The oldest bug CISA listed this month is eleven years old.

TL;DR

• CISA added 36 exploited vulnerabilities in October, after 43 in September, and gave federal agencies three days to fix 29 of them.
• Five were three to eleven years old, listed together on October 8 after a joint advisory on a Chinese government-linked company's operators.
• php2shell and HTTP2Shell each reached 82% of active environments in ZEST platform data within a day of their fixes, and an attacker chained php2shell with a Linux kernel flaw to root 24 Palo Alto Networks firewalls. ZEST researchers found a third PHP flaw, still unfixed.
• Eight products were attacked before a complete fix existed, AI helped find nine of the 36, and four incident reports describe attackers using AI.
• 76% of active environments still have an exploited vulnerability at least five years old open, led by a 2020 jQuery flaw.

Between October 1 and 30, the Cybersecurity and Infrastructure Security Agency (CISA) added 36 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, after 43 in September. Federal agencies got three days to fix 29 of the 36, and nine were listed within a day of their CVE record going public. Five were three to eleven years old: CISA added them on October 8, the day a joint advisory listed them among the CVEs that operators working with Integrity Technology Group, a China-based company with links to the Chinese government, had exploited successfully.

The vulnerabilities that mattered

The Exploit Prediction Scoring System (EPSS) rated most of them unlikely to be exploited. Each vulnerability below carries its Common Vulnerability Scoring System (CVSS) rating and its EPSS value, the estimated chance of exploitation in the next 30 days, as of October 31. All 36 are confirmed exploited, yet on the day CISA listed them EPSS put 21 of the 30 it had already rated below 10%, and six had no value yet. By October 31 it had caught up on several: Atlassian's file read rose from 2.8% to 99%, the AhsayCBS command injection from 1.8% to 82% and the Collabora flaw from 1.2% to 73%. Edge devices and remote access tools led the list with 11 of the 36.

