CISA stopped reliably sending KEV alerts.
We didn't.
CyberComply monitors the CISA Known Exploited Vulnerabilities catalog 24/7 and alerts you the moment a new KEV drops — before the deadline clock starts ticking without you knowing.
KEV Intelligence Brief — October 14, 2026
Prepared for: Federal Contractors · DevOps Teams · Security Operations Leaders Reference Period: October 4–13, 2026 | Classification: TLP:CLEAR
Deadline Watch: Ivanti, Microsoft, and Citrix Under Active Pressure
Three of the eight KEV additions carry the most operationally acute timelines and demand immediate attention from any organization running internet-facing infrastructure.
CVE-2026-104935 (Ivanti Connect Secure) and CVE-2026-96951 (Microsoft Windows Shell) were both added to the catalog on October 13 with a patch deadline of October 16, a 72-hour window that closes Friday.
The Ivanti flaw is the most dangerous entry this week. CVE-2026-104935 covers two links in a zero-day chain: an authentication bypass in the public welcome.cgi login handler that lets an attacker route requests to protected scripts, and a race condition in the wu.cgi upload handler that turns a briefly written file into remote code execution. Volexity, which found the chain, traced exploitation to October 3 against an appliance running 22.8R2.4, the latest release at the time. The actor, tracked as UTA0576, chained a third, separate privilege escalation bug to reach root, then went after Active Directory: LDAP service credentials, LAPS local administrator passwords, BitLocker recovery keys, password spraying, and packet captures of LDAP traffic on the appliance itself. Affected versions are 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior.
Three details make this harder than a normal patch cycle. First, the privilege escalation flaw is not yet fixed; Ivanti says that fix will ship in a future release. Today's patch closes the unauthenticated front door, which is what makes the root bug reachable, but expect a second update. Second, Ivanti's Integrity Checker Tool will likely miss this. The actor patched library code in memory only, restored altered configuration afterward, ran payloads from memory, and scrubbed debuglog and audit.log. No web shell or backdoor was left behind; every command re-ran the full exploit chain. A clean integrity check proves nothing here. Third, 22.8 reaches end of life on January 31, 2027, so organizations on that branch should plan the 25.x migration now rather than after the next emergency.
Organizations running affected Connect Secure appliances should treat this as an active incident posture, not a patch management task. Determining compromise requires network and memory forensics. Hunt web logs for high volumes of requests to /dana-na/auth/url_default/welcome.cgi carrying an X-DSCGI-PATH header, especially any mismatch between the requested URL and the header path, and check /tmp/ on the appliance for leftover scripts or JSON output. If compromise is suspected, follow CISA's recovery sequence: back up the configuration, factory reset (or rebuild virtual and cloud instances), upgrade, restore the configuration, then reset every domain, administrator, and local account password and revoke and reissue stored certificates, API keys, and license server credentials. Because LAPS passwords and BitLocker keys were targeted, rotate those across the domain too, not just on the appliance. For agencies or contractors who cannot patch within the deadline, BOD 26-04 requires either documented compensating controls or discontinuation of the product.
The Windows Shell vulnerability (CVE-2026-96951) is a security feature bypass of the kind threat actors routinely use to strip warning prompts from malicious files and links during initial access. Given the ubiquity of Windows in federal and contractor environments, assume broad exposure. Apply the relevant Microsoft patch immediately; where patch deployment cycles are constrained by change management windows, prioritize user workstations that handle email and web content, then jump hosts and administrative systems.
CVE-2026-88779 (Citrix NetScaler ADC / NetScaler Gateway) carried a patch deadline of October 7 and is a week overdue as of today. On appliances configured as a SAML Service Provider or Identity Provider, it can independently cause a denial of service. CISA's October 9 alert update adds the more serious finding: on unpatched appliances, attackers can use CVE-2026-88779 to force a reboot that executes code previously injected through CVE-2026-88771. That makes it part of the NetScaler remote code execution chain, not a standalone availability bug. Treat any unexplained NetScaler reboot since late September as a possible execution event. An overdue KEV deadline for a Citrix perimeter product in a federal context is a compliance finding, not just a risk. If your organization has not patched or documented a mitigation exception, that gap requires immediate escalation to your CISO and ISSO.
