Four entries hit the devices that sit between your network and the internet, and that typically run with elevated privileges and limited endpoint telemetry.
Ivanti Connect Secure (CVE-2026-104935) is an authentication bypass that gives a remote, unauthenticated attacker arbitrary command execution. Its deadline is today, October 16. Volexity, which discovered the attacks, found it used in a three-bug chain against an appliance that was fully patched at the time, with exploitation beginning October 3. The attacker reached root and went after Active Directory: LDAP service credentials, LAPS local administrator passwords, BitLocker recovery keys, and password spraying. Two facts change the response. First, do not rely on Ivanti's Integrity Checker Tool: the attacker modified code only in memory, restored what it changed, scrubbed logs, and left no web shell, so the tool will likely report a clean device. Network and memory forensics are required. Hunt web logs for bursts of requests to /dana-na/auth/url_default/welcome.cgi carrying an X-DSCGI-PATH header, and check /tmp/ on the appliance. Second, the chain's privilege escalation flaw is not yet patched; today's fix closes the unauthenticated entry point, and a second Ivanti update is coming. Rotate every credential, certificate, API key, and session secret that has touched the appliance, including LDAP/AD service accounts and VPN-issued tokens, and rotate LAPS passwords and BitLocker keys domain-wide.
Cisco Secure Email Gateway (CVE-2026-76519) is a relative path traversal that lets an unauthenticated remote attacker write arbitrary files to the underlying OS. Arbitrary file write on an appliance usually converts to code execution through cron entries, web shells, or overwritten scripts. Email gateways also see all inbound and outbound mail, so compromise carries data-exposure implications beyond the host. Deadline: October 17.
Palo Alto Networks PAN-OS (CVE-2026-0322) is a code injection flaw yielding root on the firewall. It requires authentication, which can lull teams into deprioritizing it. Don't. Credential theft, shared admin accounts, or exposed management interfaces make "authenticated" a thin barrier. The first step is confirming the management plane is not reachable from the internet and is restricted to a dedicated management network. Deadline: October 17.
Microsoft Windows Shell (CVE-2026-96951) rounds out this group as a command injection that bypasses a security feature over a network. It is less of a perimeter device than the others, but it shares the "trust boundary erosion" character. Its deadline is also today, October 16. Prioritize it through your standard Windows update channel, starting with systems that handle files or links from untrusted sources.
Practitioner guidance: For the Ivanti, Cisco, and PAN-OS devices, BOD 26-04 also requires forensic triage, not just patching. Capture logs, configuration snapshots, and disk or memory artifacts before upgrading or rebooting where feasible, since patching can destroy evidence. This matters most for Ivanti, where memory is where the evidence lives. If you cannot patch or mitigate within the window, the required action is to discontinue use. For an exposed VPN, that means taking it offline, which carries real business cost. Decide the tradeoff now rather than at the deadline.
Ahsay Backup Chain: Authentication Bypass Meets Command Injection
CVE-2026-105133 (Ahsay AhsayCBS improper authentication) and CVE-2026-105134 (AhsayCBS command injection) are being exploited as a chain, and CISA added both on the same day. The first lets a remote attacker bypass authentication by manipulating the random parameter in the checkSysPwd function of the API component. The second allows OS command execution as SYSTEM through the same parameter name in the Replication Receiver's /rps/api/json/UpdateReceivers.do endpoint. Together they form a pre-authentication RCE path. Huntress first observed exploitation on October 7, with attackers deploying JSP web shells and an XMRig cryptominer disguised as edge.exe. Both are due October 17.
The first fix failed. Ahsay confirmed on October 10 that version 10.3.4.0 did not fully address either flaw. Servers upgraded to 10.3.4 remain vulnerable until hotfix 10.3.4.45 is installed and the server rebooted. If your team closed this ticket after the 10.3.4 upgrade, reopen it.
Backup infrastructure deserves special attention. AhsayCBS servers hold credentials, backup sets, and often encryption keys for entire environments, which makes them attractive to ransomware operators who want to destroy recovery options before encrypting production. AhsayCBS is also widely run by managed service providers, so many organizations are exposed through a provider rather than their own install. Recommended steps:
- Install hotfix 10.3.4.45 and reboot. Verify the build number rather than trusting the 10.3.4 version label.
