Seven exploited vulnerabilities entered CISA KEV this week. Review the October 16–18 federal deadlines, affected products, fixed versions and the compromise checks security leaders should require.
Cisco Secure Email Gateway zero-day CVE-2026-76519 lets one crafted attachment give attackers root. CISA’s deadline is October 17. Update Content Scanner Tools, then check for compromise.
Ivanti Connect Secure zero-day CVE-2026-104935 is exploited and on CISA KEV with an October 16 deadline. Patch now, then investigate: the attack chain hides from Ivanti’s own Integrity Checker.
GitLab fixed CVE-2026-97229, a CVSS 10.0 flaw that may allow unauthenticated code execution on self-managed servers. Upgrade to 19.4.2, 19.3.5 or 19.2.8.
Citrix patched CVE-2026-107406, a CVSS 9.5 NetScaler SAML memory overflow. Builds that fixed last week’s exploited SAML zero-day remain vulnerable in IdP mode. Upgrade to 14.1-73.46 or 13.1-64.29.
CrowdStrike linked ARTEX and several AI models to confirmed intrusions at South Korean financial institutions. Review the indicators and urgent CISO actions.
Attackers are chaining two AhsayCBS flaws for SYSTEM-level code execution, webshells and cryptomining. Version 10.3.4 remains vulnerable; restrict access and investigate now.
CISA added five legacy vulnerabilities exploited by China-linked actors to KEV, with an October 11 federal deadline. Here is what security leaders should find, patch and investigate now.
The FBI and Secret Service say FortiBleed remains active against FortiGate firewalls and SSL VPNs, with administrator lockouts, ransomware access and new indicators requiring immediate review.
Fortinet now lists fixed FortiMail builds for exploited CVE-2026-104286. Its log indicators show a rogue archive account sending data to attacker infrastructure, a change that survives the upgrade.
