The United States Cybersecurity and Infrastructure Security Agency (CISA) added 36 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue during October, according to the catalogue's data feed as of its 30 October release. The KEV catalogue lists flaws with evidence of active exploitation, and its deadlines bind United States federal civilian agencies under Binding Operational Directive 26-04, while the rest of the industry treats the list as a patch-now queue. With the final October additions, the catalogue stood at 1,766 entries.

Ivanti flaws closed a heavy month

The newest additions, on 30 October, were two Ivanti Connect Secure VPN flaws that attackers chained with an earlier Ivanti zero-day to compromise a limited number of customers. CISA gave federal agencies until 2 November to fix CVE-2026-111357 and until 13 November for CVE-2026-118527, with fixed Ivanti releases 25.1.1.3 and 22.8R2.6 shipped on 29 October. Ten vulnerabilities were added in the final week alone, from 26 to 30 October, affecting PHP, Google Brotli, Adobe Commerce, the Linux kernel, VMware ESX, Cisco Secure Firewall and GitLab, alongside the two Ivanti flaws.

The month's pattern carries a blunt lesson for defenders: several of October's exploited flaws were already patched before attackers were observed using them, so the risk sat with unpatched systems rather than with missing fixes. Organisations running Ivanti VPNs, PHP websites, GitLab servers or Cisco firewalls should check their versions against the October KEV entries first, and treat a clean result from any single integrity-checking tool with caution, since CISA has warned that such tools can miss compromises.