← Back to Vulnerability Reports

Vulnerability Priority Report – Week 4 of October 2026

📅 October 26 – November 1•🟢 Live · updated 2026-10-26•31 CVEs tracked this week

Analyst Guidance

This week highlights active exploitation of critical vulnerabilities in collaboration and network orchestration platforms, alongside a memory-corruption flaw in widely-deployed compression libraries. Organizations using Collabora Online, Arista VeloCloud, or software consuming Brotli-compressed data should prioritize patching.

CVE Details & Remediation

How to read this report
Verified facts — NVD & CISA KEV Partially verified — awaiting NVD enrichment AI analysis — synthesis, verify before acting
Actionable · Verified facts
NVD-published · CISA KEV cross-checked

🛡️CVE-2026-105134 – Ahsay AhsayCBS ✓ NVD

CVSS10 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS86% · P100
ActionPatch immediately
AffectedGovernment Technology

Remediation Steps

  1. Apply the vendor security update for Ahsay AhsayCBS as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2015-3306 – Proftpd (also: Fedoraproject, Debian) ✓ NVD

CVSS10 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS99% · P100
ActionPatch immediately
AffectedGovernment Energy

Remediation Steps

  1. Apply ProFTPD security patch immediately
  2. Review access logs for unauthorized administrative access attempts
  3. Restrict network access to FTP services to trusted networks only
  4. Monitor for Flax Typhoon indicators of compromise

References:

🛡️CVE-2026-114625 – Arista VeloCloud Orchestrator ✓ NVD

CVSS9.9 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV
EPSS1% · P63
ActionPatch immediately

Remediation Steps

  1. Check CISA Known Exploited Vulnerabilities catalog for affected products and vendor advisories
  2. Determine if your organization uses the affected product
  3. Apply available vendor patches or mitigations immediately
  4. Monitor for signs of exploitation

References:

🛡️CVE-2026-102764 – BeyondTrust Remote Support ✓ NVD

CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS20% · P97
ActionPatch immediately
AffectedTechnology Government

Remediation Steps

  1. Apply the vendor security update for Beyondtrust Remote Support as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-76519 – Cisco Secure Email Gateway ✓ NVD

CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS2% · P82
ActionPatch immediately
AffectedTechnology Government Finance

Remediation Steps

  1. Apply the vendor security update for Cisco Secure Email Gateway as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-102489 – Zammad GmbH Zammad ✓ NVD

CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS2% · P80
ActionPatch immediately

Remediation Steps

  1. Check CISA Known Exploited Vulnerabilities Catalog for detailed product and version information
  2. Apply vendor-supplied patches or mitigations
  3. Review internal systems for compromise indicators

References:

🛡️CVE-2026-104286 – Fortinet FortiMail ✓ NVD

CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS5% · P92
ActionPatch immediately

Remediation Steps

  1. Apply vendor patch for Fortrix to remediate known exploited vulnerability
  2. Verify patch deployment across all affected instances
  3. Monitor security logs for exploitation attempts post-patching

References:

🛡️CVE-2026-76504 – Cisco Catalyst SD-WAN Manager ✓ NVD

CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS39% · P99
ActionPatch immediately
AffectedTechnology Government Finance

Remediation Steps

  1. Apply the vendor security update for Cisco Catalyst Sd-Wan Manager as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-88771 – Citrix NetScaler ✓ NVD

CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS82% · P100
ActionPatch immediately
AffectedTechnology Finance

Remediation Steps

  1. Apply the vendor security update for Citrix Netscaler Application Delivery Controller as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2021-3199 – ONLYOFFICE Docs ✓ NVD

CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS30% · P98
ActionPatch immediately

Remediation Steps

  1. Apply the vendor security update for ONLYOFFICE Docs as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-110447 – Collabora Online – Built-In CODE Server ✓ NVD

CVSS9.2 NVD 4.0
Triage statusActive Exploit
Exploitation In the wild In CISA KEV
EPSS12% · P96
ActionPatch immediately

Remediation Steps

  1. Apply the vendor patch for Collabora Online Built-in CODE Server immediately
  2. Verify patch application and restart affected services
  3. Monitor logs for signs of exploitation attempts
  4. Restrict access to Collabora Online instances to trusted networks if patching is delayed

References:

🛡️CVE-2026-96951 – Microsoft Windows ✓ NVD

CVSS8.8 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS10% · P96
ActionPatch immediately
AffectedTechnology Government

Remediation Steps

  1. Apply the vendor security update for Microsoft Windows as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-86950 – Apple Multiple Products ✓ NVD

CVSS8.8 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS26% · P98
ActionPatch immediately
AffectedTechnology Finance

Remediation Steps

  1. Apply the vendor security update for Apple iOS, iPadOS, macOS as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-104935 – Ivanti Connect Secure ✓ NVD

CVSS8.6 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS87% · P100
ActionPatch immediately
AffectedTechnology

Remediation Steps

  1. Apply the vendor security update for Ivanti Connect Secure as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2016-3081 – Apache Struts ✓ NVD

