CISA KEV Exploitation in October 2026: Threat Actors, CVEs and Attack Trend
Summary
October 2026 concentrated threat activity around internet-facing administration, remote-access and content-management systems. By month-end, CISA had added 35 vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog. Activity during the month involved China-nexus espionage, ransomware, an AI-augmented initial-access broker and stealthy edge-device malware.
The most consequential October cases were ARMORY CASTLE's zero-day exploitation of BeyondTrust Remote Support, UTA0576's three-flaw Ivanti Connect Secure chain, CL-STA-0954's deployment of the memory-resident PEERSTITCH implant on FortiOS, WARP PANDA's use of a low-severity VMware ESX logging flaw as an anti-forensics primitive, CyberXero's automated WordPress exploitation, continuing Warlock ransomware activity against on-premises SharePoint, and an October disclosure on Silent Lynx's WinRAR exploitation.
The common defensive lesson is that KEV status alone does not describe the full intrusion. Several actors used the vulnerable system as a privileged relay into credentials, Active Directory, remote sessions or downstream hosts. Patching closes the entry point, but exposed appliances that were vulnerable during the exploitation window should also be investigated for persistence, credential theft, log tampering and lateral movement.
Scope and method
This post focuses on threat activity that was publicly disclosed, materially updated, or added to CISA KEV during October 2026. Duplicate CVEs are grouped by campaign, and disclosure timing is distinguished from the actual exploitation window where reporting provides that detail.
Inclusion rule. The main sections cover activity with material October relevance. Earlier exploitation is included only when October reporting introduced significant new attribution or technical detail, and the timing is stated explicitly.
October at a glance
| Campaign / actor | KEV CVE(s) | Product | October relevance |
|---|---|---|---|
| ARMORY CASTLE (formerly UNC5221) | CVE-2026-102764 | BeyondTrust Remote Support | Zero-day disclosed Oct. 15; KEV Oct. 16 |
| UTA0576 | CVE-2026-104935; later CVE-2026-111357 and CVE-2026-118527 in the same chain | Ivanti Connect Secure | Active exploitation began Oct. 3; additional chain CVEs added Oct. 30 |
| CL-STA-0954 / UNC5820 | CVE-2025-61624 | FortiOS | PEERSTITCH campaign disclosed Oct. 14; KEV Oct. 16 |
| WARP PANDA | CVE-2026-41709 | VMware ESX | Zero-day use disclosed and KEV-listed Oct. 28 |
| CyberXero | CVE-2026-60137, CVE-2026-63030 | WordPress Core | October report documents mass exploitation integrated with AI-agent workflows |
| Warlock / Storm-2603 / Longlegs | ToolShell family, including CVE-2025-53770 | Microsoft SharePoint Server | October reporting describes continuing attacks on unpatched on-premises SharePoint |
| Silent Lynx / UAT-6275 / TAG-193 | CVE-2025-8088 | WinRAR | October disclosure; exploitation observed earlier, through Aug. 2026 |
Threat actors exploiting KEV-listed CVEs
ARMORY CASTLE: BeyondTrust zero-day to SAWFLY and BARECLAW
Type: suspected PRC-nexus espionage. Exploited: CVE-2026-102764 in BeyondTrust Remote Support. Malware and tools: SAWFLY web shell and BARECLAW tunneler.
Google Threat Intelligence Group and Mandiant reported that ARMORY CASTLE, formerly tracked as UNC5221, exploited CVE-2026-102764 as a zero-day in late August. BeyondTrust disclosed the flaw on October 15 and CISA added it to KEV the next day. The bug affects the appliance's internal message-origin validation and can enable unauthenticated file operations on vulnerable Remote Support systems.
Post-exploitation showed deep appliance knowledge. The actor deployed the SAWFLY PHP web shell, escalated from the web service account to root by creating a SUID shell copy, attempted to access stored credentials, modified startup and sudo-related configuration for persistence, and installed the BARECLAW WebSocket/SOCKS5 tunneler behind the appliance's local HAProxy routing. Mandiant also observed log and artifact deletion. This makes vulnerable internet-facing appliances an incident-response problem even after patching.
Defensive focus: apply BT26-05-RS to supported self-hosted systems, review appliances exposed since late August, preserve externally forwarded logs, rotate credentials brokered or stored by the appliance, and hunt for SAWFLY/BARECLAW artifacts and unauthorized role changes.
UTA0576: three-flaw Ivanti Connect Secure chain for unauthenticated root access
Type: previously undocumented threat actor. Exploited: CVE-2026-104935 as the primary authentication-bypass/RCE path, with additional privilege and upload flaws later tracked as CVE-2026-111357 and CVE-2026-118527. Target: Ivanti Connect Secure.
