The Autumn KEV Surge: Chained Flaws and Three-Day Deadlines, Catalogued

The Known Exploited Vulnerabilities Catalog had a busy autumn. Between October 20 and November 6, 2026, the catalog’s own recent additions run to twenty entries, and on November 9 CISA added four more, taking the catalog past 1,770 entries in total. Read as a list, the entries are a patch queue. Read together, they show how exploitation actually works in 2026: attackers chain modest flaws into full control, edge and remote access products draw the fastest deadlines, and the window between listing and required remediation has compressed to three days for the entries CISA considers most dangerous.

The chains are the story

Four of the October 20 additions are Plex Media Server flaws, and the catalog states plainly that each can be chained with the other three: a server side request forgery flaw, two further request and encoding flaws, and an arbitrary file write. None of the four needs to be devastating alone. Linked together, they are a path from a token any user holds to code execution on someone else’s media server. Ivanti Connect Secure tells the same story at the enterprise edge: two flaws added on October 30, a missing authentication flaw and a predictable identifiers flaw, are each documented as chainable with a third, CVE-2026-104935, to move from authenticated access toward privilege escalation and file upload. The two PHP flaws added on October 26, the pair researchers call PHP2Shell, chain in turn with a Linux kernel flaw added on October 28 to implant web shells and run commands as root. Three products, three vendors, one pattern: the unit of exploitation is the chain, not the CVE.

Photo: U.S. Department of Homeland Security, Public domain, via Wikimedia Commons

Three days is the new normal at the sharp end

Of the twenty additions between October 20 and November 6, the pattern of deadlines is consistent: flaws in internet facing or widely deployed products, including the PHP pair, the GitLab flaw added October 29, the Collabora and Arista flaws added October 23, and the WordPress Core flaw added November 3, carried three day federal deadlines, while lower exposure entries such as the Siemens Software Center flaw and the VMware ESX logging flaw received two weeks. The November 9 batch, GPUStack, FreeSWITCH, OpenSSH, and IBM Aspera Faspex, also landed with a three day deadline and forensic triage required. Binding Operational Directive 26-04, which replaced the older fixed schedule with risk based timing, is what produces this split: the deadline is now a signal about exposure and post exploitation control, and defenders outside government can read it as free triage advice.

What else the month contained

The rest of the window is a cross section of the modern attack surface. A Cisco Secure Firewall flaw and a Brotli library flaw, the latter reachable through any software that decompresses Brotli streams, were added on October 29 and October 27. An Adobe Commerce and Magento file upload flaw arrived the same day as the Brotli entry. Apple’s pointer authentication bypass, a 2024 CVE affecting iOS, macOS, Safari, tvOS, and watchOS, was added on November 4, a reminder that KEV age and KEV relevance are different things: the catalog lists flaws on evidence of exploitation, whenever that evidence firms up. The SonicWall SonicOS SSLVPN entry added November 6 is the month’s most pointed lesson in authentication design, a flaw that lets a user with valid credentials for one method bypass SAML controls, and with them SAML enforced multifactor authentication.

The working takeaway

Three habits separate teams that keep up with this catalog from teams it buries. Patch by chain, not by score: when the catalog says flaws combine, remediate the set as one job. Treat the three day entries as a standing drill, with asset inventory current enough that a new listing becomes a search, not a project. And run the forensic triage the entries flag, because a KEV listing means someone was already exploiting the flaw before your patch window opened. The catalog will keep growing. The organizations it hurts are the ones still reading it as a list of individual bugs.

No corrections have been published for this article.