Legacy Debt Weaponized: Decade-Old CVEs Return to Active Exploitation
Perhaps the most strategically significant pattern in this week's KEV additions is the reemergence of vulnerabilities from 2015 and 2016. CVE-2015-3306 (ProFTPD), CVE-2015-5477 (ISC BIND), and CVE-2016-3081 (Apache Struts) were all added October 8 with a deadline of October 11 and are now overdue. These are not random rediscoveries. They came from joint advisory AA26-281A, in which the FBI, CISA, NSA, and international partners documented intrusions enabled by Integrity Technology Group, a sanctioned China-based contractor whose tradecraft overlaps with Flax Typhoon. The flaws were recovered from the actors' own exploit tooling and confirmed as successfully exploited.
The ProFTPD flaw allows unauthenticated remote attackers to read and write arbitrary files via the SITE CPFR and SITE CPTO commands, enabling trivial data exfiltration or webshell staging. ISC BIND's TKEY query handling flaw (CVE-2015-5477) lets a single crafted query crash the DNS server, disrupting name resolution across dependent services. Apache Struts (CVE-2016-3081) rounds out this legacy cluster with remote code execution via Dynamic Method Invocation, a vulnerability class that has fueled nation-state campaigns for years. Where an upgrade is not immediately possible, disabling Dynamic Method Invocation closes the hole.
The operational message here is uncomfortable but clear: vulnerability management programs that rely solely on CVSS scoring or vendor patch cadence will miss these. A CVE from 2015 with active exploitation is more dangerous than a critical-severity CVE with no known exploit. DevOps and infrastructure teams should run asset discovery specifically targeting ProFTPD, BIND versions predating 9.9.7-P2 and 9.10.2-P3, and any Struts deployments, including those embedded in third-party applications and appliances, and treat confirmed instances as requiring emergency remediation or isolation.
Developer and Content Platform Exposure: ONLYOFFICE and Strapi
Two additions from the same AA26-281A advisory target developer-adjacent and content management platforms and deserve specific attention from teams managing SaaS-adjacent or self-hosted productivity infrastructure.
CVE-2021-3199 (ONLYOFFICE Docs) is a path traversal in the image upload functionality that can lead to remote code execution. The flaw applies to deployments where JWT is in use, so a JWT-enabled configuration offers no assurance on its own. Any self-hosted ONLYOFFICE Docs instance on 5.1.5 through 5.6.2 should be updated to 5.6.3 or later immediately and reviewed for indicators of unauthorized file access or webshell placement.
CVE-2023-22894 (Strapi) exposes sensitive user information, including password-reset material, through query filter manipulation accessible from the admin panel. Critically, it chains with CVE-2023-22621 to achieve remote code execution. Note the version discrepancy: AA26-281A lists versions up to 4.5.5 as affected, but Strapi's own advisory puts the range at 3.2.1 through 4.7.9. Patch to 4.8.0 or later and use the vendor's range. CISA notes the affected product versions may be end-of-life. Organizations running Strapi as a headless CMS backend, common in modern web application architectures, must assess whether their deployed version is still supported. If not, transition to a supported release is not optional. For teams that cannot migrate immediately, restrict admin panel access to trusted IP ranges and audit admin-level user accounts for unauthorized access or credential exposure.
Both vulnerabilities reflect a broader risk pattern: productivity and content tools are increasingly integrated into development pipelines and internal portals, yet they receive less rigorous patch scrutiny than traditional network infrastructure. That gap is now being actively exploited.
Takeaway for Security Operations: This week's KEV additions span the full kill chain: initial access via authentication bypass and security feature bypass, persistence via arbitrary file write and path traversal, and disruption via denial of service. Six deadlines are already past. The Ivanti and Windows Shell deadlines expire Friday, and the Ivanti patch is only the first of two. Prioritize accordingly.
Sources: CISA KEV Catalog · CISA BOD 26-04 · CISA Alert: Newly Exploited Vulnerability in Ivanti Connect Secure · Ivanti Security Advisory: CVE-2026-104935 · Ivanti Connect Secure Recovery Procedures · Volexity: Chained Exploitation of Ivanti Connect Secure Zero-Days · Microsoft Security Update Guide · Citrix Security Bulletin CTX697096 · CISA Advisory AA26-281A · Apache Struts Security Reports · ISC BIND CVE-2015-5477 Advisory · Strapi Security Disclosure
Free KEV Alerts
- Real-time notification the moment a KEV drops
- Vendor and product details
- BOD 26-04 remediation deadline included
Pro Alerts Coming Soon
- Real-time notification the moment a KEV drops
- Filtered to your specific vendor watchlist
- Urgency scoring (Critical / Urgent / Standard)
- Direct patch links included
Stay ahead of CISA.