• Integrity Technology Group: five old bugs listed on one day.
  The October 8 advisory from the FBI, CISA, the NSA and six partner countries ties the company's operators to tradecraft consistent with Flax Typhoon and lists eight CVEs recovered from their penetration testing scripts, five of them new to KEV. ProFTPD 1.3.5 built with mod_copy, which is not compiled by default, lets unauthenticated clients copy arbitrary files with SITE CPFR and SITE CPTO, which public exploits use to plant PHP (CVE-2015-3306, CVSS 10, EPSS 99%). One crafted TKEY query crashes BIND 9's named, and no configuration blocks it (CVE-2015-5477, CVSS 7.5, EPSS 99.5%). Struts 2.3.20 through 2.3.28 evaluates attacker-supplied OGNL through the method: prefix when Dynamic Method Invocation is enabled, a non-default setting since 2.3.15.2 (CVE-2016-3081, CVSS 8.1, EPSS 97%). ONLYOFFICE Document Server 5.1.5 to 5.6.2 lets a request with a valid JWT overwrite files through its image upload parameters, which can lead to code execution (CVE-2021-3199, CVSS 9.8, EPSS 30%). Strapi's query filters leak private fields such as password reset tokens, and chained with a second Strapi flaw give unauthenticated code execution up to 4.5.5 (CVE-2023-22894, CVSS 7.2, EPSS 4.1%).
• PHP and Brotli: unauthenticated code execution in components most web stacks ship.
  PHP fixed two unauthenticated code execution flaws on October 21 in 8.2.35, 8.3.36, 8.4.27 and 8.5.12: an out-of-memory corruption (CVE-2026-109618, CVSS 9.2, EPSS 99.9%) and stale internal request state (CVE-2026-109619, CVSS 9.2, EPSS 99.9%). The embargo broke the day before, and ELLIO logged exploitation attempts five and a half hours before the release. Dream later recovered an attacker's toolkit that chained the pair with the Linux kernel flaw below to root 24 Palo Alto Networks firewalls, whose management web server runs PHP. ZEST researchers found a third flaw, in its session upload progress handling (CVE-2026-115560); PHP says it affects fully patched releases, 8.5.12 included, and advises setting session.upload_progress.enabled to 0 until its next regular release fixes it. More on that when we can share more! In Brotli, an unchecked return value lets a crafted compressed stream corrupt the decoder's state (CVE-2026-111497, CVSS 9.2, EPSS 83%); Brotli and Node.js, which bundles its own copy, shipped fixes on October 21, and ELLIO saw a failed attempt against Node.js on October 26. We covered both as they broke: php2shell and HTTP2Shell.
• GitLab and Collabora: the systems that build and share your work are on the list.
  A crafted regular expression in a CI/CD configuration overflows an integer in Ruby's regex engine and runs code on GitLab 19.2 to 19.4 (CVE-2026-97229, CVSS 10, EPSS 27%). Exploitation needs an account that can push a pipeline configuration, and the attack on Alpine Linux's GitLab came from a newly registered one. Collabora's Built-in CODE Server for Nextcloud runs injected commands while the CODE server is not running (CVE-2026-110447, CVSS 9.2, EPSS 73%). A hosting provider's logs show a web shell written on September 10, the day before the silent fix in 26.4.303.
• BeyondTrust and Ivanti: remote access appliances exploited before their fixes.
  An authentication bypass in BeyondTrust Remote Support 26.2.3 and earlier lets a remote attacker run file operations on the appliance, under conditions BeyondTrust has not published (CVE-2026-102764, CVSS 9.3, EPSS 19%). BeyondTrust dates the first exploitation to August 29, Mandiant attributes the activity to ARMORY CASTLE, a suspected China-nexus espionage group that went from a web shell to root, and the patch shipped on October 8. On Ivanti Connect Secure, an authentication bypass by spoofing lets a remote attacker run commands without credentials (CVE-2026-104935, CVSS 8.6, EPSS 87%). Volexity saw UTA0576 exploit a fully patched appliance from October 3, chaining the bypass with a privilege escalation in the dsinvoked service (CVE-2026-111357, CVSS 7, EPSS 0.5%) and with a predictable-filename upload whose CVE record is not published yet (CVE-2026-118527, no published record). Ivanti fixed the bypass on October 13 and the other two on October 29.
• Fortinet: one exploited at disclosure, one listed six months after its fix.
  A path traversal in FortiMail lets an unauthenticated attacker write arbitrary files (CVE-2026-104286, CVSS 9.8, EPSS 4.6%). Fortinet found it internally and marked it exploited in its October 1 advisory while the fixed builds were still listed as upcoming. In FortiOS, an administrator with read-write permissions can write or delete arbitrary files through specific CLI commands (CVE-2025-61624, CVSS 5.4, EPSS 1.3%). Fortinet marked it exploited when it shipped fixes on April 14, and CISA listed it 185 days later, two days after Unit 42 tied its use to CL-STA-0954.
