CISA added 13 exploited CVEs from 27 September to 8 October 2026, including three 10-year-old bugs
CISA added 13 CVEs to its Known Exploited Vulnerabilities (KEV) catalog between 27 September and 8 October 2026 (catalog version 2026.10.08, 1,739 CVEs in total). None of the 13 is marked as known to be used in ransomware. Twelve have a federal due date three days after they were added; the Apple CVE has two weeks.
| CVE | Vendor / product | Added | Federal due | EPSS |
|---|---|---|---|---|
| CVE-2026-88771 | Citrix NetScaler | 27 Sep | 30 Sep | 1.1% |
| CVE-2026-88772 | Citrix NetScaler | 27 Sep | 30 Sep | 1.3% |
| CVE-2026-86950 | Apple (multiple products) | 29 Sep | 13 Oct | 1.2% |
| CVE-2026-76504 | Cisco Catalyst SD-WAN Manager | 30 Sep | 3 Oct | 1.8% |
| CVE-2026-104286 | Fortinet FortiMail | 1 Oct | 4 Oct | 2.2% |
| CVE-2026-102489 | Zammad | 2 Oct | 5 Oct | 1.3% |
| CVE-2026-102490 | Zammad | 2 Oct | 5 Oct | 0.6% |
| CVE-2026-88779 | Citrix NetScaler | 4 Oct | 7 Oct | 0.6% |
| CVE-2015-3306 | ProFTPD | 8 Oct | 11 Oct | 96.8% |
| CVE-2016-3081 | Apache Struts | 8 Oct | 11 Oct | 93.4% |
| CVE-2015-5477 | ISC BIND | 8 Oct | 11 Oct | 91.3% |
| CVE-2021-3199 | ONLYOFFICE Docs | 8 Oct | 11 Oct | 8.2% |
| CVE-2023-22894 | Strapi | 8 Oct | 11 Oct | 1.7% |
FIRST EPSS scores dated 8 Oct 2026: the estimated chance of exploitation activity in the next 30 days. Top 8 of the 13 additions; the highest NetScaler CVE is shown.
What stands out
- Old bugs, high scores. The three CVEs from 2015 and 2016 (ProFTPD access control, BIND, Apache Struts command injection) were added on 8 October and each has an EPSS score above 90%. Systems that still run those versions are usually old appliances or forgotten servers, which is where an inventory check pays off first.
- Citrix NetScaler three times. Three NetScaler CVEs were added within eight days.
- Two-week deadline for Apple. CVE-2026-86950 (out-of-bounds write, multiple Apple products) is due 13 October.
Federal due dates bind US federal civilian agencies; for everyone else they are a useful order of work. Per-vendor lists: Microsoft, Cisco, Apple, all vendors.
Sources: CISA KEV catalog version 2026.10.08 and FIRST EPSS scores of 8 Oct 2026. EPSS is a probability estimate, not a confirmation of exploitation.