Volexity found UTA0576 exploiting a fully patched Connect Secure appliance starting October 3. The chain combined authentication bypass, remote code execution and local privilege escalation to reach unauthenticated root-level execution. Ivanti initially released fixes for the primary path while work continued on the third issue; by October 30, fixes were available for the full chain and CISA added the two additional CVEs to KEV.
Unlike campaigns that immediately deploy a conventional web shell, the reported activity focused on credential extraction, host reconnaissance, limited Active Directory metadata collection, searches for administrator passwords, and BitLocker recovery keys. That behavior makes credential and identity review as important as appliance remediation.
Defensive focus: move to a release that fixes the complete chain, inspect authentication and configuration changes around October 3 onward, rotate credentials accessible from the appliance, review Active Directory and BitLocker-related queries, and treat a formerly exposed appliance as potentially compromised until investigated.
CL-STA-0954: FortiOS path traversal used to implant PEERSTITCH
Type: suspected advanced / state-aligned activity. Exploited: CVE-2025-61624. Malware: PEERSTITCH.
Unit 42's October investigation described a long-running intrusion at a telecommunications managed service provider. The broader campaign began with compromise of FortiManager, theft of configurations and credentials for hundreds of managed FortiGate devices, and later use of CVE-2025-61624 to deploy PEERSTITCH on FortiOS. CISA added CVE-2025-61624 to KEV on October 16.
PEERSTITCH is noteworthy because it is memory-resident and hooks legitimate FortiOS daemons such as miglogd and iked. It does not need a persistent executable on disk, a dedicated listening port or its own outbound connection. The implant can therefore blend into legitimate logging and VPN traffic, while the surrounding operation used stolen device configurations and credentials to maintain long-term access.
Defensive focus: upgrade to fixed FortiOS/FortiProxy/FortiPAM/FortiSwitchManager releases, rotate credentials and keys that may have been exposed through FortiManager, review unexpected configuration pushes and packet-capture rules, and do not rely on file-based malware scanning alone for a memory-resident appliance implant.
WARP PANDA: VMware ESX logging bypass used as an anti-forensics zero-day
Type: China-nexus espionage, according to October reporting. Exploited: CVE-2026-41709. Product: VMware ESX.
Broadcom describes CVE-2026-41709 as an insufficient-logging flaw that allows a malicious administrator to perform certain operations without those actions being logged. The vendor rates it Low severity, but CrowdStrike reporting cited in October says WARP PANDA used it as a zero-day in intrusions against U.S. organizations. CISA added the CVE to KEV on October 28.
This case shows why CVSS alone can be misleading for post-compromise vulnerabilities. An attacker already holding administrative access can use a logging weakness to reduce forensic visibility, hide follow-on actions and prolong persistence. In an ESX environment, missing audit evidence can materially complicate investigation of virtual infrastructure.
Attribution note: October reporting names WARP PANDA for the VMware ESX activity. No reviewed source establishes WARP PANDA as an alias of ARMORY CASTLE/UNC5221, so the VMware activity is treated separately.
CyberXero: AI-augmented mass exploitation of WordPress KEV flaws
Type: Russian-speaking, financially motivated initial access broker. Exploited: CVE-2026-60137 and CVE-2026-63030 in the wp2shell chain. Tooling: custom wp2shell automation, up to 51 Claude Code agents, PentAGI and Cobalt Strike infrastructure.
SOCRadar's October 6 report described CyberXero operating two pipelines: broad automated exploitation of WordPress and e-commerce sites, and a more targeted track against Ukrainian energy and utility organizations. The WordPress chain combines REST API route confusion with SQL injection to reach unauthenticated remote code execution. Both CVEs had already been added to CISA KEV in July, but the October reporting shows how quickly the same exploit chain can be industrialized.
One documented automated run scanned 4,708 targets, confirmed access to 429 WordPress administrator panels and deployed 32 web shells in 61 seconds. The AI layer appears to have been used for reconnaissance, exploit chaining, post-exploitation and payload generation, while the underlying vulnerabilities and web-shell mechanics remained conventional.
Defensive focus: patch WordPress Core to fixed supported releases, monitor REST batch API abuse, hunt for unexpected administrator accounts and web-shell/plugin paths, protect AI-agent session logs and API tokens, and treat large-scale automated exploitation as a reason to shorten patch latency rather than as a fundamentally new vulnerability class.
Warlock ransomware: old SharePoint exposure remains operationally useful
Type: ransomware / extortion. Product: on-premises Microsoft SharePoint Server. Vulnerability family: ToolShell and related SharePoint flaws, including CVE-2025-53770.
