What to patch now: the 33 flaws attackers used this month

Thousands of vulnerabilities are published every month, and most of them will never be used in an attack. The best public signal for which ones are being used is the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalogue (KEV): a flaw only goes on it when there is reliable evidence that attackers are exploiting it. Between 25 September and 25 October 2026, CISA added 33, from 23 vendors.

The deadlines in the catalogue are for US government agencies, but the list is just as useful in Europe: if you run one of these products, it is being attacked somewhere now. This is the month's list, grouped by where the products sit in a typical company, with the most urgent group first. Every CVE links to its page on this site, with fixes, advisories and scores; the full list, updated every two hours, is on our exploited vulnerabilities page.

Patch first: the edge of your network

12 of the 33 are in equipment that sits on the internet and guards the way in: Citrix NetScaler gateways (three flaws), Fortinet's FortiMail and other Fortinet products, Cisco's Secure Email Gateway and Catalyst SD-WAN Manager, Ivanti Connect Secure, Palo Alto Networks PAN-OS, BeyondTrust Remote Support, Arista's VeloCloud Orchestrator and MikroTik RouterOS. These devices can be reached by anyone on the internet, they often sit outside the reach of endpoint security tools, and getting past them puts an attacker straight inside the network. That is why ransomware groups favour them: in October, Qilin and INC were found breaking in through an older PAN-OS flaw, as we described in our ransomware round-up.

Two practical points. First, several of these flaws are in management interfaces, such as CVE-2026-0322 in PAN-OS, which needs an attacker to reach the firewall's management page; the simplest protection, besides the patch, is to make sure management pages can only be reached from an internal admin network, never from the internet. Second, patching a gateway that has already been broken into does not remove the attacker. Where the vendor publishes checks for signs of compromise, run them after you patch.

Next: business software you host yourself

The second group is software that companies run on their own servers: Microsoft SharePoint, Atlassian's products, the Collabora Online and ONLYOFFICE document servers, the Zammad helpdesk, the AhsayCBS backup server, WordPress, Siemens Software Center and SiteGuard Server Edition. If these are reachable from the internet, treat them like the edge devices above. Backup servers deserve particular attention: ransomware groups go after backups so that victims cannot restore without paying, and the AhsayCBS flaws include one scored 10.0.

Old flaws, still being used

On 8 October CISA added five flaws that are years old: ProFTPD (CVE-2015-3306) and ISC BIND (CVE-2015-5477) from 2015, Apache Struts (CVE-2016-3081) from 2016, ONLYOFFICE Docs (CVE-2021-3199) from 2021 and Strapi (CVE-2023-22894) from 2023. An old flaw going on the list means attackers are finding servers that were never updated. These are usually forgotten systems: a test server, an old FTP box, a product nobody owns any more. Your own asset list, or an outside scan of your address range, is the way to find them.

Laptops, phones and media servers

The rest are on devices people use every day: a Windows command injection flaw (CVE-2026-96951), a flaw in several Apple products (CVE-2026-86950) and four flaws in Plex Media Server. Windows and Apple fixes arrive through normal updates, so the job is to check that they have actually been installed everywhere, including on devices that are rarely switched on. Plex is mostly a home product, but it matters to companies too: staff who work from home often run it on the same network as their work laptop, so ask them to update it.

When there is no fix to install

For 14 of the 33, our sources do not link a fixed version yet. That does not always mean there is no fix: vendors often publish updates on their own portals first. Check the vendor's advisory, linked from each CVE page. If there really is no fix, CISA's advice is to apply the vendor's mitigations or stop using the product until it is fixed. In practice that means taking it off the internet, putting it behind a VPN, or switching off the affected feature.

How to use this list

1. Check each product against your asset list. If you don't have an up-to-date list of what you run and what is reachable from the internet, that is the first thing to fix.
2. Patch internet-facing systems within days, not at the next monthly cycle. Once a flaw is on this list, attackers are already using it.
3. After patching an internet-facing device, check it for signs of compromise using the vendor's guidance.
4. Follow new additions as they come: our exploited page and RSS feed update every two hours.

Source: CISA Known Exploited Vulnerabilities catalogue (CC0), with CVSS scores from the NVD and fixes from the sources listed on our about page. "Fix linked" means one of our sources links a fixed version or patch; it was correct on 25 October 2026.