This Weekly CVE Report Finds CISA KEV Trailing Daily Cybersecurity by Up to 8 Days

Between October 12 and 18, 2026, CVE Watchtower logged 5,499 new vulnerabilities. This weekly CVE report tracks 12 exploited flaws. Six came from Daily Cybersecurity’s intelligence sources, and three of those are not yet on CISA’s Known Exploited Vulnerabilities (KEV) catalog.

The week in numbers

Volume rose sharply from last week’s 3,255. The tracker counted 395 critical flaws with CVSS 9.0 or above. Another 2,427 rated high, and 1,911 rated medium. Only 118 rated low, while 648 had no score yet.

Daily Cybersecurity flagged six new CVEs as exploited. As of CISA KEVCISA KEV catalog version 2026.10.16, three of them appear in KEV. The other three remain exclusive to Daily Cybersecurity. CISA also listed six flaws that our sources did not flag this week.

The intelligence lead: Daily Cybersecurity vs CISA KEV

The table below checks each exploited flaw in this weekly CVE report against the live CISA KEV catalog.

On shared flaws, the two feeds ran close this week. Daily Cybersecurity led by one day on Fortinet and matched CISA on BeyondTrust and Ivanti. Meanwhile, three flaws surfaced only through Daily Cybersecurity. JPCERT/CC, Wordfence and the EC-CUBE developer confirm attacks on all three.

Caveat: the DC date and CISA’s dateAdded measure different events, so treat this as a feed-to-feed comparison. “Not listed” flaws may join KEV in a later catalog update.

Exploited vulnerabilities from CISA KEV only

Two of these are a follow-up from last week. Daily Cybersecurity flagged the Atlassian flaw on October 7 and the AhsayCBS authentication flaw on October 9. CISA added them on October 15 and October 14. That puts the lead at eight days and five days.

The flaws that stand out

BeyondTrust Remote Support (CVE-2026-102764)

This zero-day lets an unauthenticated attacker upload files to the appliance. According to Google Threat Intelligence, the China-linked group ARMORY CASTLE exploited it from late August 2026. The attackers stole stored credentials, deleted logs and planted persistent backdoors.

Cisco Secure Email Gateway (CVE-2026-76519)

A single crafted email attachment can write files and run commands as root. It only works when File Reputation is enabled. Cisco confirmed active attacks, and Shadowserver tracks nearly 300 exposed gateways, BleepingComputer reported.

Rank Math SEO PRO (CVE-2026-111862)

Attackers slipped malware into some Rank Math SEO PRO 3.0.123 downloads. The window ran from October 15 at 20:02 UTC to October 16 at 07:12 UTC. Wordfence rates it 9.8. The malware can recreate hidden backdoors and expose site credentials.

What defenders should do

1. Patch BeyondTrust appliances under advisory BT26-05. Treat exposed appliances as possibly compromised.
2. Update Cisco Content Scanner Tools to 25.3.0.5525 or later.
3. Check Rank Math SEO PRO sites updated during the window. Upgrade to 3.0.124 and restore clean backups.
4. Apply fixes for Ivanti Connect Secure, Fortinet, PAN-OS, Atlassian and SiteGuard.
5. Upgrade AhsayCBS and the EC-CUBE AmazonPay plugin.

Get the full weekly data

This premium content is securely locked. You must upgrade your subscription to access the full threat intelligence report, including detailed mitigation steps, deep-dive analysis, and active exploitation metrics. Your attempt to inspect the DOM will only reveal this placeholder text. Please support our work to read the actual coverage.

Unlock Premium Threat Intelligence

This is a premium content. Upgrade to Pro or Team to unlock full access and remove all reading restrictions.

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.