October reporting described Warlock, also tracked as Storm-2603 and Longlegs, continuing to compromise organizations through unpatched on-premises SharePoint. Reported victims included a water utility, telecommunications provider, regional government body and university. The campaign reinforces that a vulnerability does not stop being operationally relevant once it is a year old: exposed servers that missed remediation remain usable initial-access points.
CVE precision note: Some October summaries refer to the ToolShell family without identifying exactly which member of the chain was used in every 2026 intrusion. CVE-2025-53770 is a central ToolShell remote-code-execution flaw, but this article does not claim that every October Warlock compromise was independently confirmed to use that exact CVE.
Defensive focus: identify every internet-reachable on-premises SharePoint server, verify the complete ToolShell patch state, rotate machine keys where required by Microsoft's guidance, hunt for prior web-shell activity, and review domain-level ransomware readiness rather than treating SharePoint patching as the end of remediation.
Silent Lynx: WinRAR exploitation disclosed in October
Type: cyberespionage. Exploited: CVE-2025-8088. Tools: FoalShell, Chvost, Laplas and PickleShell reverse shells.
Cisco Talos and Recorded Future reporting published in October attributed a set of attacks on government organizations in the CIS region to Silent Lynx, also tracked as UAT-6275 and TAG-193. One infection chain used crafted WinRAR archives exploiting CVE-2025-8088, alongside other delivery methods such as macro-enabled documents and PowerShell-based loaders.
The activity was observed from June 2025 through August 2026, so this is an October disclosure of earlier exploitation, not evidence that the attacks began in October. It belongs in the monthly review because the actor-to-CVE mapping and technical details became public during October.
Patterns visible in October
1. Edge and remote-access systems remain high-value footholds
BeyondTrust, Ivanti and Fortinet all sit at privileged boundaries. Successful exploitation gives attackers a route to credentials, remote sessions, network management data or downstream systems. The operational value of the appliance is often more important than the CVSS score of the bug.
2. Post-compromise stealth is becoming a first-class capability
PEERSTITCH runs in memory inside legitimate FortiOS processes, ARMORY CASTLE deleted appliance logs after compromising BeyondTrust, and CVE-2026-41709 explicitly reduces ESX audit visibility. These cases share the same objective: make the foothold harder to detect and reconstruct.
3. A patched CVE can remain a live campaign months later
Warlock's continuing SharePoint activity and CyberXero's use of July WordPress flaws both show that disclosure age is not a reliable proxy for attacker interest. Once exploit code and automation exist, unpatched internet-facing systems remain valuable until they disappear from the attack surface.
4. Automation compresses exploitation at scale
CyberXero demonstrates how AI-agent orchestration can amplify scanning, triage and web-shell deployment. The underlying weakness is still conventional vulnerability exploitation, but automation can reduce the time defenders have between exposure and compromise.
Immediate actions to take
Within 24 hours
- Match the October KEV additions and the CVEs in this post against internet-facing inventory, prioritizing BeyondTrust Remote Support, Ivanti Connect Secure, Fortinet management/firewall products, VMware ESX, WordPress and on-premises SharePoint.
- Apply vendor fixes for the complete exploit chain, not only the first CVE disclosed. This is especially important for the Ivanti chain, where additional vulnerabilities were patched and KEV-listed later in the month.
- Restrict management and remote-access interfaces to trusted networks or authenticated access paths wherever operationally possible.
Within 72 hours
- Hunt for persistence, web shells, tunnels, unexpected SUID files, altered proxy/startup configuration, suspicious administrator-role changes and evidence of log deletion on previously exposed appliances.
- Rotate credentials, API keys and secrets stored on or brokered through compromised remote-access and management systems.
- Review Active Directory and privileged-access telemetry for follow-on activity from appliance subnets.
Within 7 days
- Move appliance logs to an external SIEM so a compromised device cannot erase the only copy of the evidence.
- Validate patch compliance on older KEV entries such as SharePoint and WordPress; exploit automation keeps these vulnerabilities active long after disclosure.
- Document unsupported or end-of-life systems that cannot reach fixed versions and isolate or retire them.
Caveats
- Threat actor naming varies by vendor. This post preserves the names used in the reporting and does not merge aliases unless the source explicitly does so.
- KEV confirms exploitation of a CVE, but it does not identify every actor using it or every victim.
- An October publication date does not mean exploitation began in October. BeyondTrust and Silent Lynx are clear examples where the exploitation window predates the disclosure.
- Where a campaign report names a vulnerability family but not a specific member of the chain for each intrusion, the article states that limitation instead of converting the association into certainty.
