October 2026 Exploited Vulnerabilities: CISA KEV Patch Roundup

Last updated: 26 October 2026. Sources are listed at the end.

Beyond the headline incidents, several exploited vulnerabilities in October 2026 hit products that Indian SMBs and enterprises run quietly. They include firewalls, an email gateway, a remote access appliance, a web application firewall, a software installer and Apple devices.

This roundup covers six of them. Five are in the US CISA Known Exploited Vulnerabilities (KEV) catalogue. The sixth, a SonicWall SMA1000 flaw, has public reports of exploitation attempts but no KEV listing that we could confirm. For each one, we cover the flaw, the fixed versions and the action to take.

We cover the Ivanti, FortiMail, Citrix, BeyondTrust and Atlassian flaws in separate guides, linked near the end.

The short answer

• Check the table below against your asset list. If you run any of them, plan the update for this week.
• Patch PAN-OS and Cisco Secure Email Gateway first, because both have confirmed attacks and give root access.
• On SiteGuard and Cisco appliances, save diagnostic data or logs before you patch. Both vendors warn that patching or upgrading can destroy evidence.
• Move Siemens Software Center to 4.0.9.8 or later. Also put iPhones and Macs on the September fixes.
• Keep firewall and VPN management interfaces off the internet. That one step reduces risk for several of these flaws.

Summary table: exploited vulnerabilities October 2026

Help Net Security reported the 14 October KEV dates from CISA’s alert. The 20 October dates come from KEV trackers (Senserva and Rescana), since we could not load the CISA feed.

Palo Alto PAN-OS: CVE-2026-0322

What it is. A code injection flaw in the PAN-OS management interface. An attacker who already has valid admin credentials and network access to that interface can run code as root. Palo Alto rates it 8.6 (CVSS 4.0) but marks the urgency as highest. The advisory says it has seen “very limited” exploitation against management interfaces.

Affected and fixed. The flaw hits PA-Series and VM-Series firewalls and Panorama, in any configuration. Cloud NGFW and Prisma Access are safe.

Confirm the hotfix for your train in the advisory. Unsupported releases need an upgrade to a supported fixed version.

Action. Check your version with the standard PAN-OS CLI command below (not tested by us):

show system info | match sw-version

There is no complete workaround, so upgrade. Until then, restrict management access to a few internal IPs or a jump host. Palo Alto also published three IP addresses linked to the activity: 66.42.72[.]14, 208.83.239[.]114 and 149.248.47[.]234. Search your logs for them (script below). Also, because the attacker needs credentials, rotate admin passwords and review admin accounts.

Cisco Secure Email Gateway: CVE-2026-76519

What it is. A path traversal bug in how the gateway handles attachments when File Reputation (part of Cisco AMP) is on. An unauthenticated attacker only needs to send an email with a crafted attachment. As a result, they can write files and run commands as root. Cisco scores it 9.8 and confirmed active exploitation in October.

Affected and fixed. Physical and virtual gateways are vulnerable only when two conditions hold. File Reputation must be enabled on a mail policy, and Content Scanner Tools must be older than 25.3.0.5525. Secure Email and Web Manager and Secure Web Appliance are not affected. Cisco has already fixed its cloud gateway.

The fix comes in two forms. The quicker one is Content Scanner Tools 25.3.0.5525 or later, which works on all supported AsyncOS releases without a restart. Alternatively, AsyncOS 15.5.5-014 or 16.5.0-780 includes it.

Action. On the appliance CLI (from Cisco’s advisory, not tested by us):

contentscannerstatus
contentscannerupdate
grep "System Security" system_logs

Then run the grep on every cluster member. If it reports a suspected compromise indicator, contact Cisco TAC. If a virtual appliance is compromised, Cisco says to save forensic data and rebuild it fresh. In addition, rotate credentials and keys. A root attacker can wipe local logs, so also check your perimeter firewall for unexpected outbound uploads.

