CVE Radar Oct 20, 2026: 10 Exploited Flaws, All Past Due

If you have ten minutes this week, spend them on patching. All ten vulnerabilities in this edition are on CISA's Known Exploited Vulnerabilities list, so attackers are already using them. They hit the systems most Houston and The Woodlands businesses depend on: Windows itself, the VPN and firewall at your front door, the email filter, and the backup and remote-support tools you would lean on during an incident. Every federal remediation deadline in this set has already passed.

CISA has not added anything new to the catalog since October 16. That makes this week a good time to catch up and to confirm the fixes really landed.

Microsoft Windows - security feature bypass (CVE-2026-96951)

What this means for you: a booby-trapped file or link can skip the Windows warning that normally asks "this came from the internet, are you sure?"

The technical juice: Windows Shell command injection, CVSS 8.8 (Microsoft). Added to KEV October 13. Fixed in the October cumulative updates: Windows 11 24H2/25H2 KB5127648, 23H2 KB5126653, Windows 10 22H2 (ESU) KB5126657, Server 2022 KB5126655, Server 2025 KB5126646, Server 2019 KB5126651. Set an Intune or WSUS deadline that forces the reboot, then confirm the build with winver or in your update compliance report.

Ivanti Connect Secure - authentication bypass (CVE-2026-104935)

What this means for you: a stranger can open your VPN without a password and run commands on it.

The technical juice: CVSS 8.6. Added to KEV October 13. Upgrade to a fixed release per Ivanti's advisory (22.8R2.5 / 25.1.1.2), and run the Integrity Checker Tool before and after.

Palo Alto Networks PAN-OS - code injection (CVE-2026-0322)

What this means for you: if your firewall's admin page is reachable from the internet, someone with an admin login can take full control of the firewall.

The technical juice: CVSS-B 8.6 (v4.0, Palo Alto) / 7.2 (NVD v3.1). Root code execution through the management interface. Palo Alto reports very limited exploitation so far. Fixed hotfixes include 12.2.4, 12.1.10-h2, 11.2.16, 11.1.16-h3 and 10.2.18-h12. Today, restrict the management interface to a jump box.

Cisco Secure Email Gateway - path traversal (CVE-2026-76519)

What this means for you: the box that filters your company email can be taken over from the internet without logging in.

The technical juice: CVSS 9.8. Unauthenticated arbitrary file write. Upgrade AsyncOS per Cisco advisory cisco-sa-esa-afw-zqYJkjxp.

BeyondTrust Remote Support - authentication bypass (CVE-2026-102764)

What this means for you: an attacker can impersonate the remote-support tool your IT team uses to get into your PCs.

The technical juice: CVSS 9.8 (NVD). Added October 16. Apply BeyondTrust BT26-05. CISA marks this one for forensic triage, so review session logs as well as patching. Full walkthrough: CVE-2026-102764 explained.

Fortinet FortiOS and related products - path traversal (CVE-2025-61624)

What this means for you: someone who already has a firewall admin login can quietly plant or delete files.

The technical juice: CVSS 6.5 (NVD). Added October 16. Upgrade per FG-IR-26-122 and enforce MFA on admin logins. See CVE-2025-61624 explained.

Citrix NetScaler ADC / Gateway - memory bounds (CVE-2026-88779)

What this means for you: your Citrix remote-access gateway can be knocked offline, locking out remote staff.

The technical juice: CVSS 7.5 (NVD). Added to KEV October 4. Upgrade per Citrix CTX697174.

Ahsay AhsayCBS - command injection and authentication bypass (CVE-2026-105134, CVE-2026-105133)

What this means for you: attackers can hijack the backup server you would need to recover from ransomware.

The technical juice: CVSS 10.0 and 7.3 (VulDB, the CVE numbering authority), chained together. Added October 14. Apply the Ahsay hotfix (v10.3.4.45 / v9.15.2.70) and restrict the replication receiver to known IPs. See CVE-2026-105134 explained.

Atlassian Data Center - files accessible to external parties (CVE-2026-21589)

What this means for you: self-hosted Jira or Confluence can leak internal files to anyone on the internet.

The technical juice: CVSS 9.3 (v4.0, Atlassian) / 7.5 (NVD). Added October 15. Upgrade per Atlassian's advisory.

1. Pull your Windows update compliance report and chase every machine that isn't on the October build.
2. Make sure no firewall or VPN admin page is reachable from the internet.
3. Ask your IT team or MSP whether you run BeyondTrust, Ivanti, Ahsay, Cisco email gateway, Fortinet, Citrix or self-hosted Atlassian. If you do, ask for proof that each one is patched.

A breach is expensive: IBM's Cost of a Data Breach Report 2025 puts the average at $4.44M globally and $10.22M in the US.

Download the full CVE Radar PDF (inventory table, 48-hour decision cards, drill-downs, sources).

Need Help With Cybersecurity?

Layer Logix will check your exposure to every CVE in this bulletin. Call 713.571.2390 or email techsupport@layerlogix.com.

Sources: CISA KEV catalog (v2026.10.16), NVD, and each vendor's advisory. The full list is in the PDF. This post is general information, not legal advice.