- Restrict the AhsayCBS web and replication interfaces to management networks or VPN, and remove any direct internet exposure.
- Hunt for unexpected child processes of the AhsayCBS service (
cbssvcX64.exe); web shell commands run as its direct children. - Review logs for requests to
UpdateReceivers.doand anomalouscheckSysPwdcalls. - Treat stored credentials and backup encryption keys as potentially exposed on any server that ran a vulnerable build, and rotate them.
- Verify backup integrity and check for deleted or altered retention sets.
- Ask your MSP whether it runs AhsayCBS, and on which build.
Legacy and Collaboration Exposure: Old Bugs, Quiet Files
Atlassian (CVE-2026-21589) affects a broad family of Data Center products: Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, and Fisheye. An unauthenticated attacker can read files within the web application root. That is not direct code execution, but it can get close: watchTowr showed that in some Crowd-integrated deployments, the flaw yields administrator access to Jira, Confluence, and Bitbucket, because Crowd stores its application credentials in plaintext in a readable config file. Exploitation attempts began within hours of watchTowr's write-up on October 6. Atlassian Cloud is already patched and needs no action; this is a self-hosted problem. Because it spans so many products, inventory is the first challenge: confirm every Data Center instance, including forgotten Crucible or Fisheye servers, and upgrade to Atlassian's fixed versions. If you cannot upgrade immediately, Atlassian's interim advice is to take affected instances off the public internet. Rotate any secrets stored in application configuration, starting with Crowd application passwords, and audit access logs for unusual requests to web-root paths. Deadline: October 18.
ProFTPD (CVE-2015-3306) is the outlier: an eleven-year-old flaw in the site cpfr and site cpto commands (the mod_copy module) that allows remote attackers to read and write arbitrary files. Its October 11 deadline has already passed, so any federal system still running a vulnerable build is out of compliance. Its return is not a coincidence: it was added after joint advisory AA26-281A, in which the FBI, CISA, NSA, and international partners confirmed its exploitation by actors working with Integrity Technology Group, a sanctioned China-based contractor whose activity overlaps with Flax Typhoon. Hunt for ProFTPD in network scans, including copies bundled in appliances, disable mod_copy if unused, retire FTP in favor of SFTP where possible, and examine web roots and home directories for dropped files, since arbitrary write on an FTP host commonly leads to web shells. The same advisory added Apache Struts, ISC BIND, ONLYOFFICE, and Strapi entries that are also now overdue.
Deadline Summary and Priorities
| Deadline | Items | |---|---| | Passed (Oct 11) | ProFTPD CVE-2015-3306 (and the rest of the AA26-281A batch) | | Today (Oct 16) | Ivanti CVE-2026-104935, Windows CVE-2026-96951 | | Oct 17 | PAN-OS, AhsayCBS (both), Cisco SEG | | Oct 18 | Atlassian CVE-2026-21589 |
Suggested order of operations: confirm and mitigate Ivanti first, starting forensics before you patch, and push the Windows update in parallel since it shares today's deadline. Then the unauthenticated Cisco and Ahsay chains (verifying hotfix 10.3.4.45, not just 10.3.4), then PAN-OS management exposure, then Atlassian, alongside ProFTPD discovery. Document your internet-exposure evaluation for each asset, as BOD 26-04 places that responsibility on stakeholders. Contractors supporting federal systems should expect customers to ask for evidence of both remediation and forensic triage, and this week, "we patched" is not evidence for Ivanti or AhsayCBS.
Sources: CISA KEV Catalog · CISA Alert: Ivanti Connect Secure · Ivanti Security Advisory: CVE-2026-104935 · Volexity: Chained Exploitation of Ivanti Connect Secure Zero-Days · Huntress: AhsayCBS Exploitation · Atlassian: CVE-2026-21589 Advisory · Palo Alto Networks Security Advisories · Cisco Security Advisories · Microsoft Security Update Guide · CISA Advisory AA26-281A · NVD CVE-2015-3306
Free KEV Alerts
- Real-time notification the moment a KEV drops
- Vendor and product details
- BOD 26-04 remediation deadline included
Pro Alerts Coming Soon
- Real-time notification the moment a KEV drops
- Filtered to your specific vendor watchlist
- Urgency scoring (Critical / Urgent / Standard)
- Direct patch links included
Stay ahead of CISA.
