Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

Weekly report flags exploited flaws absent from CISA KEV

Part of the CVE-2026-76418 story · since 28 Oct

Developinglatest 2 hours ago7 articles5 outlets
28 Oct · SecurityOnline first31 Oct1 NovNowThis article7th of 7
  • Wed 28 Oct, 22:30 UTC. SecurityOnline, first report. Cisco confirms firewall flaw is being exploited to crash VPNs. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 10:30 UTC. SecurityWeek, its first report on the story. Cisco fixes exploited VPN flaw that can crash firewalls. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 12:00 UTC. The Hacker News, its first report on the story. Cisco patches actively exploited VPN flaw that can crash firewalls. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 20:01 UTC. CISA, its first report on the story. CISA adds actively exploited Cisco firewall flaw to KEV catalogue. Cites a CVE in CISA KEV.
  • Fri 30 Oct, 08:30 UTC. The Hacker News. CISA Adds Exploited GitLab and Cisco Flaws to KEV. Cites a CVE in CISA KEV.
  • Fri 30 Oct, 21:30 UTC. Security Affairs, its first report on the story. CISA adds GitLab and Cisco flaws to exploited vulnerabilities list. Cites a CVE in CISA KEV.
  • Mon 2 Nov, 03:31 UTC. SecurityOnline. Weekly report flags exploited flaws absent from CISA KEV. Cites a CVE in CISA KEV. This article, 7th of 7.

Daily Cybersecurity’s weekly CVE report for 26 October–1 November 2026 tallies 3,734 new CVEs, with 15 exploited vulnerabilities highlighted for the period. The investigation contrasts findings from DC (Daily Cybersecurity) with CISA KEV, noting that seven flaws were flagged as exploited by DC, five of which were not yet present in KEV. The report emphasises that two DC-exploited flaws did appear in KEV, while five remain exclusive to DC for now.

The piece flags several high-severity issues and maps which products are affected, including Cisco, Ivanti, YOOtheme, Oracle EBS, MLflow and FreeSWITCH, among others. Notably, Oracle E-Business Suite and YOOtheme Pro attack activity are called out as missing from KEV despite exploitation signals in the wild.

Among the exploits spotlighted, the report documents CVE-2026-76418 affecting Cisco Secure Firewall ASA and FTD (disclosed as actively exploited by defenders), CVE-2026-102785 in YOOtheme Pro (unAuthenticated webshell write via image handler; fixed in 5.0.53), and CVE-2026-101767 in Oracle E‑Business Suite (unauthenticated SQL injection). The analysis also notes CVEs tied to FreeSWITCH (CVE-2026-116779) and Drupal Commerce Core (CVE-2026-118539), with other DC-exclusive items including MLflow (CVE-2026-116690).

The piece lists a set of CVEs reported to KEV-only, such as PHP2Shell flaws (CVE-2026-109618, CVE-2026-109619) and CVSS 9.3–9.2 severities for Adobe Magento, Google Brotli, and Linux kernel issues. Defenders are urged to patch internet-facing gear and apply Oracle’s Critical Patch Update, update YOOtheme Pro, and upgrade FreeSWITCH, among other mitigations.

How the story developed

All 7 articles
Developinglatest 2 hours ago7 articles5 outlets

7 articles from 5 outlets since 28 Oct. Picked up again today after 2 days quiet. This was the 7th report, 4 days after the first.

Now28 Oct30First reportSecurityOnline · 28 Oct, 22:30This article7th of 7 · day 5CISA alert29 Oct, 20:01 · official
  • Wed 28 Oct, 22:30 UTC. SecurityOnline, first report. Cisco confirms firewall flaw is being exploited to crash VPNs. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 10:30 UTC. SecurityWeek, its first report on the story. Cisco fixes exploited VPN flaw that can crash firewalls. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 12:00 UTC. The Hacker News, its first report on the story. Cisco patches actively exploited VPN flaw that can crash firewalls. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 20:01 UTC. CISA, its first report on the story. CISA adds actively exploited Cisco firewall flaw to KEV catalogue. Cites a CVE in CISA KEV.
  • Fri 30 Oct, 08:30 UTC. The Hacker News. CISA Adds Exploited GitLab and Cisco Flaws to KEV. Cites a CVE in CISA KEV.
  • Fri 30 Oct, 21:30 UTC. Security Affairs, its first report on the story. CISA adds GitLab and Cisco flaws to exploited vulnerabilities list. Cites a CVE in CISA KEV.
  • Mon 2 Nov, 03:31 UTC. SecurityOnline. Weekly report flags exploited flaws absent from CISA KEV. Cites a CVE in CISA KEV. This article, 7th of 7.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 7 articles as a list
  1. Wed 28 OctDay 01
    1. Cisco confirms firewall flaw is being exploited to crash VPNs22:30 · SecurityOnline · First report · Exploited CVE · Known exploited CVE
  2. Thu 29 OctDay 13
    1. Cisco fixes exploited VPN flaw that can crash firewalls10:30 · SecurityWeek · Known exploited CVE
    2. Cisco patches actively exploited VPN flaw that can crash firewalls12:00 · The Hacker News · Known exploited CVE
    3. CISA adds actively exploited Cisco firewall flaw to KEV catalogue20:01 · CISA · official · CISA alert · Known exploited CVE
  3. Fri 30 OctDay 22
    1. CISA Adds Exploited GitLab and Cisco Flaws to KEV08:30 · The Hacker News · Known exploited CVE
    2. CISA adds GitLab and Cisco flaws to exploited vulnerabilities list21:30 · Security Affairs · Known exploited CVE

  4. Quiet for 2 days

    Mon 2 NovDay 51
    1. Weekly report flags exploited flaws absent from CISA KEV03:31 · SecurityOnline · Picked up again · Known exploited CVE · This article, 7th of 7

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in