CISA stopped reliably sending KEV alerts.
We didn't.
CyberComply monitors the CISA Known Exploited Vulnerabilities catalog 24/7 and alerts you the moment a new KEV drops — before the deadline clock starts ticking without you knowing.
KEV Brief: Edge Devices, Backup Servers, and Legacy Debt (October 15, 2026)
Eight KEV entries are due or overdue this week, and they share one theme: attackers are going after infrastructure that sits at trust boundaries, and CISA is giving defenders very little time to respond. Every entry carries a three-day remediation window under BOD 26-04, plus the "Forensics Triage Requirements." That pairing signals CISA expects compromise to be assumed, not merely prevented. Two entries this week also show why the KEV entry alone is not enough: in both the Ivanti and AhsayCBS cases, the most important guidance arrived after the catalog listing, and a team that followed only the original fix would believe it was safe when it was not.
Perimeter and Edge Appliances: Deadlines Are Here or Imminent
Four entries hit security appliances, gateways, and endpoints between the internet and your internal network.
- CVE-2026-104935 (Ivanti Connect Secure) is an authentication bypass that gives a remote, unauthenticated attacker arbitrary command execution. It was added October 13 with a deadline of October 16, which is tomorrow. Volexity, which discovered the attacks, found it used as part of a three-bug chain against an appliance that was fully patched at the time, with exploitation beginning October 3. The attacker reached root, then went after Active Directory: LDAP service credentials, LAPS local administrator passwords, BitLocker recovery keys, and password spraying. Two caveats change the response. First, Ivanti's Integrity Checker Tool will likely not detect this compromise: the attacker modified code only in memory, restored what it changed, scrubbed logs, and left no web shell behind. Network and memory forensics are required. Second, the chain's privilege escalation flaw is not yet patched. Today's fix closes the unauthenticated entry point that makes it reachable, but expect a second Ivanti update in the coming weeks.
- CVE-2026-76519 (Cisco Secure Email Gateway) is an unauthenticated relative path traversal that allows arbitrary file writes on the underlying OS. Arbitrary file write on an appliance usually becomes code execution through web shells, cron entries, or overwritten scripts. Its deadline is October 17.
- CVE-2026-0322 (Palo Alto Networks PAN-OS) is a code injection flaw that gives an authenticated attacker with network access root on the firewall. "Authenticated" is a weaker barrier than it sounds. If your management interface is reachable from anywhere other than a dedicated management network, or if credentials have leaked, the barrier disappears. Its deadline is also October 17.
- CVE-2026-96951 (Microsoft Windows Shell) is a command injection flaw that lets an unauthorized attacker bypass a security feature over a network. It is the odd one out, an endpoint and server issue rather than an appliance issue. It shares the October 16 deadline with Ivanti, so Windows patch teams and network teams are competing for the same change windows.
What to do:
- Inventory exposure first. BOD 26-04 makes you responsible for evaluating each asset's internet exposure, so identify which of these appliances face the internet or untrusted segments.
- Patch or apply vendor mitigations, then run forensic triage before declaring an appliance clean. Review logs and look for unexpected files, new accounts, and outbound connections. Vendor integrity checkers help on Cisco and PAN-OS but are not sufficient for Ivanti; there, hunt web logs for high volumes of requests to
/dana-na/auth/url_default/welcome.cgicarrying anX-DSCGI-PATHheader, and check/tmp/on the appliance. Patching does not remove an attacker who is already in. - Rotate credentials and secrets that touched these devices, including local admin accounts, LDAP/AD service accounts, API keys, certificates, and VPN-related secrets. For Ivanti, follow CISA's recovery sequence (back up the configuration, factory reset or rebuild, upgrade, restore, then reset all passwords and reissue certificates and keys), and because LAPS passwords and BitLocker keys were targeted, rotate those domain-wide, not just on the appliance.
- Restrict management planes to dedicated out-of-band networks. If a patch cannot be applied in time, the BOD guidance is to apply mitigations or discontinue use of the product. Pulling an internet-facing email gateway offline is painful, but less so than a breach.
Chained Flaws in Backup Infrastructure: AhsayCBS
CVE-2026-105133 (an improper authentication flaw in the AhsayCBS API's checkSysPwd function) and CVE-2026-105134 (an OS command injection in the Replication Receiver's /rps/api/json/UpdateReceivers.do endpoint) are being exploited as a chain. The first bypasses authentication and the second delivers command execution as SYSTEM, which together amount to unauthenticated remote code execution on a backup server. Huntress first observed exploitation on October 7, with attackers deploying JSP web shells and an XMRig cryptominer disguised as edge.exe. Both are due October 17.
