TL;DR
Eleven new entries landed in CISA’s KEV catalog between late September and early October 2026. They aren’t a random sample of exploited software — they cluster around three categories: internet-facing edge appliances, management consoles that control large estates, and API middleware. These systems share three properties: reachable from the internet, holding credentials or policy for everything behind them, and patched on maintenance-window cadence. That makes them high-value targets and slow-moving remediation projects. The pattern is the story.
The Batch
CISA added eleven vulnerabilities to its Known Exploited Vulnerabilities catalog in one week. Each one is actively exploited in the wild. Here’s the full list:
| CVE | Product | Primitive | CVSS | Due Date |
|---|---|---|---|---|
| CVE-2026-88771 | Citrix NetScaler ADC/Gateway | Auth bypass (unauthenticated) | 9.5 | Oct 4 |
| CVE-2026-88772 | Citrix NetScaler ADC/Gateway | Auth bypass (unauthenticated) | 9.5 | Oct 4 |
| CVE-2026-88779 | Citrix NetScaler ADC/Gateway | Memory buffer DoS (SAML SP/IdP) | 8.7 | Oct 7 |
| CVE-2026-76504 | Cisco Catalyst SD-WAN Manager | Hex encoding → admin access | 9.8 | Oct 3 |
| CVE-2026-104286 | Fortinet FortiMail | Path traversal → RCE | 9.8 | Oct 4 |
| CVE-2026-102489 | Zammad | Session fixation → RCE | 8.5 | Oct 5 |
| CVE-2026-102490 | Zammad | Local priv esc to root | 7.8 | Oct 5 |
| CVE-2026-65660 | Microsoft SharePoint | Code injection (low-priv auth) | 7.1 | Oct 5 |
| CVE-2026-87902 | WordPress core | Remote file inclusion | 9.8 | Oct 6 |
| CVE-2026-5430 | WSO2 API Manager | Auth bypass | 8.1 | Oct 7 |
| CVE-2026-71362 | Adobe Commerce/Magento | Template injection | 8.3 | Oct 8 |
That’s six network appliances, two helpdesk/commerce platforms, one CMS, one API gateway, and one management plane. The density of edge infrastructure is striking.
The Pattern
Three properties recur across these eleven entries:
1. Internet-reachable. Every affected product is commonly exposed to the public internet — email gateways, VPN concentrators, API managers, CMS sites. Attackers don’t need to be inside the network.
2. Credential-rich. Each system holds auth tokens, API keys, session cookies, or policy rules for everything behind it. Compromise one and you have leverage over a dozen services.
3. Maintenance-window patched. Edge appliances and management consoles rarely support rolling updates. You patch during a window, and that window is planned days or weeks ahead. Attackers know this and time their exploitation campaigns accordingly.
This is a deliberate concentration, not opportunistic scatter-shot. Threat actors are focusing on infrastructure that gives the most leverage per exploit.
Why This Batch Matters More Than the Sum of Its Parts
A single KEV addition is an event. Eleven in one week is a pattern.
The clustering reveals two things:
Where attackers are concentrating effort. Edge appliances account for four of the eleven entries (two Citrix, one Cisco, one Fortinet). Management planes add SharePoint and WSO2. The API middleware layer (WSO2, Citrix Gateway) appears twice. Attackers are treating the attack surface as a stack: breach the edge → pivot through management → own the API layer.
Where defender effort is misspent. Most organizations treat the KEV catalog as a queue of independent items — patch this one, then the next. But when eleven entries share the same class of affected infrastructure, you get more value from a coordinated response: inventory all internet-facing edge devices, know the exact build levels, pre-book maintenance windows, and patch the batch as a group rather than chasing due dates one at a time.
The WSO2 Lesson
CVE-2026-5430 in WSO2 API Manager is the most instructive entry in the batch. The fix was available months before CISA added it to KEV. The binding constraint wasn’t the vendor — it was the lag between a fix shipping and the estate actually being updated. Teams that shrink that lag on credential-holding infrastructure now will meet the next KEV wave with a shorter, more predictable to-do list.
Actionable Takeaways
1. Inventory the edge. List every internet-facing appliance, management console, and API gateway. Record the exact deployed build and the vendor’s fixed build. If you don’t know your build level, you don’t know if you’re affected.
2. Know the lag. For each product class, measure the gap between “fix available” and “applied to estate.” Edge appliances with long lag times should get pre-scheduled maintenance windows.
3. Pre-book patches. Don’t wait for the next KEV batch to decide when to patch. If an appliance requires downtime, book the window now. The next wave arrives faster than you think.
4. Read batches, not entries. When KEV additions cluster (and they do — six entries hit between Sep 27 and Oct 4), treat them as an operations dataset. Identify the shared infrastructure class and patch it all at once.
5. Hunt the SAML angle. The Citrix NetScaler entries (three KEV additions across Sep 27 and Oct 4, all on the same product) exploit SAML configuration paths. If you run NetScaler as a SAML SP or IdP, check for compromise signs using Citrix’s IOC script.