← Back to Vulnerability Reports

Vulnerability Priority Report – Week 1 of November 2026

📅 November 2 – 8•🟢 Live · updated 2026-11-02•34 CVEs tracked this week

Analyst Guidance

This week's priority is Ivanti Connect Secure vulnerabilities added to CISA's KEV catalog with evidence of active exploitation. Single-source disclosures (Hitachi Energy, Siemens Mendix, EPICS Base) warrant review but require additional verification before prioritization.

CVE Details & Remediation

How to read this report
Verified facts — NVD & CISA KEV Partially verified — awaiting NVD enrichment AI analysis — synthesis, verify before acting
Actionable · Verified facts
NVD-published · CISA KEV cross-checked

🛡️CVE-2026-97229 – GitLab Community Edition And Enterprise Edition ✓ NVD

CVSS10 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS27% · P98
ActionPatch immediately
AffectedTechnology Retail Finance

Remediation Steps

  1. Apply the vendor security update for GitLab Community Edition And Enterprise Edition as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-105134 – Ahsay AhsayCBS ✓ NVD

CVSS10 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS82% · P100
ActionPatch immediately
AffectedGovernment Technology

Remediation Steps

  1. Apply the vendor security update for Ahsay AhsayCBS as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2015-3306 – Proftpd (also: Fedoraproject, Debian) ✓ NVD

CVSS10 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS99% · P100
ActionPatch immediately
AffectedGovernment Energy

Remediation Steps

  1. Apply ProFTPD security patch immediately
  2. Review access logs for unauthorized administrative access attempts
  3. Restrict network access to FTP services to trusted networks only
  4. Monitor for Flax Typhoon indicators of compromise

References:

🛡️CVE-2026-114625 – Arista VeloCloud Orchestrator ✓ NVD

CVSS9.9 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS1% · P64
ActionPatch immediately
AffectedTechnology Government Defense

Remediation Steps

  1. Apply the vendor security update for Arista VeloCloud Orchestrator as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-109618 – PHP Group PHP ✓ NVD

CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS100% · P100
ActionPatch immediately
AffectedTechnology Retail Finance

Remediation Steps

  1. Apply the vendor security update for PHP Group PHP as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-102764 – BeyondTrust Remote Support ✓ NVD

CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS19% · P97
ActionPatch immediately
AffectedTechnology Government

Remediation Steps

  1. Apply the vendor security update for Beyondtrust Remote Support as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-76519 – Cisco Secure Email Gateway ✓ NVD

CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS2% · P82
ActionPatch immediately
AffectedTechnology Government Finance

Remediation Steps

  1. Apply the vendor security update for Cisco Secure Email Gateway as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2021-3199 – ONLYOFFICE Docs ✓ NVD

CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS30% · P98
ActionPatch immediately

Remediation Steps

  1. Apply the vendor security update for ONLYOFFICE Docs as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-48356 – Adobe Commerce And Magento ✓ NVD

CVSS9.3 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS45% · P99
ActionPatch immediately

Remediation Steps

  1. Verify affected systems are running vulnerable versions
  2. Apply vendor security patches immediately
  3. Monitor systems for signs of exploitation
  4. Review access logs for suspicious activity

References:

🛡️CVE-2026-111497 – Google Brotli ✓ NVD

CVSS9.2 NVD 4.0
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS83% · P100
ActionPatch immediately
AffectedRetail Technology Education

Remediation Steps

  1. Apply the vendor security update for Google Brotli as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-110447 – Collabora Online – Built-In CODE Server ✓ NVD

CVSS9.2 NVD 4.0
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS73% · P99
ActionPatch immediately

Remediation Steps

  1. Apply the vendor patch for Collabora Online Built-in CODE Server immediately
  2. Verify patch application and restart affected services
  3. Monitor logs for signs of exploitation attempts
  4. Restrict access to Collabora Online instances to trusted networks if patching is delayed

References:

🛡️CVE-2026-96951 – Microsoft Windows ✓ NVD

CVSS8.8 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS10% · P96
ActionPatch immediately
AffectedTechnology Government

Remediation Steps

  1. Apply the vendor security update for Microsoft Windows as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-104935 – Ivanti Connect Secure ✓ NVD

CVSS8.6 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS87% · P100
ActionPatch immediately
AffectedTechnology

Remediation Steps

  1. Apply the vendor security update for Ivanti Connect Secure as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-76418 – Cisco Secure Firewall ASA Software And Cisco Secure FTD Software ✓ NVD

CVSS8.6 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS1% · P57
ActionPatch immediately

Remediation Steps

  1. Apply the vendor security update for Cisco Secure Firewall ASA Software And Cisco Secure FTD Software as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-109619 – PHP Group PHP ✓ NVD

CVSS8.1 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS100% · P100
ActionPatch immediately
AffectedTechnology Retail Finance

Remediation Steps

  1. Apply the vendor security update for PHP Group PHP as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2016-3081 – Apache Struts ✓ NVD

CVSS8.1 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS97% · P100
ActionPatch immediately
AffectedTechnology Finance

Remediation Steps

  1. Apply the vendor security update for Apache Struts as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-46300 – Linux Kernel ✓ NVD

CVSS7.8 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS16% · P97
ActionPatch immediately
AffectedGovernment Technology

Remediation Steps

  1. Apply the vendor security update for Linux Kernel as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-106931 – EG Secure Solutions SiteGuard Server Edition ✓ NVD

