Exploited CVEs Last Week: October 12-18, 2026

Eight CVEs from seven vendors entered CISA's Known Exploited Vulnerabilities catalog between October 13 and 16, 2026, and VulnTracker marks every one of them as Active in SSVC. Five of the eight sit on security or remote access products at the network edge: BeyondTrust Remote Support, Ivanti Connect Secure, Fortinet FortiOS, Palo Alto Networks PAN-OS and Cisco Secure Email Gateway. The other three are two flaws in Ahsay's backup server and a Windows Shell bypass.

Federal deadlines for the group ran from October 16 to October 19, so the first of them had already passed before the week ended. This post lists the eight, summarizes what each one does, and looks at what the scores and SSVC values say when read side by side.

The week at a glance

All values below are as VulnTracker shows them on October 19, 2026. Scores are the NVD or primary CVSS figure displayed in the list. SSVC order is exploitation, automatable, technical impact.

CVE	Vendor and product	Score	EPSS	SSVC	Added to KEV	Federal due
CVE-2026-102764	BeyondTrust Remote Support	9.8 Critical	1%	Active, Automatable, Total	Oct 16	Oct 19
CVE-2025-61624	Fortinet FortiOS	6.5 Medium	1%	Active, Not automatable, Total	Oct 16	Oct 19
CVE-2026-0322	Palo Alto Networks PAN-OS	7.2 High	1%	Active, Not automatable, Total	Oct 14	Oct 17
CVE-2026-76519	Cisco Secure Email Gateway	9.8 Critical	2%	Active, Automatable, Total	Oct 14	Oct 17
CVE-2026-105134	Ahsay AhsayCBS	10 Critical	5%	Active, Automatable, Total	Oct 14	Oct 17
CVE-2026-105133	Ahsay AhsayCBS	7.3 High	0.9%	Active, Automatable, Partial	Oct 14	Oct 17
CVE-2026-96951	Microsoft Windows Shell	8.8 High	2%	Active, Not automatable, Total	Oct 13	Oct 16
CVE-2026-104935	Ivanti Connect Secure	8.6 High	26%	Active, Automatable, Total	Oct 13	Oct 16

Edge and remote access products

BeyondTrust Remote Support (CVE-2026-102764). Improper origin validation in an internal messaging component lets a remote attacker perform file operations on the appliance. Mandiant ties the exploitation, which began on August 29, to ARMORY CASTLE, a suspected China-nexus espionage group that dropped a PHP webshell and a SOCKS5 tunneler after getting in. The BT26-05-RS patch covers versions 24.3.1 through 26.2.3, and BeyondTrust says SaaS instances are already patched.

Ivanti Connect Secure (CVE-2026-104935). Volexity found an actor chaining three zero-days to reach root on a fully patched VPN appliance, starting with an authentication bypass in the welcome.cgi path. The fixes are 25.1.1.2, 25.1.3.0, 25.1.3.1 and 22.8R2.5. When Ivanti published its advisory, the third flaw in the chain, a privilege escalation, had no fix yet. This CVE also has the highest EPSS of the week, 26%.

Fortinet FortiOS (CVE-2025-61624). A path traversal in the command line interpreter turns an admin session into file writes as root. Palo Alto Networks Unit 42 saw it used to deploy PEERSTITCH, a memory-only implant that hooks the logging and IPsec VPN daemons on FortiGate firewalls. Fortinet fixed the bug in April with a Medium rating, and CISA listed it as exploited six months later.

Palo Alto Networks PAN-OS (CVE-2026-0322). A code injection flaw in the management interface lets an authenticated attacker with network access to that interface run code as root. Palo Alto reports very limited exploitation and offers no workaround, only per-train fixes. VulnTracker's list shows 7.2 for it, while Palo Alto's own CVSS 4.0 score is 8.6.

Cisco Secure Email Gateway (CVE-2026-76519). An unauthenticated arbitrary file write in the Advanced Malware Protection feature can lead to root command execution when File Reputation is on and Content Scanner Tools is older than 25.3.0.5525. Cisco scores it 9.8, says a limited number of customers were hit, and offers either AsyncOS 15.5.5-014 and 16.5.0-780 or the lighter Content Scanner Tools update. It is the second Secure Email Gateway zero-day in about two months.