The first patch did not work. Ahsay confirmed on October 10 that version 10.3.4.0 did not fully fix either flaw. Servers upgraded to 10.3.4 are still vulnerable until hotfix 10.3.4.45 is installed and the server is rebooted. If your team closed this ticket after the 10.3.4 upgrade, reopen it.
Backup platforms are high-value targets. They store credentials, hold copies of sensitive data, and are the recovery path ransomware operators want to destroy. AhsayCBS is especially popular with managed service providers and system integrators, which means many organizations are exposed through a provider rather than their own install. Today's cryptominer is a low-stakes payload on access that could just as easily serve a ransomware crew.
What to do:
- Install hotfix 10.3.4.45 and reboot. Confirm the build number; do not rely on the 10.3.4 version label.
- Remove AhsayCBS management and replication endpoints from direct internet exposure. Put them behind a VPN or restrict them to trusted IPs.
- Hunt for unexpected child processes of the AhsayCBS service (
cbssvcX64.exe). Because the web app runs inside the service process, web shell commands appear as its direct children. Also review logs for requests to the checkSysPwd API and UpdateReceivers.do from unfamiliar sources. - Ask your MSP and other backup providers directly whether they run AhsayCBS and which build.
- Assume stored backup credentials and encryption keys are exposed if you find suspicious activity, and rotate them. Verify that offline or immutable backup copies are intact.
Legacy Debt Resurfaces: ProFTPD and Apache Struts
Two old vulnerabilities were added October 8 with deadlines of October 11, which makes both overdue by four days for any federal agency still affected. Their return is not a coincidence. They came from joint advisory AA26-281A, in which the FBI, CISA, NSA, and international partners documented intrusions enabled by Integrity Technology Group, a sanctioned China-based contractor whose activity overlaps with Flax Typhoon. The flaws were found in the actors' own exploit tooling and confirmed as successfully exploited.
- CVE-2015-3306 (ProFTPD) allows remote attackers to read and write arbitrary files through the
site cpfrandsite cptocommands (the mod_copy module). Unauthenticated file write on an FTP server is typically a short path to code execution, such as dropping a web shell into a web root. - CVE-2016-3081 (Apache Struts) is remote code execution through Dynamic Method Invocation in Struts 2.3.x. Struts 2.3 is long past end of life, so any surviving instance is a replacement project. If replacement cannot happen immediately, disabling Dynamic Method Invocation closes the hole.
The same advisory added three more entries now overdue: CVE-2015-5477 (ISC BIND denial of service), CVE-2021-3199 (ONLYOFFICE Document Server), and CVE-2023-22894 (Strapi). Search software inventories and scan results for all five, including copies bundled inside vendor appliances and container images. For ProFTPD, disable mod_copy if it isn't needed and check web roots and upload directories for unexpected files.
Prioritization Summary
- Today: CVE-2026-104935 (Ivanti), due tomorrow, plus CVE-2026-96951 (Windows). For Ivanti, start forensics now; the integrity checker will not give you an answer.
- By October 17: PAN-OS, Cisco Secure Email Gateway, and both AhsayCBS CVEs. For AhsayCBS, verify hotfix 10.3.4.45 specifically.
- Already overdue: ProFTPD, Struts, and the rest of the AA26-281A batch. Close these out and document any exceptions.
Contractors handling federal data should also expect customers to ask for evidence of remediation and forensic triage, not just patch confirmation. This week, "we patched" is not evidence for either Ivanti or AhsayCBS.
Sources: CISA KEV Catalog · CISA Alert: Ivanti Connect Secure · Ivanti Security Advisory: CVE-2026-104935 · Volexity: Chained Exploitation of Ivanti Connect Secure Zero-Days · Huntress: AhsayCBS Exploitation · Palo Alto Networks Security Advisories · Cisco Security Advisories · Microsoft Security Update Guide · CISA Advisory AA26-281A · Apache Struts S2-032
Free KEV Alerts
- Real-time notification the moment a KEV drops
- Vendor and product details
- BOD 26-04 remediation deadline included
Pro Alerts Coming Soon
- Real-time notification the moment a KEV drops
- Filtered to your specific vendor watchlist
- Urgency scoring (Critical / Urgent / Standard)
- Direct patch links included
Stay ahead of CISA.