SonicWall SMA1000: CVE-2026-102255

What it is. A pre-authentication server-side request forgery (SSRF) in the WorkPlace login portal of SMA1000 appliances. SonicWall rates it 10.0. In short, an attacker can make the appliance send requests to internal functions without logging in.

Timeline. SonicWall published advisory SNWLID-2026-0017 on 6 October. By 8–9 October, Defused and Previdian reported SSRF traffic against their SMA honeypots. However, SonicWall’s advisory did not confirm exploitation, and nobody has reported a confirmed breach.

Affected and fixed. Models 6210, 7210 and 8200v on 12.4.3-03526 or older, and 12.5.0-02952 or older. Fixed builds are 12.4.3-03670 and 12.5.0-03082 or later, via MySonicWall. Because the hotfix restarts the appliance, plan for brief downtime. There is no workaround. The SMA 100 series and firewall SSL-VPN are not affected.

Action. Apply the hotfix in a maintenance window this week. Among the exploited vulnerabilities in this October 2026 roundup, it alone needs no login. Then review WorkPlace access logs from 6 October onwards for unusual requests.

SiteGuard Server Edition: CVE-2026-106931

What it is. An OS command injection flaw in the statistics feature of SiteGuard Server Edition, a host-based WAF from Japan’s EG Secure Solutions. The feature is on by default. As a result, attackers can run commands as root on Linux and FreeBSD, or SYSTEM on Windows. JVN and JPCERT/CC both say exploitation is confirmed. The CVSS vector is local, so attackers probably need some prior foothold. The initial access route is not public.

Note that the advisories name only Server Edition, not the SiteGuard WordPress plugin.

Affected and fixed. Version 2.20 and later is affected when statistics is enabled. Version 8.00 Update 5 fixes the Apache, Nginx and IIS editions, and 7.00 Update 6 fixes the FreeBSD editions. IIS 3.10 to 4.00 Update 4 is not affected. For systems that cannot upgrade, the vendor offers a patch for the statistics files, even for end-of-life versions.

Action. First, download the diagnostic information from the web management screen and store it off the server. The vendor warns that updating can erase attack traces. Then upgrade or apply the patch. If you cannot do either today, JPCERT/CC suggests disabling the statistics feature as a stopgap. Finally, because exploitation is confirmed, investigate the host for signs of compromise.

Siemens Software Center: CVE-2026-110936

What it is. Siemens Software Center downloads and manages Siemens software on Windows PCs. It loads DLLs from an uncontrolled search path. So anyone who drops a crafted DLL next to the signed executable can run code inside it. Siemens rates it 6.7 (CVSS 3.1) and 8.4 (CVSS 4.0).

How it was abused. On 19 October, Siemens confirmed active exploitation. Attackers did not breach Siemens. Instead, a ClickFix campaign linked to the Romulus delivery platform abused the genuine, signed SiemensSoftwareCenter.exe. It shipped the program with a malicious archive.dll inside an MSI called AllMyBasic.msi. In practice, the lure got victims to paste a PowerShell command, which pulled the MSI and then malware such as LegionLoader.

Affected and fixed. All versions before 4.0.9.8 (advisory SSA-580366). Also, existing installs update themselves at next launch.

Action. First, open Software Center once on each PC so it updates, then confirm the version. Next, hunt for SiemensSoftwareCenter.exe running from AppData\Local\Programs with msiexec.exe as its parent, especially on PCs that never had Siemens software. Siemens published these IOCs: 96.62.218[.]59 and wizardexpensive[.]com (payload hosting and C2), and 2.27.248[.]127 (MSI distribution). If you find a hit, isolate the PC, remove startup entries and reset the user’s passwords.

Apple CoreGraphics: CVE-2026-86950

What it is. An out-of-bounds write in CoreGraphics, the framework that draws images and parses PDFs. Opening a malicious file can run code. Apple says it may have been used in “an extremely sophisticated attack” against specific people on iOS versions before iOS 27. CISA added it to KEV on 29 September.

