Welcome to HowToShipIt — practical how-to guides for developers: code, AI tools, and servers, explained step by step.

CISA KEV October 2026 weekend patch triage

CISA KEV October 2026: The Weekend Patch Triage (What to Patch First)

by

Seven CISA KEV October 2026 CVEs hit their remediation deadlines this weekend — four of them land today, Saturday October 17, one lands tomorrow, and two land on Monday. If you run any of the affected appliances or services (a Cisco Secure Email Gateway, a PAN-OS firewall, a backup server, self-hosted Atlassian tools, a BeyondTrust jump box, or Fortinet gear), this is the order to patch them in, the exact fixed versions, and how to check whether you were already hit.

Last verified: October 17, 2026. Every deadline, affected product, and fixed version below was re-checked against the live CISA KEV catalog and the vendor advisories today.

CISA’s Known Exploited Vulnerabilities catalog isn’t a theoretical risk list — every entry on it is a vulnerability CISA has evidence is being exploited in the wild right now. The remediation dates aren’t suggestions either: federal agencies are required to patch by them under CISA’s BOD 26-04 guidance, and the “forensic triage required” flag on most of this weekend’s entries means you should also check whether attackers already got in before you patch over the evidence. The Oct 15 Patch Tuesday triage covered the Oct 16 deadline (CVE-2026-96951, Windows Shell) — if that one slipped past you, handle it first, then work through this list.

The deadlines at a glance

Due CVE Product What it is
Today (Oct 17) CVE-2026-76519 Cisco Secure Email Gateway Unauthenticated root file write (CVSS 9.8)
Today (Oct 17) CVE-2026-0322 Palo Alto PAN-OS Authenticated mgmt → root RCE (CVSS 8.6)
Today (Oct 17) CVE-2026-105133 / 105134 Ahsay AhsayCBS Chained auth bypass + command injection (CVSS 10.0)
Tomorrow (Oct 18) CVE-2026-21589 Atlassian Data Center (8 products) Unauthenticated file access (CVSS 9.3)
Monday (Oct 19) CVE-2026-102764 BeyondTrust Remote Support Auth bypass by spoofing (CVSS 9.3)
Monday (Oct 19) CVE-2025-61624 Fortinet (FortiOS et al.) CLI path traversal (CVSS 6.0)

Due today: Cisco Secure Email Gateway (CVE-2026-76519)

This is the scariest one on the list. Cisco Secure Email Gateway contains a relative path traversal vulnerability (CWE-23) that lets an unauthenticated, remote attacker write arbitrary files on the underlying operating system. Cisco rates it CVSS 3.1 9.8. The attack path runs through crafted email attachments when File Reputation is enabled and Content Scanner Tools is older than 25.3.0.5525.

Why it’s at the top of today’s list: Cisco became aware of active exploitation in October and has been contacting managed Secure Email Cloud customers showing compromise indicators. Roughly 300 gateways were counted exposed online, and Cisco warns that a root compromise may expose inter-cluster SSH keys — so if one cluster member is compromised, assume the whole cluster is.

Fixed versions: AsyncOS 15.5.5-014 or 16.5.0-780. Release 16.0 has no fixed build — migrate to 16.5.0-780. Alternatively, updating Content Scanner Tools to 25.3.0.5525+ fixes it with no upgrade and no restart. Secure Email Cloud Gateway already has the fixed component.

Check your system:

# confirm the appliance version
version
# check the scanner component version
contentscannerstatus
# update the scanner component without restarting
contentscannerupdate
# hunt for compromise indicators on every cluster member
grep "System Security" system_logs

Verify in the web UI that Advanced Malware Protection (File Reputation) is on the expected mail policies. And if grep "System Security" system_logs shows anything you don’t recognize, rebuild every cluster member — a single patched box with stolen inter-cluster keys is still a compromised cluster.

Due today: Palo Alto PAN-OS (CVE-2026-0322)

An authenticated attacker with network access to the management interface can execute arbitrary code with root privileges (CWE-94 code injection). Cisco’s issue needed no login; this one needs high-privilege management access, so it’s less exposed — but the management interface of a firewall should never be internet-facing anyway, and “limited exploitation observed” plus a published attack-IP list means someone is already using it.

