CISA KEV October 2026: What Linux Server Owners Should Check

What CISA added in October 2026 so far

The source for every number here is the official CISA KEV JSON feed, downloaded on October 21, 2026 (UTC). That file reports catalogVersion 2026.10.21 and 1,754 entries in total, and its newest dateAdded is 2026-10-20. Counting entries whose dateAdded starts with 2026-10 gives 24, added on nine separate days and covering 18 vendors. October is not over, so this is a partial month and the number will grow.

For comparison, the same file has 43 entries with dateAdded in September 2026. That is the largest month of 2026 so far; January was the smallest at 17. The September figure comes from today's file, so it covers the whole month and is higher than the seven early-September entries discussed in our September KEV article, which also explains what the catalog is and why small hosts should care. We do not repeat that here.

One definition matters for reading any KEV number: the catalog counts only vulnerabilities for which CISA has reliable evidence of active exploitation in the wild. Scanning, research and public proof-of-concept code do not qualify on their own. So 24 is a count of confirmed exploitation, not of all serious bugs disclosed in the period.

How the 24 split by who is likely to run the software (this grouping is our own judgment, the feed does not make it):

• 15 are in software commonly self-hosted on Linux servers: Plex Media Server (4), Zammad (2), AhsayCBS (2), Atlassian Data Center and related products (1), SiteGuard Server Edition (1), BIND, ProFTPD, Apache Struts, ONLYOFFICE Docs and Strapi (1 each).
• 7 are in network or security appliances: FortiMail, FortiOS and related Fortinet products, Citrix NetScaler, Ivanti Connect Secure, Palo Alto Networks PAN-OS, Cisco Secure Email Gateway and BeyondTrust Remote Support.
• 2 are Windows-specific: Microsoft Windows Shell (CVE-2026-96951) and Siemens Software Center (CVE-2026-110936). We do not cover them further.

What is not in the October list so far: a search of the added entries for the Linux kernel, sudo, OpenSSH, OpenSSL, nginx, Docker, runc, Kubernetes, PostgreSQL, MySQL, Redis, GitLab, Jenkins, WordPress, Roundcube, Zimbra, Exim, Postfix and Samba finds none of them. The only name match is Apache Struts, which is a Java framework, not the Apache HTTP Server. In contrast, September has three Linux Kernel entries in the same file (CVE-2025-39964, CVE-2026-53266 and CVE-2025-39682). An empty October for the kernel is not a reason to skip kernel updates; if you rely on kernel live patching or Livepatch, keep it running.

Finally, the catalog field knownRansomwareCampaignUse is "Unknown" for all 24 October entries, and also for all 43 September entries. Across the whole catalog 361 of 1,754 entries are "Known". "Unknown" means no recorded ransomware use, not a guarantee of safety.

Due dates in October, and a correction on the directive

Every entry has a dueDate. In this file 21 of the 24 October entries are due three calendar days after dateAdded and three are due after 14 days: Siemens Software Center and two of the four Plex entries (CVE-2026-96652 and CVE-2026-96655). On the download date, 18 of the 24 due dates had already passed. For a small host that matters as a yardstick: federal systems get days, not a maintenance quarter.

The directive behind those dates has changed. Each October requiredAction text cites CISA's BOD 26-04, "Prioritizing Security Updates Based on Risk". According to CISA's BOD 26-04 page, it was issued on June 10, 2026 and revokes and supersedes BOD 22-01, the 2021 directive that originally set the KEV due dates. In this feed the last entry citing BOD 22-01 was added on 2026-06-09 and the first citing BOD 26-04 on 2026-06-11. The binding obligation still falls on US Federal Civilian Executive Branch agencies, and the BOD 26-04 timelines depend on the asset, including whether it is exposed to the internet.