CVSS7.8 NVD 3.0
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS3% · P85
ActionPatch immediately
AffectedTechnology Government

Remediation Steps

  1. Apply the vendor security update for SiteGuard WAF Server Edition as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-21589 – Atlassian Multiple Products ✓ NVD

CVSS7.5 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS99% · P100
ActionPatch immediately

Remediation Steps

  1. Locate CISA Known Exploited Vulnerabilities Catalog entry for CVE-2026-21589
  2. Identify affected products in your environment
  3. Apply vendor-supplied patches or workarounds as directed
  4. Monitor for exploitation attempts

References:

🛡️CVE-2015-5477 – ISC BIND ✓ NVD

CVSS7.5 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS100% · P100
ActionPatch immediately
AffectedTechnology Finance

Remediation Steps

  1. Apply the vendor security update for ISC BIND as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-88779 – Citrix NetScaler ✓ NVD

CVSS7.5 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS11% · P96
ActionPatch immediately
AffectedHealthcare Education

Remediation Steps

  1. Apply the vendor security update for Citrix Netscaler Application Delivery Controller as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-105133 – Ahsay AhsayCBS ✓ NVD

CVSS7.3 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS79% · P100
ActionPatch immediately

Remediation Steps

  1. Apply the vendor security update for Ahsay AhsayCBS as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-96656 – Plex Media Server ✓ NVD

CVSS7.2 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS2% · P78
ActionPatch immediately
AffectedTechnology Media

Remediation Steps

  1. Apply the vendor security update for Plex Media Server as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-0322 – Palo Alto Networks PAN-OS ✓ NVD

CVSS7.2 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS2% · P78
ActionPatch immediately
AffectedGovernment Technology

Remediation Steps

  1. Apply the vendor security update for Palo Alto Networks PAN-OS as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-111357 – Ivanti Connect Secure ✓ NVD

CVSS7 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV
EPSS1% · P45
ActionPatch immediately

Remediation Steps

  1. Apply vendor security patch from Ivanti immediately
  2. Verify Ivanti Connect Secure is not exposed to untrusted networks; restrict access to VPN gateway endpoints
  3. Monitor authentication logs for suspicious access patterns
  4. Assume compromise if CVE-2026-111357 exploitation indicators are present; review account creation and privilege escalation events

References:

🛡️CVE-2026-110936 – Siemens Software Center ✓ NVD

CVSS6.7 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS1% · P62
ActionPatch immediately

Remediation Steps

  1. Apply the vendor security update for Siemens Software Center as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-96654 – Plex Media Server ✓ NVD

CVSS6.5 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS2% · P80
ActionPatch immediately
AffectedTechnology Media

Remediation Steps

  1. Apply the vendor security update for Plex Media Server as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2025-61624 – Fortinet Multiple Products ✓ NVD

CVSS6.5 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS1% · P71
ActionPatch immediately

Remediation Steps

  1. Consult CISA Known Exploited Vulnerabilities catalog entry for affected product details and remediation guidance
  2. Prioritize patching based on CISA's recommended timeline
  3. Monitor systems for active exploitation activity
  4. Implement network segmentation to limit exposure if patching cannot be deployed immediately

References:

🛡️CVE-2023-22894 – Strapi ✓ NVD

CVSS4.9 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS4% · P91
ActionPatch immediately

Remediation Steps

  1. Apply the vendor security update for Strapi Strapi as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-96652 – Plex Media Server ✓ NVD

CVSS4.3 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS2% · P79
ActionPatch immediately
AffectedTechnology Media

Remediation Steps

  1. Apply the vendor security update for Plex Media Server as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-96655 – Plex Media Server ✓ NVD

CVSS4.3 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS2% · P76
ActionPatch immediately
AffectedTechnology Media

Remediation Steps

  1. Apply the vendor security update for Plex Media Server as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-41709 – Broadcom VMware ESX ✓ NVD

CVSS2.7 NVD 3.1
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
EPSS1% · P53
ActionPatch immediately

Remediation Steps

  1. Verify affected systems are running vulnerable versions
  2. Apply vendor security patches immediately
  3. Monitor systems for signs of exploitation
  4. Review access logs for suspicious activity

References:

Actionable · Partially verified
CVE in source articles · NVD enrichment pending

⏳CVE-2026-118527 – Ivanti Connect Secure pending NVD

CVSSawaiting NVD
Triage statusActive Exploit
Exploitation In the wild In CISA KEV ↻ Ongoing
ActionPatch immediately
AffectedTechnology Finance

Remediation Steps

  1. Apply the vendor security update for Ivanti Connect Secure as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References:

⏳CVE-2026-58882 – Android pending NVD

CVSSawaiting NVD
Triage statusPoC Available
Exploitation PoC published
ActionPatch within 48 hours

Remediation Steps

  1. Apply latest Android security patch if available from device manufacturer
  2. Check for OEM-specific SMS handler security updates
  3. Advise users that specially crafted text messages may crash the device or disrupt cellular service
  4. Monitor for denial-of-service attack reports from users receiving malformed SMS

References:

These CVEs are real (IDs appear in source articles) but NVD has not yet finished enrichment. Canonical vendor/product/CVSS data will appear here automatically once NVD catches up — we re-check daily.
🤖 This vulnerability report was compiled by defend.network using AI-powered analysis of vulnerability databases, vendor advisories, and threat intelligence feeds. Always verify remediation steps through official vendor channels before implementing changes in production environments.

Get Vulnerability Priority Updates

Subscribe free and stay on top of critical patches.