Fixed versions (per the Palo Alto advisory): 12.2.4; 12.1.4-h12 / 12.1.7-h8 / 12.1.10-h2; 11.2.4-h22 / 11.2.7-h21 / 11.2.10-h15 / 11.2.13-h3 / 11.2.16 (released around Oct 15); 11.1.4-h37 / 11.1.6-h39 / 11.1.7-h11 / 11.1.10-h35 / 11.1.13-h15 / 11.1.16-h3; 10.2.7-h38 / 10.2.10-h41 / 10.2.13-h26 / 10.2.16-h11 / 10.2.18-h12. Cloud NGFW and Prisma Access are not affected.

Check your system:

# dashboard → Software, or from the CLI
show system info

Palo Alto published three attacker IPs tied to the observed exploitation: 66.42.72.14, 208.83.239.114, 149.248.47.234. Search your management-interface logs for them. The vendor’s own threat IDs 510046/510047 only give limited coverage, so log review matters more than signature detection here. No workaround exists — patching is the fix.

Due today: Ahsay AhsayCBS (CVE-2026-105133 + CVE-2026-105134)

This pair chains into unauthenticated remote OS command execution on your backup server. CVE-2026-105133 (CVSS 3.1 7.3) is an authentication bypass in the API’s password check via manipulation of the random parameter; CVE-2026-105134 (CVSS 3.1 10.0) is command injection through the same parameter in the Replication Receiver’s /rps/api/json/UpdateReceivers.do endpoint. A backup server is a perfect target — it’s full of credentials, it backs up everything, and MSPs run it for dozens of clients.

The urgency is real, not theoretical: security researchers at Huntress reported an active exploitation campaign since October 7 — attackers chain the two flaws for unauthenticated code execution with SYSTEM rights, drop JSP web shells, install XMRig cryptominers disguised as Microsoft Edge (with a fake “Microsoft Edge Update” service for persistence), and in at least one case dropped the vulnerable WinRing0x64.sys driver. At least five organizations had been targeted as of early October.

Fixed versions — read carefully, because the early patches didn’t work: Ahsay itself admits that releases v9.15.2.59 and v10.3.4.0 did not fully close the flaws. You need hotfix v10.3.4.45 (for v10) or hotfix v9.15.2.70 (for v7/v8/v9), downloaded from the Ahsay partner portal, followed by a reboot. If you applied the August releases and stopped, you are still vulnerable.

Check your system: the version/build shows in the AhsayCBS management console or the System Monitor login page. Then, per the KEV forensic-triage flag on CVE-2026-105134, hunt before you patch: look for JSP files in the CBS web directory that you didn’t deploy, unknown replication receivers, services named like “Microsoft Edge Update” running msedge.exe from an unusual path, and the WinRing0x64.sys driver. If you find any of these, treat the backup server as compromised — rebuild it and rotate every stored credential and storage key.

Due tomorrow: Atlassian Data Center (CVE-2026-21589)

Eight self-hosted Atlassian products — Bitbucket DC, Confluence DC, Jira Software DC, Jira Service Management DC, Bamboo DC, Crowd DC, Crucible, and Fisheye — carry an unauthenticated arbitrary file-access vulnerability (CWE-552), CVSS 4.0 9.3. An attacker who knows the exact file name and path can read files inside the application’s web root with no login. The worst demonstrated chain: reading Crowd’s crowd.properties exposes application credentials, which can then be used to create a Jira administrator account. Researchers at watchTowr observed in-the-wild exploitation starting around October 7, days after the advisory.

Fixed versions (per Atlassian’s October 5 advisory):

  • Bitbucket Data Center: 9.4.26, 10.2.8, 10.5.1
  • Confluence Data Center: 9.2.26, 10.2.19
  • Jira Software Data Center: 9.12.40, 10.3.26, 11.3.12
  • Jira Service Management Data Center: 5.12.40, 10.3.26, 11.3.12
  • Bamboo Data Center: 10.2.24, 12.1.12
  • Crowd Data Center: 6.3.7, 7.0.3, 7.1.7, 7.2.4
  • Crucible: 4.9.15 · Fisheye: 4.9.15

Check your system: Confluence → Administration → System Information; Jira → Settings → System → System info; Bitbucket → Administration → System information. Atlassian Cloud is already patched, so only self-hosted instances need action. Until you can patch, apply Atlassian’s WAF rule or Tomcat RewriteValve mitigation and restrict internet access — but treat those as stopgaps, not fixes. And if you run Crowd, rotate its application credentials: assume any attacker who probed you read them.