• NetScaler, Cisco, PAN-OS and VeloCloud: more edge devices, each with a precondition that decides exposure.
  NetScaler appliances configured as a SAML service provider or identity provider crash and reboot on a crafted request (CVE-2026-88779, CVSS 8.7, EPSS 11%); Citrix reported targeted attacks when it shipped fixes on October 3. Cisco's Secure Email Gateway lets an email attachment write files and run commands as root (CVE-2026-76519, CVSS 9.8, EPSS 2.2%) on AsyncOS builds older than September 14 with File Reputation enabled. Cisco ASA and FTD reload on an unauthenticated request where the SSL remote-access VPN is enabled and a tunnel group uses secondary authentication (CVE-2026-76418, CVSS 8.6, EPSS 0.8%). PAN-OS lets an attacker with valid high-privilege credentials and access to the management interface run code as root (CVE-2026-0322, CVSS 8.6, EPSS 1.7%). In VeloCloud Orchestrator on-prem, an SQL injection lets any logged-in user, down to the lowest read-only role, become a superuser operator (CVE-2026-114625, CVSS 9.9, EPSS 1.0%); Arista says it detected the issue itself.
• Zammad and AhsayCBS: helpdesk and backup servers chained to root and SYSTEM.
  On Zammad 6.3.0 to 6.5.4, one unauthenticated WebSocket message returns an error containing the session cookies of every connected user, and an administrator's cookie leads to code execution as the zammad user (CVE-2026-102489, CVSS 8.7, EPSS 22%). On DEB and RPM installs, services that start as root run files the zammad account can write, so the account can become root within seconds because the services restart automatically (CVE-2026-102490, CVSS 8.5, EPSS 11%). The chain was used to breach the Dutch Institute for Vulnerability Disclosure (DIVD) on September 21, two days before the fix. In AhsayCBS, an authentication bypass (CVE-2026-105133, CVSS 6.9, EPSS 79%) reaches a command injection in the Replication Receiver's UpdateReceivers.do endpoint that runs as SYSTEM on Windows (CVE-2026-105134, CVSS 10, EPSS 82%); Huntress saw exploitation on October 7, three days before the first complete hotfix.
• Plex Media Server: four flaws, three rated below 7, chained into code execution.
  An unauthenticated request makes the server call itself and leak the owner's admin token, which unlocks a transcoder option that writes a shared library the next transcode loads (CVE-2026-96652, CVSS 4.3, EPSS 1.8%; CVE-2026-96654, CVSS 6.9, EPSS 1.9%; CVE-2026-96655, CVSS 4.3, EPSS 1.6%; CVE-2026-96656, CVSS 8.6, EPSS 1.8%). Plex fixed all four in 1.43.3.10861 on August 4. The researcher, Zach Main, published the chain on October 16, and a honeypot saw it used the next day to drop XMRig and proxyware.
• Linux kernel, Adobe Commerce and VMware ESX: listed months after their fixes.
  Fragnesia lets an unprivileged local user write into the page cache of read-only files and become root (CVE-2026-46300, CVSS 7.8, EPSS 16%); the fix was posted on May 13, and the first dated exploitation is the October 23 firewall campaign above. PolyShell, an upload flaw in Adobe Commerce and Magento (CVE-2026-48356, CVSS 9.3, EPSS 45%), drew a mass wave from March 30 by Sansec's count, months before Adobe's July 14 fix. VMware ESX lets an administrator perform certain operations without logging them (CVE-2026-41709, CVSS 2.7, EPSS 0.7%); CrowdStrike says WARP PANDA, its name for the cluster behind the BeyondTrust zero-day, used it to hide commands during vCenter intrusions, and Broadcom fixed it on July 29.
• Windows, Atlassian, SiteGuard and Siemens: a bypass, a file read, a command injection and a planted DLL.
  The Windows Shell flaw bypasses Mark-of-the-Web, so a crafted file sent by email or instant message opens without the warnings and Office Protected View that Mark-of-the-Web normally triggers (CVE-2026-96951, CVSS 8.8, EPSS 9.8%). In Atlassian's self-managed products, a shared web-resource library turns "::" into "/", so an unauthenticated request can read any file under the web root whose exact path the attacker knows (CVE-2026-21589, CVSS 9.3, EPSS 99%); watchTowr showed that on Jira integrated with Crowd one such file holds Crowd's plaintext application password. In SiteGuard Server Edition, a web application firewall, an OS command injection runs commands as root or SYSTEM (CVE-2026-106931, CVSS 7.8, EPSS 2.5%). Siemens Software Center loads a planted DLL (CVE-2026-110936, CVSS 6.7, EPSS 0.967%), and the ROMULUS ClickFix campaign ships its own signed old copy beside a malicious DLL, so updating does not stop it.

