CISA KEV Adds 40 Flaws — BeyondTrust, Fortinet, Atlassian Deadlines Hit This Week
CISA logged 40 catalog additions in the trailing month, with three carrying remediation deadlines landing today or tomorrow: an Atlassian multi-product exposure flaw (due today), plus BeyondTrust Remote Support and a Fortinet path traversal bug (both due tomorrow). The bulk of the batch — including several legacy/EoL entries dating back to 2015 — already has lapsed BOD 26-04 deadlines; treat those as emergency backlog patching, not routine maintenance.
| Total additions | 40 |
| Due today (10-18) | 1 |
| Due tomorrow (10-19) | 2 |
| Already overdue | 37 |
| Confirmed ransomware use | 0 (all flagged "Unknown" by CISA) |
| ID | CVE-2026-21589 |
| Manufacturer | Atlassian |
| Product | Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd Data Center; Crucible/Fisheye |
| Class | Files or Directories Accessible to External Parties |
| Status | KEV-confirmed exploitation |
| Filed | 2026-10-15 |
| Effective (deadline) | 2026-10-18 — due today |
Unauthenticated exposure across a wide Atlassian Data Center install base; confirm patch status now, this deadline has already arrived.
| ID | CVE-2026-102764 |
| Manufacturer | BeyondTrust |
| Product | Remote Support |
| Class | Authentication Bypass by Spoofing |
| Filed | 2026-10-16 |
| Effective (deadline) | 2026-10-19 |
Allows remote file operations on the appliance — privileged remote-access tooling is a prime ransomware foothold; prioritize over the 24-hour window.
| ID | CVE-2025-61624 |
| Manufacturer | Fortinet |
| Product | FortiOS, FortiPAM, FortiProxy, FortiSwitchManager |
| Class | Path Traversal |
| Filed | 2026-10-16 |
| Effective (deadline) | 2026-10-19 |
Requires admin read-write access but enables arbitrary file write/delete via CLI — chain risk with other Fortinet CVEs on this list.
| ID | CVE-2026-105134 (Command Injection) / CVE-2026-105133 (Improper Authentication) |
| Manufacturer | Ahsay |
| Product | AhsayCBS |
| Filed | 2026-10-14 |
| Effective (deadline) | 2026-10-17 (lapsed) |
Auth-bypass chains directly into command injection