CISA KEV additions, Oct 16 to Oct 23, 2026: what was added and how to triage

What the three alerts cover

CISA published three Known Exploited Vulnerabilities (KEV) alerts in this window, dated October 16, October 20 and October 23, 2026. Each one lists the new entries by CVE number, vendor, product and weakness type. Each one also repeats the same paragraph about Binding Operational Directive (BOD) 26-04.

One limit comes first. The three alerts supplied for this briefing contain no federal due dates. They name no remediation deadline for any entry. This guide therefore gives none. Take due dates for each CVE from the KEV Catalog itself, which this briefing did not review. What follows covers what the alerts do say, and how the directive language they quote can be used to order the work.

October 16, 2026: Fortinet and BeyondTrust

CISA's October 16 alert says it added two vulnerabilities based on active exploitation evidence.

The alert names both entries: a path traversal flaw in multiple Fortinet products and an authentication bypass in BeyondTrust Remote Support.

The Fortinet entry covers "Multiple Products." The alert does not say which products. A team that runs Fortinet gear cannot treat this as a single-product check. It will need the vendor's own product list to learn whether any of its devices are in scope.

October 20, 2026: six entries from four vendors

The October 20 alert is the largest of the three. CISA says it added six vulnerabilities, again based on evidence of active exploitation.

Four of the six are in Plex Media Server. Two are server-side request forgery (SSRF) flaws, and one is an improper neutralization of encoded URI schemes in a web page.

The Plex group has two more entries, a second SSRF flaw and a flaw described as external control of file name or path.

The other two entries come from different vendors. They are an OS command injection flaw in EG Secure Solutions SiteGuard Server Edition and an uncontrolled search path element flaw in Siemens Software Center.

Four CVEs against one product is a reason to inventory that product once. Any Plex Media Server instance that exists in your environment is affected by four separate entries. Checking it four times would waste effort.

October 23, 2026: Arista VeloCloud Orchestrator

The October 23 alert covers a single entry. CISA says it added one vulnerability, based on evidence of active exploitation.

The entry is a SQL injection flaw in Arista VeloCloud Orchestrator.

How BOD 26-04 frames priority

All three alerts quote the same passage on the directive. It starts with scope.

The core requirement is a sorting rule. It sets two conditions and a deferral.

Read plainly, the rule has three parts. The CVE must be in the KEV Catalog. The affected asset must be publicly exposed. Exploitation must give an attacker total control of the asset. Items that do not meet these conditions fall under the deferral language.

The directive also covers compromise checks, not only patching. The alerts do not state what those expectations are or when the checks apply. A patched system is therefore not automatically a clean one. The agency's obligation, as CISA describes it, includes looking back at the period before the patch.

CISA also says why it keeps adding entries like these.

Applying this outside the federal government

The directive binds only federal civilian agencies, but CISA's alerts speak to everyone else too.

Using only what the alerts say, a security team can work through these questions in order for each of the nine entries:

1. Do we run the named product? For the Fortinet entry, that means checking which of the "Multiple Products" you own.
2. Is the affected asset publicly exposed? The directive's priority rule turns on this.
3. Does exploitation give an attacker total control of the asset? The alerts do not answer this per CVE, so the answer has to come from the vendor or the catalog entry.
4. If the asset was exposed and unpatched, did anyone compromise it before the patch? The directive's compromise-check language makes this part of the job.
5. What is the due date in the KEV Catalog for that CVE? The alerts do not give it.

Items that clear the first three questions belong at the front of the queue under the directive's own wording. Items that fail the exposure or total-control tests are the "lower-risk" group the directive allows agencies to defer. The alerts do not tell non-federal teams how long to defer them, so that call belongs to your own risk process.

Keeping the catalog current

CISA says the catalog will keep growing. That means the list above is a snapshot of one week, and a team that tracks KEV should expect more entries after October 23, 2026.

Organizations that know of an exploited flaw missing from the catalog can report it. The alerts point to a nomination form for that purpose.

CISA sets a minimum bar for what it will consider. A report that lacks any of the three is unlikely to qualify, going by CISA's own wording.