What to patch now — 19 October 2026
Source: CISA Known Exploited Vulnerabilities (KEV) catalog — the most recently added entries as of today. Every vulnerability below has been confirmed by CISA as actively exploited in the wild, meaning attackers are already using it, not just researching it. If you (or a supplier) run any of this software, treat it as urgent.
Busier than last week, and skewed toward the edge of your network. CISA added nine entries since the last edition (12 October) — up from a quiet five last time. Two of the nine are a chained pair in the same product and are covered as one entry below, so there are eight write-ups. None are yet flagged by CISA as linked to a known ransomware campaign, but several need no password at all to exploit.
1. Ivanti Connect Secure VPN gateway — an outsider can run commands with no password at all (CVE-2026-104935)
🛠️ Ivanti Connect Secure · added 13 Oct 2026 · CISA fix-by date 16 Oct 2026 (3 days overdue)
What it is: Ivanti Connect Secure is a VPN gateway many businesses use to let staff and contractors connect in securely from outside the office. This flaw is an "authentication bypass by spoofing" — the gateway can be tricked into treating a request as already verified when it isn't, and once past that check, an attacker who has never logged in can make the device run their own commands. No password is required at all. Ivanti's VPN products have been a repeat target in past years, so this is worth treating as high-priority even by the standard of this list.
Who's affected: Any business using Ivanti Connect Secure as its remote-access VPN — ask whoever manages your network (in-house IT or an outsourced provider) whether this is the product in use.
What to do: Apply Ivanti's patch immediately if you run this gateway. If it's managed by an outsourced IT provider, call them today rather than waiting for a regular check-in — this one is both unauthenticated and already overdue against CISA's own deadline.
2. Microsoft Windows — a flaw lets an attacker slip past a built-in security check over the network (CVE-2026-96951)
🛠️ Microsoft Windows · added 13 Oct 2026 · CISA fix-by date 16 Oct 2026 (3 days overdue)
What it is: This sits in the Windows Shell — the part of Windows that handles things like file icons, right-click menus and how the system launches programs. "Command injection" means a specially crafted file or link can smuggle in an extra instruction Windows wasn't meant to run; paired with a way to bypass a Windows security feature over a network, it gives an attacker more room to act than that security check was designed to allow. Because the Windows Shell runs on essentially every Windows PC and server, this reaches far wider than most entries on this list.
Who's affected: Every business running Windows — there's no niche here; this is as broad as it gets.
What to do: Make sure Windows Update is switched on and current, or confirm with IT that this month's Windows updates have rolled out to every machine if updates are managed centrally.
3. Ahsay backup software — a chained pair of bugs lets an outsider walk straight into the server holding your backups (CVE-2026-105133 and CVE-2026-105134)
🛠️ Ahsay AhsayCBS · added 14 Oct 2026 · CISA fix-by date 17 Oct 2026 (2 days overdue)
What it is: AhsayCBS is backup server software — what many backup-as-a-service providers run behind the scenes to store and manage their customers' backups. CISA added two bugs in it together because they chain: the first (CVE-2026-105133) lets an attacker bypass the login check by manipulating a parameter in the server's own password-check function; the second (CVE-2026-105134) then lets that attacker run operating-system commands through a different part of the software. Together, no valid password is needed to go from "outsider" to "running commands on the box holding your backups."
Who's affected: Not usually the small business directly — AhsayCBS is typically run by a backup or IT service provider on behalf of its clients, not installed by an SMB itself. If your backups are handled by an outsourced provider, this is squarely their problem to fix, but it's worth knowing whether your provider uses it.
What to do: Ask your backup or managed-service provider directly whether they run Ahsay, and if so, whether both fixes are applied — a compromised backup server can mean an attacker reaching the one copy of your data meant to survive everything else going wrong.
4. Cisco Secure Email Gateway — a flaw lets an outsider write files onto the appliance with no login (CVE-2026-76519)
🛠️ Cisco Secure Email Gateway · added 14 Oct 2026 · CISA fix-by date 17 Oct 2026 (2 days overdue)
What it is: This is an on-premises email-security appliance some businesses run to filter spam, phishing and malware before it reaches staff inboxes. "Relative path traversal" means a crafted request can trick the device into writing a file outside the folder it's supposed to stay confined to — and because it needs no login at all, an unauthenticated outsider can plant files directly on the appliance's own operating system.
Who's affected: Businesses running their own on-premises Cisco email-security appliance rather than a cloud email filter (Microsoft 365's own filtering, or a hosted provider). More common among mid-sized organisations and the IT providers managing mail security for several clients than a typical small shop on a cloud mailbox.