Affected and fixed. Apple released fixes on 28 September. They are iOS and iPadOS 26.7.1 (iPhone 11 and later), macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1.

Action. First, use your MDM to report device OS versions and push the update. On a Mac, sw_vers -productVersion shows the version. On iPhone, check Settings, General, About. This is the oldest of the exploited vulnerabilities in our October 2026 list, so any device still unpatched is overdue.

Check your logs for the published IOCs

The script below searches exported firewall, proxy or DNS logs for the IOCs that Palo Alto and Siemens published. It only reads files. We tested it with bash -n, ShellCheck and sample log lines. It also correctly ignored a near-match.

#!/usr/bin/env bash
# Read-only: search exported firewall/proxy/DNS logs for IOCs published
# by Palo Alto Networks (CVE-2026-0322) and Siemens (CVE-2026-110936).
LOGDIR="${1:-./logs}"
grep -rEnw --binary-files=without-match \
  '66\.42\.72\.14|208\.83\.239\.114|149\.248\.47\.234|96\.62\.218\.59|2\.27\.248\.127|wizardexpensive\.com' \
  "$LOGDIR" || echo "No matches in $LOGDIR"

Save it as ioc.sh and run bash ioc.sh /path/to/exported-logs. A clean result is not proof of safety, and a hit is a reason to investigate, not proof of breach.

India angle

Palo Alto, Cisco and SonicWall appliances are common in Indian enterprises, banks and IT services firms. So if one of these exploited vulnerabilities from October 2026 led to a compromise, remember the CERT-In Directions of April 2022. Covered entities must report specified incidents to CERT-In within six hours of noticing them. The DPDP Rules add a separate breach notice to the Data Protection Board within 72 hours. However, that rule (Rule 7) applies only from May 2027, so it is not yet in force.

Our other October 2026 guides

Several more exploited vulnerabilities in October 2026 have their own posts on our site:

• Ivanti Connect Secure CVE-2026-104935
• FortiMail CVE-2026-104286 file write
• Citrix NetScaler CVE-2026-88771
• BeyondTrust Remote Support CVE-2026-102764
• Atlassian Confluence and Jira CVE-2026-21589
• Arista VeloCloud Orchestrator CVE-2026-114625
• The k0t campaign leaking firewall and VPN credentials
• Plex Media Server flaws under attack

Quick checklist

• ☐ Match every product in the summary table against your asset inventory
• ☐ Upgrade PAN-OS to the fixed hotfix for your train and lock down the management interface
• ☐ Run contentscannerstatus on Cisco gateways and update to 25.3.0.5525 or later
• ☐ Run the “System Security” log check on every Cisco cluster member
• ☐ Apply the SMA1000 hotfix (12.4.3-03670 or 12.5.0-03082)
• ☐ Save SiteGuard diagnostic data, then upgrade or patch
• ☐ Confirm Siemens Software Center is on 4.0.9.8 or later and hunt for the side-loading pattern
• ☐ Push iOS, iPadOS and macOS updates through MDM
• ☐ Search exported logs for the published IOCs
• ☐ Know your CERT-In six-hour reporting path before you need it

Not sure which of these products sit on your network? An external scan is a quick first step. Our VAPT services include perimeter appliance checks. Meanwhile, the free website safety check gives a fast first look at your public footprint.

Sources

• Palo Alto Networks advisory: CVE-2026-0322
• Cisco advisory: Secure Email Gateway arbitrary file write (CVE-2026-76519)
• Help Net Security: CISA flags exploited flaws in Palo Alto, Cisco and Ahsay products
• The Hacker News: SonicWall patches CVSS 10.0 pre-auth SMA1000 flaw
• JVN#88474777: SiteGuard Server Edition OS command injection
• Siemens ProductCERT SSA-580366
• The Hacker News: ClickFix attackers exploit Siemens Software Center
• Apple security content of iOS 26.7.1 and iPadOS 26.7.1

Need help with network security? We test routers, firewalls, ACLs and segmentation as part of our VAPT services and hardening audits. Contact us for a quote.