For everyone else, CISA's KEV page says state, local, tribal and territorial governments and private companies are not bound by BOD 26-04, but CISA strongly recommends they prioritize KEV vulnerabilities and treat an entry as a trigger for immediate response in their own vulnerability management plans. So the due date is not your legal deadline; it is the pace CISA considers appropriate for a confirmed-exploited flaw. Our server patch management guide shows how to build that fast lane next to routine updates, and the glossary entry on KEV defines the term.

Software you may self-host on a Linux server

These 15 entries are in software often run on Linux servers, VPSs and containers. Descriptions are paraphrased from the catalog's own wording and add nothing beyond it. Whether you are affected depends on your product, edition and version, so check your own install against the vendor notice. All dates are dateAdded and dueDate in the feed.

Added with 2026 CVE IDs (10 entries)

• CVE-2026-96652, Plex Media Server: a server-side request forgery in which a request carrying any X-Plex-Token value can make the server send a POST to a destination the sender chooses. Added 2026-10-20, due 2026-11-03.
• CVE-2026-96654, Plex Media Server: improper handling of encoded URI schemes in a web page that could let an attacker call other plugins' functions with their own parameters. Added 2026-10-20, due 2026-10-22.
• CVE-2026-96655, Plex Media Server: server-side request forgery for an authenticated user through the /video/:/transcode/universal path parameter, reaching internal or external addresses. Added 2026-10-20, due 2026-11-03.
• CVE-2026-96656, Plex Media Server: external control of a file name or path that lets an admin user write arbitrary files which may be executed on load. Added 2026-10-20, due 2026-10-22. The catalog says all four Plex entries can be chained.
• CVE-2026-102489, Zammad: session fixation that can lead to remote code execution as the zammad user. Added 2026-10-02, due 2026-10-05.
• CVE-2026-102490, Zammad: improper privilege management that lets the local zammad user escalate to root. Added 2026-10-02, due 2026-10-05. The catalog says these two Zammad entries can be chained.
• CVE-2026-21589, Atlassian Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo and Crowd (Data Center) plus Crucible and Fisheye: files or directories accessible to external parties, letting an unauthenticated attacker access specific files in the web application root in affected versions. Added 2026-10-15, due 2026-10-18.
• CVE-2026-105133, Ahsay AhsayCBS: authentication bypass through manipulation of a parameter in the checkSysPwd function of the API component. Added 2026-10-14, due 2026-10-17.
• CVE-2026-105134, Ahsay AhsayCBS: operating system command injection through a parameter of the Replication Receiver endpoint /rps/api/json/UpdateReceivers.do. Added 2026-10-14, due 2026-10-17. The catalog says it can be chained with CVE-2026-105133.
• CVE-2026-106931, EG Secure Solutions SiteGuard Server Edition: OS command injection that may allow arbitrary commands with root or SYSTEM privileges on the system running the product. Added 2026-10-20, due 2026-10-22.

Older CVEs added on October 8, all due 2026-10-11 (5 entries)

• CVE-2015-5477, ISC BIND: a data processing error that lets remote attackers cause a denial of service through TKEY queries.
• CVE-2015-3306, ProFTPD: improper access control that lets remote attackers read and write arbitrary files through the site cpfr and site cpto commands.
• CVE-2016-3081, Apache Struts: command injection that could allow remote code execution through method:prefix when Dynamic Method Invocation is enabled.
• CVE-2021-3199, ONLYOFFICE Docs: path traversal when JWT is used, via a /.. sequence in an image upload parameter, which could allow remote code execution.
• CVE-2023-22894, Strapi: cleartext storage of sensitive information that lets someone with admin panel access discover user details through the query filter. The catalog says the product may be end-of-life or end-of-service, advises moving to a supported version, and says it can be chained with CVE-2023-22621 for remote code execution.

The five older entries carry CVE numbers from 2015 to 2023. They are n-day style entries: the flaw was public long before the listing. The catalog does not say why these were added now beyond having evidence of exploitation. The practical question is whether any host of yours still runs a version from before the fix, or a product the vendor no longer supports.

