[REVISION HISTORY]
CISA vulnerability exploitation and patching directives
Updated 9 times since CLSTR started tracking revisions of this situation.
What changed
2026-10-24 11:03 UTC → 2026-10-26 08:43 UTC ·
added
removed
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has continued issuing directives to federal agencies regarding multiple actively exploited software vulnerabilities. Following the September 9, 2026, addition of the ‘StyleSmuggler’ flaw in Adobe Commerce (CVE-2026-75650), CISA also added a static code injection vulnerability in N-able N-central (CVE-2026-86218) and a Microsoft Windows link-following vulnerability (CVE-2026-81963) to its Known Exploited Vulnerabilities (KEV) catalog. On September 22, CISA added three high-severity Linux kernel vulnerabilities: CVE-2025-39682, affecting the TLS receive path; CVE-2026-53266, an out-of-bounds write in the ebtables SNAT ARP rewrite path; and CVE-2025-39964, a long-standing race condition in the AF_ALG cryptographic interface. On the same day, CISA ordered agencies to patch a stack-based buffer overflow in Zyxel GS1900 series switches (CVE-2026-7273). By September 25, CISA added further critical flaws, including a code injection vulnerability in Microsoft SharePoint Server (CVE-2026-65660), an SSH protocol flaw in MikroTik RouterOS (CVE-2026-67279), a path traversal flaw in WSO2 (CVE-2026-5430), and an authorization flaw in Adobe Commerce (CVE-2026-71362). On September 30, CISA added a critical authentication bypass in Cisco Catalyst SD-WAN Manager (CVE-2026-76504). On October 1, In October, Fortinet confirmed that a critical zero-day path traversal vulnerability (CVE-2026-104286) in its FortiMail gateway is being exploited. gateway. For the week of October 12–18, CISA added nine new vulnerabilities, including a path traversal flaw in Fortinet products (CVE-2025-61624) used by PEERSTITCH malware to exploit FortiManager, and an authentication bypass in BeyondTrust Remote Support (CVE-2026-102764). Other additions included flaws in Atlassian, Cisco, AhsayCBS, Palo Alto Networks, Microsoft, and Ivanti products. In late October, INCIBE-CERT issued an early warning regarding critical security updates During the same period, CISA added five entries for several Fortinet product families, the week of October 5–11, including FortiOS, FortiManager, FortiAnalyzer, FortiMail, flaws in Strapi, ONLYOFFICE Docs Server, Apache Struts, ISC BIND, and FortiAuthenticator. ProFTPD. Cisco reported active exploitation of a zero-day in its Secure Email Gateway (CVE-2026-76519), while Ivanti Connect Secure faced a chain of three zero-day vulnerabilities, including CVE-2026-104935, used by threat actor UTA0576.
Versions
- 2026-10-26 08:43 UTC CISA vulnerability exploitation and patching directives
- 2026-10-24 11:03 UTC CISA vulnerability exploitation and patching directives
- 2026-10-19 07:55 UTC CISA vulnerability exploitation and patching directives
- 2026-10-12 14:01 UTC CISA vulnerability exploitation and patching directives
- 2026-10-03 00:22 UTC CISA vulnerability exploitation and patching directives
- 2026-10-01 13:26 UTC CISA vulnerability exploitation and patching directives
- 2026-09-26 02:51 UTC CISA vulnerability exploitation and patching directives
- 2026-09-10 15:37 UTC CISA vulnerability exploitation and patching directives
- 2026-08-28 14:17 UTC CISA vulnerability exploitation and patching directives
- 2026-08-27 14:10 UTC CISA vulnerability exploitation and patching directives
Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.