CVE Weekly, October 9 to 16, 2026: Ivanti, Cisco and PAN-OS Exploited, Patch Tuesday Lands 79 Fixes

397 CVEs were analysed this week (October 9 to 16, 2026). 185 have a CVSS score of 9 or more, which is exactly why severity alone is not a to-do list. Five are on the CISA Known Exploited Vulnerabilities (KEV) catalog, and that is where your week should start.

This digest ranks the week by exploitation first: KEV, then EPSS (the probability of exploitation in the next 30 days), then how widely the product is deployed, and only then CVSS. Each entry links to the full analysis and to the vendor advisory, which remains the source of truth for fixed versions.

At a glance

Patch now: exploited in the wild

Three of this week's five KEV entries are recent, and all three sit on network edge or security devices. That pattern keeps repeating: the appliances meant to protect a network are a favourite way in, because they face the internet and rarely run endpoint protection.

Ivanti Connect Secure: unauthenticated command execution

CVE-2026-104935 is an authentication bypass that lets a remote, unauthenticated attacker execute commands on Ivanti Connect Secure SSL VPN appliances before 25.1.3.0. CVSS 8.6, EPSS 26%, the highest exploit likelihood of any 2026 CVE this week.

• Upgrade to 25.1.3.0 or later following the Ivanti advisory.
• Because exploitation predates many patch windows, also run Ivanti's integrity checker and review appliance logs for unexpected sessions or commands. Patching does not remove an attacker who is already in.

Cisco Secure Email Gateway: path traversal to root

CVE-2026-76519 lets an unauthenticated attacker write files and gain root on Cisco Secure Email Gateway (formerly ESA) deployments that use AMP file reputation. CVSS 9.8, on the KEV list.

• Apply the fixed release from the Cisco advisory.
• Until you can, check whether file reputation is enabled and whether the advisory lists a workaround for your release.

PAN-OS management interface: authenticated code injection to root

CVE-2026-0322 is a code injection in the PAN-OS management interface that yields root, affecting PA-Series and VM-Series firewalls and Panorama. It needs authentication, which makes stolen admin credentials and exposed management interfaces the real issue.

• Upgrade per the Palo Alto Networks advisory.
• Make sure the management interface is reachable only from a dedicated management network, never from the internet, and rotate admin credentials if it was exposed.

Old bugs, still exploited

Two decade-old vulnerabilities entered our feed this week, both on the KEV list with EPSS above 95%. If either is still running anywhere in your estate, assume it is being probed.

• CVE-2015-3306, ProFTPD 1.3.5 mod_copy: unauthenticated file read and write through SITE CPFR and CPTO. EPSS 99.5%. Upgrade ProFTPD or disable mod_copy, and ask whether that FTP server needs to exist at all.
• CVE-2016-3081, Apache Struts 2 S2-032: remote code execution through Dynamic Method Invocation in Struts 2.0.0 to 2.3.28. EPSS 96%. It often hides inside third-party Java applications rather than your own code, so check vendors' bundled libraries too. See the Struts advisory.

Patch Tuesday: 79 Microsoft fixes

October's Patch Tuesday (October 13) accounts for 79 of this week's CVEs, 22 of them rated critical. None is on the KEV list yet. Prioritise by exposure rather than by count:

1. Servers that accept traffic from outside: Microsoft Exchange (CVE-2026-70571, remote code execution), Routing and Remote Access and its PPP EAP-TLS path (remote code execution, CVSS 9.8), and Network Policy Server (CVSS 9.8).
2. Core Windows network services: the RPC runtime (CVE-2026-83910, unauthenticated remote code execution, CVSS 9.8) and Microsoft DNS Server.
3. Everything else, including workstations: Windows Shell, Media Foundation, Text Shaping and Error Reporting, through your normal patch ring.

Details and fixed builds are in the Microsoft Security Update Guide.

Not exploited yet, but likely: worth a look this week

These are not on the KEV list, but their EPSS scores stand out (most CVEs score well under 1%) and the products are common in engineering environments.

Your checklist for this week

1. Patch or isolate Ivanti Connect Secure, Cisco Secure Email Gateway and PAN-OS management interfaces, and check the appliances for signs of compromise.
2. Search your estate for ProFTPD 1.3.5 and Struts 2.3.x, including inside third-party Java applications.
3. Roll out Patch Tuesday to internet-facing Exchange, RRAS and NPS servers first, then core Windows servers, then workstations.
4. Update AnyDesk, Argo CD, Brocade Fabric OS and MariaDB where you run them.

See which of these hit your stack

A weekly digest tells you what happened in the world. It cannot tell you which of these CVEs touch the products and versions you run. vulneraibility.com matches every new CVE against your stack, app by app, checks your version against the published affected range, and ranks what is left by exploitation. Read how teams use it to stay ahead of CVE risk.

Data: the vulneraibility.com CVE corpus as of October 16, 2026. KEV status comes from the CISA catalog and EPSS from FIRST. Always confirm fixed versions in the vendor advisory linked from each entry.