What to do: If you or your IT provider run this appliance, apply Cisco's fix now; if your email runs entirely through a cloud provider's own filtering, this doesn't apply to you.
5. Palo Alto Networks PAN-OS firewall — a logged-in attacker can run code as root (CVE-2026-0322)
🛠️ Palo Alto Networks PAN-OS · added 14 Oct 2026 · CISA fix-by date 17 Oct 2026 (2 days overdue)
What it is: PAN-OS is the operating system Palo Alto Networks firewalls run on. This "code injection" flaw lets someone who already holds a valid account on the firewall, and network access to it, go further than that account should allow — running their own code with full ("root") control of the device. Needing an existing account is a meaningful limit, but it also means the risk is highest wherever more people than necessary hold admin-level logins, or where a different compromise (a stolen password, say) has already happened.
Who's affected: Businesses whose network firewall is a Palo Alto Networks appliance — typically set up and managed by an IT provider rather than run directly by the business.
What to do: Ask whoever manages your firewall whether it's a Palo Alto device and whether this patch is on; it's also a good prompt to check that admin access to the firewall is limited to people who genuinely need it.
6. Atlassian self-hosted tools — a flaw can expose files inside the application that should be private (CVE-2026-21589)
🛠️ Atlassian Confluence, Jira, Bitbucket, Bamboo, Crowd, Crucible, Fisheye (Data Center editions) · added 15 Oct 2026 · CISA fix-by date 18 Oct 2026 (1 day overdue)
What it is: This affects the self-hosted "Data Center" editions of Atlassian's well-known workplace tools — Confluence (wikis/documentation), Jira (issue and project tracking), Bitbucket (code repositories) and several smaller products. The flaw lets an unauthenticated outsider reach specific files sitting inside the application's own folder structure that were never meant to be reachable from outside. It does not affect Atlassian's cloud-hosted plans (Confluence Cloud, Jira Cloud) — only software run on a business's own servers.
Who's affected: Organisations that specifically chose to self-host Atlassian's Data Center products rather than use Atlassian's cloud plans — usually a larger team with its own IT department, not something stumbled into. If you use Confluence or Jira through a standard cloud subscription, this doesn't reach you.
What to do: If you self-host any of the listed products, apply Atlassian's fix now. If you're on Atlassian's cloud plans, there's nothing to do here — Atlassian patches the cloud version for you.
7. BeyondTrust Remote Support — a flaw lets an attacker impersonate a legitimate request to the appliance (CVE-2026-102764)
🛠️ BeyondTrust Remote Support · added 16 Oct 2026 · CISA fix-by date 19 Oct 2026 (due today)
What it is: Remote Support is software IT help desks and managed service providers use to take control of a user's screen to fix a problem — the kind of tool behind "I'm going to take over your mouse for a moment." This is another "authentication bypass by spoofing": the appliance can be fooled into treating a forged request as trusted, letting an attacker perform file operations on it without the credentials that should be required. Remote-support tools like this have been high-value targets before, precisely because they're built to have privileged access into other systems.
Who's affected: Businesses using BeyondTrust's Remote Support product for IT help-desk access, or whose IT provider uses it to support them remotely.
What to do: Ask your IT support provider whether they use BeyondTrust Remote Support and whether it's patched — if a remote-support tool used to access your systems is compromised, the attacker potentially inherits the same access your support provider has.
8. Fortinet firewalls and related products — a privileged account can be abused to tamper with files on the device (CVE-2025-61624)
🛠️ FortiOS, FortiPAM, FortiProxy, FortiSwitchManager · added 16 Oct 2026 · CISA fix-by date 19 Oct 2026 (due today)
What it is: FortiOS is the operating system behind Fortinet's firewalls, with FortiPAM, FortiProxy and FortiSwitchManager as related Fortinet security products. This "path traversal" flaw lets someone who already holds an admin-level account with read-write permissions run specific commands that write or delete files outside the areas they should be confined to. As with the Palo Alto entry above, an existing privileged account is required, so the real-world risk tracks closely with how tightly admin access to the device is controlled.
Who's affected: Businesses running Fortinet firewalls or the related named products — again, usually set up and managed by an IT provider.
What to do: Ask your network or firewall provider whether any Fortinet devices in use need this fix, and treat it as a reminder to review who holds admin-level accounts on your security appliances generally.
This is an awareness summary of public CISA KEV data, not professional security advice. CISA "fix-by" dates are US federal deadlines; for everyone else they're a strong urgency signal, not a legal obligation. Always confirm the affected versions and the fix against the vendor's own advisory.