Vendor notices we read for the newer entries, paraphrased: Plex's security notice says to update to Plex Media Server 1.43.3.10861 or later; Atlassian's advisory lists a fixed release per product and gives workarounds if you cannot patch at once; Zammad's community post says versions 6.5 and older no longer receive security fixes and points to 7.2.0 as the current stable release, while saying the scope of CVE-2026-102490 was not yet confirmed; Ahsay's announcement says its hotfix builds go through its partner portal and that earlier patch releases did not fully fix the two CVEs. Read the notice for your exact version before acting on any of this.

Edge appliances and what else is in the list

These seven entries are in appliances and gateways. Most VPS owners do not run them, but they matter if your servers sit behind one, if you administer one for an employer or a client, or if you reach your servers through a VPN gateway. Wording is paraphrased from the catalog.

• CVE-2026-104286, Fortinet FortiMail: path traversal and a NULL byte handling flaw that may let an unauthenticated attacker write arbitrary files through crafted HTTP or HTTPS requests. Added 2026-10-01, due 2026-10-04.
• CVE-2026-88779, Citrix NetScaler ADC and Gateway: a memory buffer bounds flaw that could allow a denial of service. Added 2026-10-04, due 2026-10-07.
• CVE-2026-104935, Ivanti Connect Secure: authentication bypass by spoofing that lets a remote unauthenticated attacker execute arbitrary commands. Added 2026-10-13, due 2026-10-16.
• CVE-2026-0322, Palo Alto Networks PAN-OS: code injection that could let an authenticated attacker with network access execute code as root on the firewall. Added 2026-10-14, due 2026-10-17.
• CVE-2026-76519, Cisco Secure Email Gateway: relative path traversal that could let an unauthenticated remote attacker write arbitrary files on the underlying operating system. Added 2026-10-14, due 2026-10-17.
• CVE-2025-61624, Fortinet FortiOS, FortiPAM, FortiProxy and FortiSwitchManager: path traversal that may let an authenticated attacker with an admin profile and read-write permissions write or delete arbitrary files through specific CLI commands. Added 2026-10-16, due 2026-10-19.
• CVE-2026-102764, BeyondTrust Remote Support: authentication bypass by spoofing that could let a remote attacker perform file operations on the appliance. Added 2026-10-16, due 2026-10-19.

If you do run any of these, the vendor links are in the notes field of each entry, and every entry's requiredAction tells you to apply the vendor's mitigations or stop using the product if none exist. We add no exploitation detail beyond the catalog text.

How to check what you run with read-only commands

None of these commands change anything. Start with exposure: which services listen on the network, and which program owns each one.

sudo ss -tlnp
docker ps --format 'table {{.Names}}\t{{.Image}}'

Then look at installed versions. On Debian or Ubuntu:

dpkg -l | grep -Ei 'plexmediaserver|zammad|proftpd|bind9|onlyoffice'
dpkg-query -W -f='${Package} ${Version}\n' proftpd-basic
apt-cache policy bind9
apt list --upgradable

On the RHEL family (Rocky, Alma, Fedora):

rpm -q bind proftpd
dnf check-update --security

Program-level version checks for the usual suspects:

uname -r
sudo --version | head -n 1
nginx -v
named -v
proftpd -v
docker version --format '{{.Server.Version}}'

Two cautions. First, distributions backport fixes, so an upstream version number can look old while the fix is present. Ask the package itself: apt changelog bind9 | grep CVE-2015-5477 on Debian or Ubuntu, or rpm -q --changelog bind | grep CVE-2015-5477 on the RHEL family. A match is useful evidence; an empty result is not proof either way, so confirm in your distribution's security tracker. Second, software installed from a tarball, a vendor repository you forgot about or a container image will not show up in the host's package list. Plex, Zammad and ONLYOFFICE often live in containers or vendor packages, so check the application's own version screen and the image tag too, and compare it with the vendor notice listed in the previous sections.

The same habit applies to sudo and every other privileged tool on the box. For a wider review of the host, our VPS security checklist covers the rest of the basics.