Search the KEV Catalog by Vendor or Product
Search for CVEs by vendor or product to identify known exploited vulnerabilities in your environment
Upcoming Patch Due Dates
via Binding Operational Directive 26-04
BOD 26-04 is CISA's current vulnerability remediation directive for Federal Civilian Executive Branch (FCEB) agencies, updating the KEV-driven framework introduced under BOD 22-01 with a more risk-based approach to prioritization. While binding only on FCEB agencies, its framework increasingly influences contractor expectations through procurement requirements, FedRAMP programs, and agency security clauses.
Loading...
Cyber Security News
You may have missed...
Hacking Editorial Brief — October 16, 2026
Chinese Espionage Group Exploited BeyondTrust Zero-Day Since August
Chinese state-sponsored group Armory Castle exploited a critical authentication bypass vulnerability (CVE-2026-TBD) in BeyondTrust Remote Support as a zero-day beginning in August 2026, using it for initial access and lateral movement across enterprise networks. Google's Threat Analysis Group issued warnings Thursday that organizations should prepare for "potential widespread exploitation" now that the vulnerability is public. The campaign represents a significant supply chain risk, as BeyondTrust's remote support platform is widely deployed in enterprise environments for IT administration and helpdesk operations.
GitHub Campaign Compromises 1,900 Accounts to Plant Malicious Workflows
A campaign dubbed GhostAction compromised approximately 1,900 GitHub accounts to inject credential-stealing Actions workflows into over 30,000 repositories. The attack leverages GitHub's CI/CD automation features to execute malicious code within developer environments, targeting credentials and potentially injecting backdoors into software supply chains. Separately, the FBI executed searches at 40 Texas locations, seizing 187 laptops used by North Korean IT workers in remote employment fraud schemes designed to evade sanctions and generate revenue for the regime.
Advertising Infrastructure Weaponized for Espionage Operations
An Israeli digital advertising agency provided surveillance firms, including blacklisted spyware vendor Candiru, access to major advertising platforms to deliver exploits through malvertising campaigns seen by millions of users. The operation demonstrates how legitimate advertising infrastructure is being systematically abused to enable targeted espionage at scale. Additional incidents include a BAE Systems breach disrupting federal bankruptcy court notice systems nationwide, and Burger King Japan confirming unauthorized access to its app management system exposed 11.18 million user records.
Sources: The Hacker News · Reuters · The New Stack · CISO Series · CBC News · Jerusalem Post · Law.com · Cybersecurity News
*
Inside a cyberattack: How hackers steal data
The truth about cybersecurity is that it's almost impossible to keep hackers outside of an organization, particularly as the cybercrime industry ...
FBI Seized Vulnerability Scanning and Spear Phishing Tools Used by China-Linked Hackers
The FBI and Justice Department seized seven domains tied to Microscan and FishHub hacking tools operated by Integrity Technology Group, disrupting inf...
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
Chinese espionage group Armory Castle exploited a critical authentication bypass vulnerability in BeyondTrust Remote Support as a zero-day since Augus...
Microsoft Patches Two Dozen RCE Flaws in Office
Microsoft announced patches for over 30 new vulnerabilities, including two dozen high-severity remote code execution flaws in the Office suite.
3 Cybersecurity Stocks With Market Caps Over $9 Billion - Yahoo Finance
Palo Alto Networks sits near the center of this cybersecurity screen because its Cortex platform tackles exactly what growing AI and cloud usage ...
X suspends 13,000 accounts, alleging foreign influence ahead of US midterms - Al Jazeera
Who's in charge in Iran? News|Cybersecurity. X suspends 13,000 accounts, alleging foreign influence ahead of US midterms. The social platform says ...
Grocery store hack could have broader implications, national security expert says - 6abc Philadelphia
Grocery store hack impacting Giant, Stop & Shop and Food Lion could have broader implications, National Security Expert says.
I opened one port on my home router. The "hacker's search engine" found it in two hours
The "hacker search engine" found my port in about an hour. Shodan constantly scans the internet and indexes everything.
Feds issue warning to local water systems over increased cyberattacks, following Minnesota incident
Minnesota systems may have been targeted by Iranian groups, U.S. officials say. Iran suspected in hack of Minnesota water systems.
Updated daily