CVSS8.1 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS97% · P100
ActionPatch immediately
AffectedTechnology Finance

Remediation Steps

  1. Apply the vendor security update for Apache Struts as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-88772 – Citrix NetScaler ✓ NVD

CVSS8.1 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS78% · P100
ActionPatch immediately
AffectedTechnology Government

Remediation Steps

  1. Apply the vendor security update for Citrix NetScaler ADC/Gateway as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-106931 – EG Secure Solutions SiteGuard Server Edition ✓ NVD

CVSS7.8 NVD 3.0
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS3% · P85
ActionPatch immediately
AffectedTechnology Government

Remediation Steps

  1. Apply the vendor security update for SiteGuard WAF Server Edition as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-102490 – Zammad GmbH Zammad ✓ NVD

CVSS7.8 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS1% · P58
ActionPatch immediately
AffectedTechnology Government Finance

Remediation Steps

  1. Apply the vendor security update for Zammad Ticketing System as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-21589 – Atlassian Multiple Products ✓ NVD

CVSS7.5 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS99% · P100
ActionPatch immediately

Remediation Steps

  1. Locate CISA Known Exploited Vulnerabilities Catalog entry for CVE-2026-21589
  2. Identify affected products in your environment
  3. Apply vendor-supplied patches or workarounds as directed
  4. Monitor for exploitation attempts

References:

🛡️CVE-2015-5477 – ISC BIND ✓ NVD

CVSS7.5 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS100% · P100
ActionPatch immediately
AffectedTechnology Finance

Remediation Steps

  1. Apply the vendor security update for ISC BIND as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-88779 – Citrix NetScaler ✓ NVD

CVSS7.5 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS11% · P96
ActionPatch immediately
AffectedHealthcare Education

Remediation Steps

  1. Apply the vendor security update for Citrix Netscaler Application Delivery Controller as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-105133 – Ahsay AhsayCBS ✓ NVD

CVSS7.3 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS79% · P100
ActionPatch immediately

Remediation Steps

  1. Apply the vendor security update for Ahsay AhsayCBS as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-96656 – Plex Media Server ✓ NVD

CVSS7.2 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS2% · P78
ActionPatch immediately
AffectedTechnology Media

Remediation Steps

  1. Apply the vendor security update for Plex Media Server as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-0322 – Palo Alto Networks PAN-OS ✓ NVD

CVSS7.2 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS2% · P78
ActionPatch immediately
AffectedGovernment Technology

Remediation Steps

  1. Apply the vendor security update for Palo Alto Networks PAN-OS as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-111497 – Google Brotli decoder (affects Node.js, Bun, Python Brotli, brotlicffi, Envoy) ✓ NVD

CVSS9.2 NVD 4.0
Triage statusNo Known Exploit
ExploitationNo exploitation reported
EPSS33% · P98
ActionPatch within 48 hours

Remediation Steps

  1. Identify all instances of Node.js, Bun, Python Brotli packages, brotlicffi, and Envoy proxies in your environment
  2. Check for available patches from respective vendors
  3. Apply patches to update Brotli decoder to patched version
  4. Test decompression of untrusted Brotli-compressed data after patching
  5. Monitor for exploitation attempts targeting Brotli decompression

References:

🛡️CVE-2026-110936 – Siemens Software Center ✓ NVD

CVSS6.7 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS1% · P61
ActionPatch immediately

Remediation Steps

  1. Apply the vendor security update for Siemens Software Center as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-96654 – Plex Media Server ✓ NVD

CVSS6.5 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS2% · P80
ActionPatch immediately
AffectedTechnology Media

Remediation Steps

  1. Apply the vendor security update for Plex Media Server as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2025-61624 – Fortinet Multiple Products ✓ NVD

CVSS6.5 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS1% · P71
ActionPatch immediately

Remediation Steps

  1. Consult CISA Known Exploited Vulnerabilities catalog entry for affected product details and remediation guidance
  2. Prioritize patching based on CISA's recommended timeline
  3. Monitor systems for active exploitation activity
  4. Implement network segmentation to limit exposure if patching cannot be deployed immediately

References:

🛡️CVE-2023-22894 – Strapi ✓ NVD

CVSS4.9 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS4% · P91
ActionPatch immediately

Remediation Steps

  1. Apply the vendor security update for Strapi Strapi as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-96652 – Plex Media Server ✓ NVD

CVSS4.3 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS2% · P79
ActionPatch immediately
AffectedTechnology Media

Remediation Steps

  1. Apply the vendor security update for Plex Media Server as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-96655 – Plex Media Server ✓ NVD

CVSS4.3 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS2% · P76
ActionPatch immediately
AffectedTechnology Media

Remediation Steps

  1. Apply the vendor security update for Plex Media Server as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🤖 This vulnerability report was compiled by defend.network using AI-powered analysis of vulnerability databases, vendor advisories, and threat intelligence feeds. Always verify remediation steps through official vendor channels before implementing changes in production environments.

Get Vulnerability Priority Updates

Subscribe free and stay on top of critical patches.