Reproduce these numbers and filter the feed with jq

Every figure in this post can be rebuilt from the feed with curl and jq. Download once, then run the queries against the local file:

curl -sSfL -o kev.json https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
jq '.catalogVersion, .count' kev.json
jq '[.vulnerabilities[] | select(.dateAdded | startswith("2026-10"))] | length' kev.json
jq -r '.vulnerabilities | group_by(.dateAdded[0:7])[] | "\(.[0].dateAdded[0:7]) \(length)"' kev.json | tail -n 3

List everything added since October 1 with its dates, or narrow it to the vendors you run (the dateAdded condition keeps old entries for the same vendors out of the result):

jq -r '.vulnerabilities[] | select(.dateAdded >= "2026-10-01") | [.cveID, .vendorProject, .product, .dateAdded, .dueDate] | @tsv' kev.json
jq -r --arg re 'plex|zammad|atlassian|ahsay' '.vulnerabilities[] | select(.dateAdded >= "2026-10-01" and ((.vendorProject + " " + .product) | test($re; "i"))) | [.cveID, .dateAdded, .dueDate] | @tsv' kev.json

Two more fields are worth a query. The first prints entries with known ransomware use (empty for October in our file); the second counts entries flagged for forensic triage, which is 17 of the 24:

jq -r '.vulnerabilities[] | select(.dateAdded >= "2026-10-01" and .knownRansomwareCampaignUse == "Known") | .cveID' kev.json
jq -r '.vulnerabilities[] | select(.dateAdded >= "2026-10-01" and .forensicTriage == "Yes") | .cveID' kev.json | wc -l

To get a daily "what is new" list without reading the whole catalog, keep a sorted list of IDs and compare it with the next day's:

jq -r '.vulnerabilities[].cveID' kev.json | sort > kev-today.txt
comm -13 kev-yesterday.txt kev-today.txt

Results change as CISA adds entries, so a later download will show more than 24 for October. The standard feed fields are cveID, vendorProject, product, vulnerabilityName, dateAdded, shortDescription, requiredAction, dueDate, knownRansomwareCampaignUse, notes, cwes and forensicTriage. There is no severity score in them, so we give none; look up the CVSS score in the vendor advisory or NVD if you need one for triage.

If you run one of these: what to do, in order

1. Confirm exposure. Is the service reachable from the internet, or only from a private network or VPN? An internet-facing admin interface changes the order of work. sudo ss -tlnp and your firewall rules answer this.
2. Update to the vendor's fixed release, or apply the vendor's mitigation. That is exactly what the catalog's requiredAction says. If neither is possible, take the service off the internet or put it behind a VPN or an allow-list; the catalog text says to stop using a product when mitigations are unavailable.
3. Check for compromise when the entry says so. The forensicTriage field is "Yes" for 17 of the 24 October entries, including both Zammad entries, the Atlassian entry, SiteGuard, the AhsayCBS command injection, Plex CVE-2026-96656, ONLYOFFICE, ProFTPD, Struts and Strapi. For those, patching closes the door but does not tell you whether someone already walked through. If you find unexplained processes, new accounts, unfamiliar files or odd outbound connections, follow our server breach incident response guide and prefer a rebuild from a clean image over cleaning a live system.
4. Shrink what a hit can do. Zammad's entries, for example, involve a local service user reaching root. Run services under their own unprivileged accounts and keep sudo rights narrow, as described in sudo least privilege on a VPS. If the product runs in a container, review published ports, the Docker socket and container privileges in Docker host security on a VPS.
5. Close the other common door. While you review exposure, make sure SSH is not the easy way in: see SSH brute force protection.

The catalog does not say whether an entry was first exploited before a patch existed (a zero-day) or after, so do not assume either. What it does confirm is that exploitation is happening now. Put KEV additions for software you actually run into the fast lane of your patch management process, and treat the rest as routine. Data and counts in this post come from the CISA feed linked above, downloaded October 21, 2026 (UTC); we will not revise them silently, and a rerun of the jq commands on a later download will include later additions.