Due Monday: BeyondTrust Remote Support (CVE-2026-102764)

An authentication bypass by spoofing (CWE-290) in BeyondTrust Remote Support lets a remote attacker perform file operations on the appliance — CVSS 4.0 9.3, advisory BT26-05. The genuinely alarming part: this was exploited as a zero-day since August 29, 2026 by the China-state espionage cluster tracked as Armory Castle / UNC5221, which harvested credentials and moved laterally during a multi-week dwell. Google Threat Intelligence warned of imminent wider exploitation after disclosure.

Fixed: this one ships as a patch, not a version bump — apply the BT26-05-RS patch to Remote Support versions 24.3.1 through 26.2.3 (all versions ≤ 26.2.3 are affected). If you’re on anything older than 24.3.1, you must upgrade first, then patch. BeyondTrust SaaS customers were patched by BeyondTrust itself on October 9, but credential rotation and a config review are still recommended. (Note: version numbers alone don’t confirm patch state here, since the fix is a patch — check the appliance’s patch history, not just the version line.)

Check your system: sign in to the appliance interface — version and patch state show in the appliance console (/appliance). Because the zero-day window stretches back to late August, review appliance audit logs for authentication anomalies and jump-item role changes before you patch.

Due Monday: Fortinet (CVE-2025-61624)

Path traversal (CWE-22) in FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager: an authenticated attacker with an admin profile and read-write permissions can write or delete arbitrary files via crafted CLI commands. CVSS 3.1 is only 6.0 Medium — the lowest score on this list — but it’s on KEV because it’s genuinely exploited: Palo Alto’s Unit 42 tied it to the threat cluster CL-STA-0954 (aka UNC5820), which used it to deploy PEERSTITCH, a memory-resident implant on managed FortiGates after an earlier FortiManager compromise. Score the blast radius, not just the CVSS.

Fixed versions: FortiOS 7.6.5+ or 7.4.10+ (7.2/7.0/6.4 have no patch — migrate); FortiPAM 1.7.1+ (1.8 unaffected; 1.0–1.6 migrate); FortiProxy 7.4.12+ (7.2/7.0 migrate); FortiSwitchManager 7.2.8 or 7.0.7+. Note some of these products are in “migrate, no patch” territory on older branches — check your branch, not just your build.

Check your system:

get system status

Then confirm your branch has a fixed release available and review for rogue admin accounts or auto-scripts, the persistence artifacts Unit 42 documented.

The 30-minute weekend triage routine

Do these in order. The list is sorted by deadline and exploitability, not alphabetically.

  1. Inventory (10 min): list every internet-facing instance of the six products above. If you can’t enumerate them, you can’t triage them — a Shodan-style exposure check for your own org’s IPs counts.
  2. Patch the unauthenticated-first trio (15 min): Cisco SEG (due today, CVSS 9.8, actively exploited), AhsayCBS (due today, CVSS 10.0, active campaign), then Atlassian (due tomorrow, CVSS 9.3, in-the-wild since Oct 7). Unauthenticated access beats everything else on the triage list.
  3. Patch the rest today, not Monday: PAN-OS and BeyondTrust need management/console access, but Monday’s deadline is a federal compliance line — your deadline should be before the attackers’ scanning peaks over the weekend.
  4. Hunt before you reboot: the KEV forensic-triage flag is set on Cisco, PAN-OS, AhsayCBS (105134), Atlassian, BeyondTrust, and Fortinet. Check the IoCs listed above (logs, rogue shells, odd services, the three PAN-OS IPs) before the patch, because a reboot and upgrade can destroy the evidence you need to know whether this was a patch or an incident.

Make next month’s triage boring

Weekend fire drills are a process failure, not a badge of honor. Three things that actually help:

  • Subscribe to the KEV machine-readable feed. CISA publishes the catalog as a CSV and JSON — ingest it into whatever watches your infrastructure and alert on new entries touching your asset inventory. The entries that land on a Friday are the ones that ruin your weekend.
  • Keep a living asset-and-branch list. Half of this weekend’s work was knowing which FortiOS branch, which PAN-OS hotfix, which AsyncOS train you’re on. A spreadsheet with product, version, branch, and internet exposure is the cheapest security tooling you’ll ever build.
  • Patch the management-plane stuff on a cadence. PAN-OS, BeyondTrust, Fortinet — these are the boxes everything else depends on. A standing monthly window for infrastructure appliances keeps you out of emergency mode.

Further Reading & References

Related Posts:

Leave a Comment