Backup and Windows

Ahsay AhsayCBS (CVE-2026-105133 and CVE-2026-105134). Attackers chain an authentication bypass in the JSON API (7.3, High) with a command injection reached through the Replication Receiver (10.0, Critical). The second step only works when the server is set up as a replication receiver. Huntress saw exploitation from October 7, with JSP webshells and an XMRig miner dropped on compromised hosts. Early patches did not close the flaws, so customers need the hotfix: 10.3.4.45 on version 10 and 9.15.2.70 on version 9, with versions 7 and 8 moving to 9.15.0.0 first.

Microsoft Windows Shell (CVE-2026-96951). A Mark of the Web bypass that lets a crafted file lose the internet-origin tag, so SmartScreen, Office Protected View and similar checks stand down. It needs a user to open the file, which is why SSVC marks it Not automatable. It was the one exploited bug in the record October 13 Patch Tuesday, and the fix is in that month's cumulative update.

What the numbers say when read together

Seven of the eight CVEs have an EPSS of 5% or less, and only Ivanti's, at 26%, stands out. EPSS estimates the chance of exploitation in the next 30 days, so a queue sorted by it would have pushed most of this week's list toward the bottom. Every one of them was already being exploited.

CVSS sorts the list differently, and not much better. Three entries are Critical (BeyondTrust, Cisco and Ahsay's CVE-2026-105134), four are High, and Fortinet's CVE-2025-61624 is Medium at 6.5. Palo Alto's CVE-2026-0322 sits at 7.2 on VulnTracker's list. Both of those need an authenticated session, which is what holds their scores down, and both carry Total impact in SSVC.

SSVC is the column that separates this week's list most cleanly. All eight read Active, seven read Total impact, and the only Partial belongs to Ahsay's authentication bypass, which attackers chain with the other Ahsay flaw anyway. The Automatable column splits the week five to three. BeyondTrust, Cisco, Ivanti and both Ahsay flaws can be reached without a user clicking anything, so they come first. Fortinet, Palo Alto and Microsoft need an admin session or a user to open a file, which makes them slower to spread but no less serious for the systems they sit on.

The common thread is the product role, not the bug class. Remote support, VPN, firewall, email gateway and backup server are all tools that hold credentials or reach into other systems, and an intruder who controls one inherits that reach.

What to do this week

The federal due dates for the group have all passed or fall on October 19, so use them as the minimum bar. Start with the five automatable flaws, then check the other three. For each one that was exploited before a fix, patching is only half the work: check for signs of earlier access.

BeyondTrust Remote Support: apply the BT26-05-RS patch (upgrade first if you run something older than 24.3.1), restrict the admin interfaces, forward logs off the appliance, and hunt back to late August.
Ivanti Connect Secure: move to 25.1.1.2, 25.1.3.0, 25.1.3.1 or 22.8R2.5, do not trust the Integrity Checker Tool alone, and watch for the privilege escalation fix.
Cisco Secure Email Gateway: check whether File Reputation is on, then update Content Scanner Tools to 25.3.0.5525 or move to a fixed AsyncOS release.
Ahsay AhsayCBS: apply hotfix 10.3.4.45 or 9.15.2.70, keep the management interface off the internet, and look for unexpected JSP files and miner processes.
Fortinet FortiOS: upgrade to a fixed release, limit admin access, and hunt for the PEERSTITCH indicators in Unit 42's report, since the implant lives in memory.
Palo Alto PAN-OS: move to the fixed release for your train and block the management interface from untrusted networks.
Windows Shell: deploy the October cumulative update, starting with endpoints that open outside files, and keep Protected View and SmartScreen on while you do.

Takeaway

This week's list shows that exploitation does not wait for a high score or a high EPSS. Seven of the eight were at or below 5% EPSS, one was rated Medium, and seven of them sat on products that reach into other systems. Patch the automatable ones first, then look back for access that predates the fix. If you want to know when the vendors and products you run land in KEV, you can track them on VulnTracker and see the due date the day CISA sets it.