October 2026 KEV additions: patterns and what to change in remediation

What CISA added between October 23 and October 30, 2026

CISA published four KEV alerts in this window. The entries are listed here in date order, so the patterns in the later sections can be checked against them.

CISA's October 23 alert says it added one vulnerability, CVE-2026-114625, an Arista VeloCloud Orchestrator SQL injection flaw, to the KEV Catalog.

CISA's October 26 alert says it added two vulnerabilities and also updated an earlier alert, "Critical Vulnerabilities in PHP Require Immediate Patching."

The two October 26 entries are CVE-2026-109618, a PHP memory corruption vulnerability, and CVE-2026-109619, a PHP stale internal request-state vulnerability.

CISA's October 28 alert says it added CVE-2026-41709, a Broadcom VMware ESX insufficient logging vulnerability, based on evidence of active exploitation.

The second October 28 entry is CVE-2026-46300, a Linux kernel missing-initialization-of-a-variable vulnerability.

CISA's October 30 alert says it added CVE-2026-111357, an Ivanti Connect Secure missing-authentication-for-critical-function vulnerability, based on evidence of active exploitation.

The second October 30 entry is CVE-2026-118527, an Ivanti Connect Secure vulnerability described as generation of predictable numbers or identifiers.

Product classes: what the names show

The alerts name products but do not sort them into classes. Any grouping is therefore a reading of the names, not a CISA statement.

Read that way, three vendors appear: Arista, Broadcom and Ivanti. PHP and the Linux kernel appear without a vendor name. Two alerts list two flaws in the same product: PHP on October 26 and Ivanti Connect Secure on October 30. Each of the other two alerts names different products from the others.

The practical point for an inventory is that the entries do not cluster in one product family. A program that watches only one product class would have missed most of these alerts.

Vulnerability types

The seven entries carry seven different weakness labels: SQL injection, memory corruption, stale internal request-state, insufficient logging, missing initialization of a variable, missing authentication for critical function, and generation of predictable numbers or identifiers.

Nothing in the alerts ranks these types or says one is more urgent than another. CISA uses the same sentence in each alert about them. It says these types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

The "insufficient logging" entry on October 28 is worth noting for a security leader. The alert gives no detail on how it was exploited, so this guide does not assume any. The entry sits in the catalog on the same footing as the others.

Remediation deadlines: what the alerts say

None of the four alerts gives a due date for any of the seven CVEs. This guide cannot report a deadline that the alerts do not state.

What the alerts do give is the framework that governs federal remediation. CISA says Binding Operational Directive (BOD) 26-04, "Prioritizing Security Updates Based on Risk," sets vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies.

CISA says the directive requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities.

The alerts define the high-risk group narrowly. It covers CVEs in the KEV Catalog on publicly exposed assets that give total control of the asset after exploitation, and the directive defers action on lower-risk vulnerabilities.

Anyone who needs the actual due date for a given CVE must take it from the KEV Catalog itself or from BOD 26-04. Neither is included in the documents behind this guide.

What this supports for patch SLAs

CISA states that BOD 26-04 applies only to FCEB agencies. It also says it encourages all organizations to adopt risk-based vulnerability management and to prioritize remediation of KEV Catalog vulnerabilities.

That is the extent of what the alerts ask of non-federal organizations. From it, three adjustments follow directly:

• Treat KEV listing as an input to SLA tiering, not a footnote to a severity score.
• Apply the directive's own test to your assets: is the CVE in the KEV Catalog, is the asset publicly exposed, and does exploitation give total control?
• Allow slower handling only for vulnerabilities outside that group, since the directive defers action on lower-risk items.

The alerts give no number of days for any tier. Choosing day counts is a decision for your own program, and the documents do not supply a figure.

One more point comes from the directive. CISA says BOD 26-04 sets basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. An SLA that ends at "patch applied" does not cover that step. Your program should say when a compromise check is required.

What this supports for exposure monitoring

The directive's test turns on whether an asset is publicly exposed, so exposure data decides which KEV entries land in your fastest tier. In practice that means being able to answer two questions quickly for each new entry: do we run this product, and is the instance reachable from outside?

The October 23 to 30 entries show why the answer has to cover many products. Five product names appeared in eight days, and two of them appeared twice in a single alert.

CISA also says it will keep adding entries. Monitoring that matches each new entry against your inventory, rather than a fixed list of products, fits that statement.

CISA also gives organizations a way to report what they see. Its alerts say a potential KEV addition must have a CVE ID, evidence of exploitation and clear mitigation guidance. If your monitoring finds exploitation of a flaw that is not in the catalog, that is the bar a submission has to meet.

Limits of this reading

This guide rests on four short CISA alerts. They name the CVEs, products and weakness types, and they restate BOD 26-04. They do not give due dates, severity scores, affected versions, patches or exploitation details. The October 26 alert is also the only one of the four that points to another CISA alert, the PHP one. This guide therefore cannot say which versions of any product are affected, or what a fix involves. For those, go to the vendor bulletins and the KEV Catalog entries for each CVE.