Search the KEV Catalog by Vendor or Product
Search for CVEs by vendor or product to identify known exploited vulnerabilities in your environment
Upcoming Patch Due Dates
via Binding Operational Directive 26-04
BOD 26-04 is CISA's current vulnerability remediation directive for Federal Civilian Executive Branch (FCEB) agencies, updating the KEV-driven framework introduced under BOD 22-01 with a more risk-based approach to prioritization. While binding only on FCEB agencies, its framework increasingly influences contractor expectations through procurement requirements, FedRAMP programs, and agency security clauses.
Loading...
Cyber Security News
You may have missed...
Hacking Editorial Brief — October 14, 2026
AI-Discovered Linux Kernel Vulnerability Enables Root Escalation and VM Escape
Tencent's Corvus AI has identified CVE-2026-74580 (Vghost), a critical Linux kernel vulnerability enabling local privilege escalation to root and guest-to-host escape in virtualized environments. The flaw affects nearly a decade of kernel versions, representing significant risk to cloud infrastructure and containerized deployments. The discovery marks a notable development in AI-assisted vulnerability research, demonstrating machine learning systems' capability to identify complex kernel flaws that span multiple subsystems and affect hypervisor isolation boundaries.
South Korean Financial Sector Breach Expands to 16 Institutions with 100,000 Records Compromised
South Korean authorities have confirmed data breach incidents across 16 financial institutions with approximately 100,000 customer records leaked. The campaign represents a coordinated effort targeting the financial sector, though attribution and specific attack vectors remain under investigation. Separately, threat actors compromised a European bank through stolen VPN credentials accessing a misconfigured third-party gateway, conducting months of reconnaissance before detection.
Cryptocurrency and Consumer Technology Under Active Attack
Ledger SAS is reviewing its hardware wallet sales policies following a $90 million spyware attack involving compromised devices. In a separate corporate espionage incident, Saudi national Abdulrahman Alfozan, an OpenAI engineer, was arrested for planting an audio recording device in an executive conference room to capture sensitive internal meetings. Additionally, two iOS exploit kits—Coruna and DarkSword—have been observed chaining vulnerabilities to fully compromise outdated iPhones through single malicious web visits without requiring app installation.
Sources: The Hacker News · Channel News Asia · Bloomberg · Cybersecurity News · Cybersecurity News · GBHackers
*
Inside a cyberattack: How hackers steal data
The truth about cybersecurity is that it's almost impossible to keep hackers outside of an organization, particularly as the cybercrime industry ...
Volt Typhoon Explained: Tactics, Targets & 2026 Threat
An analysis of Volt Typhoon, a China-linked state-sponsored hacking group pre-positioning in U.S. critical infrastructure using living-off-the-land te...
AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host
CVE-2026-74580 (Vghost), discovered by Corvus AI in Tencent's research, enables local privilege escalation to root and guest-to-host escape in virtual...
Ivanti Connect Secure 0-Day Vulnerability Actively Exploited in the Wild
Attackers chained three zero-day flaws in Ivanti Connect Secure VPN appliances to gain root-level access and steal Active Directory credentials from f...
Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN
Ivanti warned customers that a zero-day vulnerability in its Connect Secure VPN appliances has been exploited in the wild, allowing unauthenticated re...
Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day
Microsoft's October 2026 Patch Tuesday updates fix a record-breaking 1,413 CVEs across Windows, Office, developer tools, and SharePoint, including a W...
CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure
... Cybersecurity & Infrastructure Security Agency logo America's Cyber ...
Cyberattack Prompts Ahold Delhaize to Disconnect Systems
Dutch-Belgian grocery giant Ahold Delhaize has disconnected some of its systems in response to a cyberattack affecting its network.
GIANT website down following 'cybersecurity incident' | fox43.com
The GIANT grocery chain's website is currently offline following a reported "cybersecurity incident." The store's parent company, Ahold Delhaize, ...
Updated daily