Recorded Future identifies 82 high-impact CVEs in October 2026
Original title: October 2026 CVE Landscape
Insikt Group notes 52 Very Critical Risk Scores and CISA KEV coverage for 36 vulnerabilities among 82 high-impact CVEs.
Insikt Group identified 82 high-impact vulnerabilities in October 2026, a 13% decrease from September. 36 came from CISA's KEV catalog and 69 were actively exploited. Products from 51 vendors including Citrix and Microsoft were affected, spanning network, operating systems, collaboration platforms, and AI tools. The group created Nuclei templates for several PHP2Shell and other CVEs.
Unconfirmed: PoCs not tested for accuracy; North Korean attack link assessed with moderate confidence
- 52 vulnerabilities had Very Critical Risk Score
- 36 surfaced via CISA KEV catalog
- 13 exclusively from honeypot data
- 37 enabled remote code execution
- Public PoCs identified for 37 vulnerabilities
Impact: Remote code execution on affected servers and appliances
| Product | Affected |
|---|---|
| Citrix NetScaler ADC and Gateway | — |
| Microsoft Windows Shell | — |
| Palo Alto Networks PAN-OS | — |
| Fortinet FortiOS | — |
| Red Hat Polkit | — |
| Google Chrome | — |
| Adobe Commerce and Magento | — |
- 1.Verify public proof-of-concept exploits before testing
- 2.Upgrade affected products to patched versions
- 3.Check for suspicious PHP shells
- CVEs
- CVE-2015-3306CVE-2015-5477CVE-2016-3081CVE-2021-22205CVE-2021-3199CVE-2021-4034CVE-2023-22894CVE-2023-4863CVE-2025-61624CVE-2025-8088CVE-2026-0322CVE-2026-102490CVE-2026-102764CVE-2026-104286CVE-2026-104935CVE-2026-105133CVE-2026-105134CVE-2026-106931CVE-2026-109618CVE-2026-109619CVE-2026-110447CVE-2026-110936CVE-2026-111357CVE-2026-111497CVE-2026-114625CVE-2026-118527CVE-2026-21589CVE-2026-41709CVE-2026-46300CVE-2026-48356
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2015-3306 | Arbitrary file read/write via ProFTPD 1.3.5 mod_copy | 10.0 | 99% | KEVPoC ×5 | KEV |
| CVE-2015-5477 | Remote denial of service in ISC BIND via TKEY queries | 7.5 | 100% | KEV | KEV |
| CVE-2016-3081 | Command injection RCE in Apache Struts Dynamic Method Invocation | 8.1 | 97% | KEVPoC ×2 | KEV |
| CVE-2021-22205 | Unauthenticated RCE in GitLab CE/EE via ExifTool Image Parsing (CVE-2021-22205) | 10.0 | 100% | KEVRansomwarePoC ×2 | KEV |
| CVE-2021-3199 | Path Traversal RCE in ONLYOFFICE Document Server | 9.8 | 30% | KEVPoC ×2 | KEV |
| CVE-2021-4034 | Out-of-Bounds Read/Write Local Privilege Escalation in polkit pkexec (PwnKit) | 7.8 | 95% | KEVRansomwarePoC ×4 | KEV |
| CVE-2023-22894 | Sensitive-data leak in Strapi admin query filters (through 4.5.5) | 4.9 | 4% | KEVPoC ×2 | KEV |
| CVE-2023-4863 | Out-of-Bounds Write in Google Chromium WebP Image Codec Actively Exploited | 8.8 | 100% | KEVPoC ×4 | KEV |
| CVE-2025-61624 | Authenticated path traversal in Fortinet FortiOS and related products | 6.5 | 1% | KEV | KEV |
| CVE-2025-8088 | WinRAR Path Traversal (CVE-2025-8088) Enables Arbitrary Code Execution | 8.4 | 94% | KEVRansomware | KEV |
| CVE-2026-0322 | Authenticated root RCE in Palo Alto PAN-OS management | 8.6 | 2% | KEV | KEV |
| CVE-2026-102490 | Local privilege escalation to root in all Zammad versions | 9.4 | 11% | KEV | KEV |
| CVE-2026-102764 | Message-origin spoofing enables file ops on BeyondTrust Remote Support | 9.3 | 78% | KEVPoC ×2 | KEV |
| CVE-2026-104286 | Unauthenticated path traversal file write in Fortinet FortiMail | 9.8 | 5% | KEVPoC ×4 | KEV |
| CVE-2026-104935 | Auth Bypass to Command Execution in Ivanti Connect Secure | 8.6 | 89% | KEVPoC ×4 | KEV |
CVE-2026-105134+1 related CVE | Unauthenticated OS Command Injection in AhsayCBS | 10.0 group max | 82% | KEVPoC | KEV |
| CVE-2026-106931 | OS command injection in SiteGuard Server Edition | 8.5 | 3% | KEV | KEV |
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-110447 | Unauthenticated OS command injection in Nextcloud CODE Server | 9.2 | 73% | KEVPoC ×3 | KEV |
| CVE-2026-110936 | DLL Search-Path Hijacking in Siemens Software Center | 8.4 | <1% | KEV | KEV |
| CVE-2026-111357 | Local root privilege escalation in Ivanti Connect Secure 22.8R2.4 | 7.0 | <1% | KEV | KEV |
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
| CVE-2026-114625 | SQL injection in Arista VeloCloud Orchestrator grants superuser | 9.4 | 1% | KEVPoC | KEV |
| CVE-2026-118527 | Predictable identifiers in Ivanti Connect Secure enable file upload | 4.3 | <1% | KEV | KEV |
| CVE-2026-21589 | Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability | 9.3 | 100% | KEVPoC ×10 | KEV |
| CVE-2026-41709 | Insufficient logging in VMware ESX for admin operations | 2.7 | <1% | KEV | KEV |
| CVE-2026-46300 | Shared-frag marker loss in Linux kernel skb coalescing (LPE) | 7.8 | 16% | KEVPoC | KEV |
| CVE-2026-48356 | Unrestricted dangerous file upload in Adobe Commerce and Magento | 9.3 | 47% | KEV | KEV |
From the original article
8 min read at recordedfuture.com
In October 2026, Insikt Group® identified 82 high-impact vulnerabilities that should be prioritized for remediation, 52 of which had a Very Critical Recorded Future Risk Score. This represents a 13% decrease from last month.
By Insikt Group® · recordedfuture.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.