How they were found, and where AI fits

Three of the zero-days were found during incident response. BeyondTrust's threat hunt and Mandiant found the Remote Support flaw, DIVD and Merlon Security found the Zammad pair while investigating DIVD's breach, and Volexity found the Ivanti chain during an incident response engagement. Fortinet found the FortiMail flaw internally and Arista the VeloCloud issue.

AI helped find nine of the 36. All three teams credited for the PHP pair say they used language models, OpenAI Codex Security reported the Brotli bug, Zach Main says he "used LLMs heavily" on the Plex chain, and the Fragnesia discoverer says it was found with an agentic auditing tool. Microsoft credits "Benoit Sevens using Claude with Anthropic" for the Windows Shell zero-day, the only one of the 40 Microsoft KEV entries added in 2026 whose credit names an AI model, and Cisco says frontier AI models were among the methods behind the Secure Email Gateway hardening release that contains a tenth. A public tracker of Anthropic-credited CVEs lists 114 dated September or October; none is on CISA's list, and 82 already appear in ZEST platform data.

AI is on offense too. DIVD says the intruder used AI agents after reaching root, Volexity assesses with medium confidence that UTA0576 uses large language models, Huntress says one script left on an AhsayCBS server appears AI-assisted, and Dream found Claude Code and a scanner configured with DeepSeek and Kimi on the firewall attacker's machine, though no direct evidence that they wrote the exploit.

Who is using them

Only 11 of the 36 have a named attacker. Public reporting ties the five older CVEs to the Integrity Technology Group operators, the BeyondTrust and VMware ESX flaws to ARMORY CASTLE, which CrowdStrike tracks as WARP PANDA, the three Ivanti entries to UTA0576 and the FortiOS flaw to CL-STA-0954. Dream does not attribute the firewall campaign. CISA lists ransomware use as unknown for all 36.

What we saw in ZEST platform data

Most of the October entries we found were there before CISA listed them. Fourteen of the 36 appear in ZEST platform data, and nine of them were there before the listing, a median of 44 days earlier. Fragnesia was first reported in May, 166 days before the listing, and has appeared in 94% of active environments. The 2015 BIND flaw appeared on on-prem hosts 175 days before the listing, the FortiOS flaw 167 days before, the VMware ESX logging flaw 67 days before and the Strapi flaw 44 days before.

Old exploited bugs stay open. Across the 1,766 CVEs in CISA's catalog, 76% of active environments have at least one exploited vulnerability five or more years old still open, 29% have one from 2016 or earlier, and the oldest still open dates from 2012. These older vulnerabilities make up only about 2% of the open instances of exploited vulnerabilities, so they are easy to miss in a flood of new CVEs. The most widespread is a 2020 cross-site scripting flaw in jQuery's DOM manipulation methods (CVE-2020-11023, CVSS 6.9, EPSS 85%), open in 53% of active environments, mostly in container images; CISA added it to the catalog in January 2025. Log4Shell (CVE-2021-44228, CVSS 10, EPSS 99.9%) is still open in 24% of active environments, also mostly in container images. The 2013 WinVerifyTrust flaw, which lets an attacker append content to a signed Windows executable without breaking its signature (CVE-2013-3900, CVSS 5.5, EPSS 45%), stays open because Microsoft ships the fix disabled: Check Point reported Zloader abusing it in January 2022, CISA listed the CVE five days later, and the check applies only once an administrator sets the EnableCertPaddingCheck registry value. It is open in 18% of active environments.

Edge devices are a blind spot in the data. The tools that report into ZEST found only one of the eleven firewall, gateway and remote-access entries, the FortiOS flaw, much as they found one of September's 17 appliance entries. We read that as coverage more than exposure, since host agents and cloud, container and code scanners rarely look inside network gear.

Severity labels undersell exploited bugs. 95% of the jQuery flaw's reported instances carry a Medium severity, every tool that reported the FortiOS flaw rated it Medium, and the VMware ESX logging flaw was rated Low, so all three sit near the bottom of a severity-sorted queue.

The only way to handle it is at machine speed

Attackers did not wait for patch cycles. Eight products on October's list were attacked before a complete fix existed: BeyondTrust, Zammad, Ivanti, FortiMail, AhsayCBS, Collabora, Adobe Commerce and VMware ESX. PHP drew exploitation attempts hours before its release, the Plex chain was in use a day after its write-up, and the fixes for the five October 8 entries are up to eleven years old.

Defenders still work at human speed. The php2shell pair and HTTP2Shell each reached 82% of active environments within a day of their fixes, and on November 1, 90% and 79% of those instances were still open. The Windows Shell zero-day is in 35% of active environments, 80% of its instances open. Keeping up takes a response that runs at machine speed and closes attack paths preemptively, which is the loop ZEST runs: it validates exposure, reachability and exploitability for every vulnerability your tools report, credits the controls that already protect an asset, and hands the rest to AI agents that simulate remediation paths on a Digital Twin of your cloud and on-prem environments before automated remediation ships the root-cause fix.

