Zero-day report: October 2026 (so far)
CISA added 32 exploited vulnerabilities to its catalog in October 2026 so far. 15 were zero-days, listed within a week of going public. The most-hit vendor was Plex, with 4.
By technology
Most-hit vendors
Every flaw added in October 2026
- VMware · VMware ESXBroadcom VMWare ESX Insufficient Logging Vulnerability
- Linux · KernelLinux Kernel Missing Initialization of a Variable Vulnerability
- Google · BrotliGoogle Brotli Unchecked Return Value Vulnerability
- Adobe · Commerce and MagentoAdobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
- PHP Group · PHPPHP Memory Corruption Vulnerability
- PHP Group · PHPPHP Stale Internal Request-State Vulnerability
- Collabora · Collabora Online – Built-in CODE ServerCollabora Online – Built-in CODE Server OS Command Injection Vulnerability
- Arista · VeloCloud OrchestratorArista VeloCloud Orchestrator SQL Injection Vulnerability
- EG Secure Solutions · SiteGuard Server EditionEG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
- Siemens · Software CenterSiemens Software Center Uncontrolled Search Path Element Vulnerability
- Plex · Media ServerPlex Media Server Server-Side Request Forgery (SSRF) Vulnerability
- Plex · Media ServerPlex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
- Plex · Media ServerPlex Media Server Server-Side Request Forgery (SSRF) Vulnerability
- Plex · Media ServerPlex Media Server External Control of File Name or Path Vulnerability
- Fortinet · Multiple ProductsFortinet Multiple Products Path Traversal Vulnerability
- BeyondTrust · Remote SupportBeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
- Atlassian · Multiple ProductsAtlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
- Palo Alto Networks · PAN-OSPalo Alto Networks PAN-OS Code Injection Vulnerability
- Ahsay · AhsayCBSAhsay AhsayCBS Improper Authentication Vulnerability
- Ahsay · AhsayCBSAhsay AhsayCBS Command Injection Vulnerability
- Cisco · Secure Email GatewayCisco Secure Email Gateway Relative Path Traversal Vulnerability
- Ivanti · Connect SecureIvanti Connect Secure Authentication Bypass by Spoofing Vulnerability
- Microsoft · WindowsMicrosoft Windows Command Injection Vulnerability
- ProFTPD · ProFTPDProFTPD Improper Access Control Vulnerability
- ISC · BIND ISC BIND Data Processing Errors Vulnerability
- Apache · StrutsApache Struts Command Injection Vulnerability
- ONLYOFFICE · DocsONLYOFFICE Docs Server Path Traversal Vulnerability
- Strapi · StrapiStrapi Cleartext Storage of Sensitive Information Vulnerability
- Citrix · NetScalerCitrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
- Zammad GmbH · ZammadZammad GmbH Zammad Session Fixation Vulnerability
- Zammad GmbH · ZammadZammad GmbH Zammad Improper Privilege Management Vulnerability
- Fortinet · FortiMailFortinet FortiMail Path Traversal Vulnerability
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.