CISA adds two actively exploited flaws to KEV catalog

CISA added two exploited vulnerabilities to its Known Exploited Vulnerabilities catalog on 23 October 2026 and set remediation due dates of 26 October. The first, CVE-2026-110447, is an OS command injection flaw in Collabora Online's built-in CODE server when used within NextCloud. CISA says it allows remote code execution when the CODE server is not running. The second, CVE-2026-114625, is a SQL injection flaw in Arista VeloCloud Orchestrator on-prem that may let a remote attacker reach restricted internal functions and affect the VCO host. CISA says a successful exploit could undermine confidentiality, integrity, and availability of the orchestrator and the data it manages. CISA marks both entries as requiring forensic triage under BOD 26-04, but says it does not know whether either is used in ransomware campaigns.

The same catalog page lists 18 other exploited vulnerabilities. On 20 October CISA added Siemens Software Center CVE-2026-110936, four Plex Media Server flaws CVE-2026-96652, CVE-2026-96654, as well as CVE-2026-96655 and CVE-2026-96656, and a SiteGuard Server Edition flaw from EG Secure Solutions, CVE-2026-106931. CISA says the Plex flaws can be chained together. On 16 October it added Fortinet multiple products CVE-2025-61624 and BeyondTrust Remote Support CVE-2026-102764. On 15 October it added Atlassian multiple products CVE-2026-21589. On 14 October it added a PAN-OS code injection flaw from Palo Alto Networks, CVE-2026-0322, Ahsay AhsayCBS CVE-2026-105133 and CVE-2026-105134, and Cisco Secure Email Gateway CVE-2026-76519. On 13 October it added Microsoft Windows CVE-2026-96951 and Ivanti Connect Secure CVE-2026-104935. On 8 October it added ProFTPD CVE-2015-3306, ONLYOFFICE Docs CVE-2021-3199, and Strapi CVE-2023-22894. CISA lists due dates from 11 October to 3 November 2026, depending on the date added.

CISA's catalog says it is the definitive list of vulnerabilities known to be actively exploited, and the agency advises organizations to apply it within their prioritization process. For each entry, CISA's action says to apply mitigations in accordance with vendor instructions, follow BOD 26-04 patching guidance and forensics triage requirements, and discontinue use if mitigations are unavailable. Administrators should apply vendor mitigations or discontinue use by the due date CISA lists.