What to do this month

1. Validate exposure, reachability and exploitability.
   Check every new KEV entry, and the older ones still open in your backlog, against your own environment and the exploitation requirements published for the CVE, because a version match, a CVSS rating or an EPSS value does not tell you whether you are exposed. This month's requirements are in the entries above.
2. Be preemptive with compensating controls.
   Put a control you already run, such as a WAF, IPS, EDR or cloud network policy, on each exploitable path, and switch it to block as soon as an IOC or exploitation of the CVE is identified. A vulnerability behind a blocking control can be dismissed against that control, with the evidence attached, while one behind a control that only watches stays open.
3. Patch only what matters, at the root cause.
   Fix what survives validation without a blocking control at its source, the base image, golden image or dependency that brought it in, so one change shipped through automated remediation fixes every instance built from it. For CVE-2013-3900 the root cause is a missing registry value, not a missing update. Count a vulnerability fixed only when a rescan no longer finds it.
4. Talk to ZEST.
   If October's KEV additions, or the older ones that never left, are already in your backlog, book a demo and we'll show you what ZEST does with them.

How we measured. ZEST platform data, aggregated and anonymized, as of November 1, 2026. "Seen" means a connected tool reported the CVE, an instance is one vulnerability on one asset from one tool, "still open" means open or in progress and reported in the last 14 days, environment shares count environments active in the last 30 days, and a CVE's age is the year in its ID. CVSS comes from each CVE record and EPSS from FIRST, dated October 31, 2026; EPSS on listing day comes from FIRST's API. KEV data: CISA catalog version 2026.10.30.

October's 36. Adobe Commerce, Ahsay AhsayCBS (2), Apache Struts, Arista VeloCloud Orchestrator, Atlassian Data Center, BeyondTrust Remote Support, Cisco Secure Email Gateway, Cisco Secure Firewall ASA and FTD, Citrix NetScaler, Collabora Online, Fortinet FortiMail, Fortinet FortiOS and related products, GitLab, Google Brotli, ISC BIND, Ivanti Connect Secure (3), Linux kernel, ONLYOFFICE Docs, Palo Alto Networks PAN-OS, PHP (2), Plex Media Server (4), ProFTPD, Siemens Software Center, SiteGuard Server Edition, Strapi, VMware ESX, Windows, Zammad (2). CVE IDs are in CISA's catalog.

Sources. CISA: KEV catalog, AA26-281A, BOD 26-04; FIRST EPSS; Mandiant; BeyondTrust: advisory, blog; Ivanti; Volexity; Fortinet: FortiMail, FortiOS; Internet Archive: FortiMail advisory, October 1, FortiOS advisory, April 15; Palo Alto Networks: PAN-OS, Unit 42; Citrix: bulletin, blog, October 2 notice; Cisco: Secure Email Gateway, September hardening release, ASA and FTD; DIVD: breach, Zammad case; Zammad; Horizon3.ai; Ahsay; Huntress; Microsoft: Windows Shell, CVE-2013-3900; Atlassian; watchTowr; CVE Program: CVE-2026-21589, record history; Check Point Research; Anthropic-credited CVE tracker; ProFTPD; ISC; Apache Struts; ONLYOFFICE; Strapi; PHP: CVE-2026-109618, CVE-2026-109619, release news; ELLIO: PHP, Node.js; Calif; Dream; Google: Brotli 1.2.1; Node.js; OpenAI; GitLab: patch release; Ruby; Rapid7; Alpine Linux; Collabora: advisory, web shell report; Plex: security update; Zach Main: Plex2Shell; BoredHackerBlog; Arista; Linux kernel: fix; V12; Adobe; Sansec: PolyShell, mass attack wave; Broadcom; CrowdStrike; EG Secure Solutions; JVN; Siemens: SSA-580366, exploitation notice; Forescout.