Search the KEV Catalog by Vendor or Product
Search for CVEs by vendor or product to identify known exploited vulnerabilities in your environment
Upcoming Patch Due Dates
via Binding Operational Directive 26-04
BOD 26-04 is CISA's current vulnerability remediation directive for Federal Civilian Executive Branch (FCEB) agencies, updating the KEV-driven framework introduced under BOD 22-01 with a more risk-based approach to prioritization. While binding only on FCEB agencies, its framework increasingly influences contractor expectations through procurement requirements, FedRAMP programs, and agency security clauses.
Loading...
Cyber Security News
You may have missed...
Hacking Editorial Brief — October 15, 2026
Iranian Threat Actor Expands Infrastructure Targeting Across Middle East
An Iranian threat actor linked to the Shelby Strategy campaign is actively targeting telecommunications, aviation, and critical infrastructure across Iraq, Israel, and the UAE. The campaign represents expanded operational scope for this group, focusing on strategically significant sectors. Separately, U.S. federal authorities have issued warnings to local water systems following suspected Iranian targeting of Minnesota water infrastructure. The timing suggests coordinated reconnaissance or preparatory activity against critical infrastructure sectors across multiple geographic regions.
AI-Enabled Tooling Used Against South Korean Financial Institutions
An unidentified Chinese-speaking threat actor deployed ARTEX, an open-source agentic penetration testing tool leveraging multiple large language models, in attacks against South Korean financial institutions. This represents tactical evolution from yesterday's confirmed breach affecting 16 financial organizations with 100,000 compromised records, indicating sophisticated threat actors are actively integrating AI-driven offensive tools into campaigns targeting the financial sector. The use of publicly available AI penetration testing frameworks demonstrates how emerging technologies are being rapidly weaponized for intrusion operations.
Critical Security Incidents Span Operational Technology and Government Systems
France has opened an investigation into a cyberattack affecting hundreds of food retailers, causing refrigeration system malfunctions that resulted in widespread food spoilage. The attack likely exploited outdated firmware in remotely managed refrigeration units, highlighting operational technology vulnerabilities in retail supply chains. Meanwhile, a breach of Denmark's national ID register exposed names, addresses, and CPR numbers for approximately 8.8 million individuals, with the attacker claiming access was obtained through a "123456" password. Additionally, social media accounts operated by An Garda Síochána (Irish police) were compromised in a cryptocurrency-related breach.
Sources: Israel Defense · ABC7 News · CrowdStrike · NPR · TechPowerUp · RTE
*
Inside a cyberattack: How hackers steal data
The truth about cybersecurity is that it's almost impossible to keep hackers outside of an organization, particularly as the cybercrime industry ...
3 Cybersecurity Stocks With Market Caps Over $9 Billion - Yahoo Finance
Palo Alto Networks sits near the center of this cybersecurity screen because its Cortex platform tackles exactly what growing AI and cloud usage ...
X suspends 13,000 accounts, alleging foreign influence ahead of US midterms - Al Jazeera
Who's in charge in Iran? News|Cybersecurity. X suspends 13,000 accounts, alleging foreign influence ahead of US midterms. The social platform says ...
Grocery store hack could have broader implications, national security expert says - 6abc Philadelphia
Grocery store hack impacting Giant, Stop & Shop and Food Lion could have broader implications, National Security Expert says.
I opened one port on my home router. The "hacker's search engine" found it in two hours
The "hacker search engine" found my port in about an hour. Shodan constantly scans the internet and indexes everything.
Feds issue warning to local water systems over increased cyberattacks, following Minnesota incident
Minnesota systems may have been targeted by Iranian groups, U.S. officials say. Iran suspected in hack of Minnesota water systems.
France investigates cyberattack that hacked retailers' refrigeration systems - NPR
France has opened an investigation into a cyberattack that hit hundreds of food retailers, causing refrigerators to malfunction across the ...
Security researchers spent 6 days doing their Chromework, built 1B user exploit
Researchers chained three zero-day vulnerabilities in Chrome into an exploit affecting approximately one billion users, earning a $250,000 bounty from...
Volt Typhoon Explained: Tactics, Targets & 2026 Threat
An analysis of Volt Typhoon, a China-linked state-sponsored hacking group pre-positioning in U.S. critical infrastructure using living-off-the-land te...
Updated daily