CISA adds nine actively exploited vulnerabilities this week

Between 12 and 18 October 2026, CISA added nine actively exploited flaws to its KEV catalog, including authentication bypasses in BeyondTrust Remote Support (CVE-2026-102764) and Ivanti Connect Secure (CVE-2026-104935), a Fortinet path traversal (CVE-2025-61624) and code injection in PAN-OS (CVE-2026-0322). Have I Been Pwned also listed breaches at Crunchbase (559,908 accounts), Sharecare (318,185) and Gîtes de France (117,574).

• BeyondTrust Remote Support auth bypass CVE-2026-102764 added 16 October
• Fortinet path traversal CVE-2025-61624 and Ivanti Connect Secure CVE-2026-104935
• PAN-OS code injection CVE-2026-0322 and Windows CVE-2026-96951
• Breaches: Crunchbase 559,908, Sharecare 318,185, Gîtes de France 117,574 accounts