Threat forecast · Thu 05 Nov 2026
What attackers are using, and what is next.
Two lists, updated from public exploit data: the vulnerabilities confirmed as exploited in the wild, and the ones with the highest probability of being exploited in the next 30 days.
- 34vulnerabilities confirmed exploited in the last 30 days
- 36added to the CISA catalog in October, against a monthly average of 26 over the year before
- 26came with a three-day fix deadline for federal agencies
- 4,382known vulnerabilities carry a better than even chance of exploitation in the next 30 days
Watchlist
Likely next.
Fourteen vulnerabilities with a better than 70% public probability of exploitation activity in the next 30 days, ranked by Cycurion Priority. None are in the CISA catalog yet. Two numbers appear on every row; here is what each one means.
0 to 100%
The FIRST EPSS estimate of the chance that a vulnerability sees exploitation activity in the next 30 days. A higher number means more likely to be attacked. It knows the vulnerability, not your environment.
0 to 100
Likelihood multiplied by what the attacker would gain, scaled so the most damaging confirmed attack scores 100. A higher number means deal with it first.
The watchlist is the highest-probability vulnerabilities with a CVE from 2025 or later that CISA has not yet confirmed as exploited. The line shows each public probability over the past 30 days.
Confirmed in the last 30 days
Already being exploited.
34 vulnerabilities CISA has confirmed as exploited in the wild, ranked by Cycurion Priority, with the date federal agencies must have them fixed. 12 of them give an attacker code execution.
| Public probability | |||||||
|---|---|---|---|---|---|---|---|
| Priority | Vulnerability | Threat vector | CVE | Confirmed | Fix by | Before CISA confirmation | Today |
| 93 | WordPress WordPress CoreTime-of-check Time-of-use (TOCTOU) Race ConditionPanoptic find and fixHabit catch in use | Code execution | CVE-2026-119977 | Nov 3 | Nov 6 | 0.6% | 1.2% |
| 93 | GitLab Community Edition and Enterprise EditionInteger Overflow or WraparoundPanoptic find and fixHabit catch in use | Code execution | CVE-2026-97229 | Oct 29 | Nov 1 | 18.4% | 65.2% |
| 93 | Adobe Commerce and MagentoUnrestricted Upload of File with Dangerous TypePanoptic find and fixHabit catch in use | Code execution | CVE-2026-48356 | Oct 27 | Nov 10 | 1.0% | 47.5% |
| 93 | Google BrotliUnchecked Return Value | Code execution | CVE-2026-111497 | Oct 27 | Nov 10 | 36.0% | 82.6% |
| 93 | PHP Group PHPStale Internal Request-State | Code execution | CVE-2026-109619 | Oct 26 | Oct 29 | 100.0% | 100.0% |
| 93 | PHP Group PHPMemory Corruption | Code execution | CVE-2026-109618 | Oct 26 | Oct 29 | 100.0% | 100.0% |
| 93 | Collabora Collabora Online - Built-in CODE ServerOS Command Injection | Code execution | CVE-2026-110447 | Oct 23 | Oct 26 | 1.2% | 73.3% |
| 93 | EG Secure Solutions SiteGuard Server EditionOS Command Injection | Code execution | CVE-2026-106931 | Oct 20 | Oct 23 | 0.7% | 2.5% |
| 93 | Ahsay AhsayCBSCommand Injection | Code execution | CVE-2026-105134 | Oct 14 | Oct 17 | 1.8% | 81.8% |
| 93 | Palo Alto Networks PAN-OSCode Injection | Code execution | CVE-2026-0322 | Oct 14 | Oct 17 | No score | 1.7% |
| 93 | Microsoft WindowsCommand Injection | Code execution | CVE-2026-96951 | Oct 13 | Oct 16 | No score | 9.8% |
| 93 | Apache StrutsCommand Injection | Code execution | CVE-2016-3081 | Oct 8 | Oct 11 | 93.4% | 96.5% |
| 87 | Apple Multiple ProductsImproper Authentication | Data exposure | CVE-2024-27834 | Nov 4 | Nov 18 | 0.6% | 1.4% |
| 87 | Ivanti Connect SecureMissing Authentication for Critical Function | Data exposure | CVE-2026-111357 | Oct 30 | Nov 2 | 0.2% | 0.5% |
| 87 | Arista VeloCloud OrchestratorSQL Injection | Data exposure | CVE-2026-114625 | Oct 23 | Oct 26 | No score | 1.0% |
| 87 | Plex Media ServerServer-Side Request Forgery (SSRF) | Data exposure | CVE-2026-96655 | Oct 20 | Nov 3 | 0.2% | 10.7% |
| 87 | Plex Media ServerServer-Side Request Forgery (SSRF) | Data exposure | CVE-2026-96652 | Oct 20 | Nov 3 | 0.2% | 11.9% |
| 87 | BeyondTrust Remote SupportAuthentication Bypass by Spoofing | Data exposure | CVE-2026-102764 | Oct 16 | Oct 19 | No score | 78.0% |
| 87 | Fortinet Multiple ProductsPath Traversal | Data exposure | CVE-2025-61624 | Oct 16 | Oct 19 | 0.5% | 1.3% |
| 87 | Cisco Secure Email GatewayRelative Path Traversal | Data exposure | CVE-2026-76519 | Oct 14 | Oct 17 | No score | 2.2% |
| 87 | Ahsay AhsayCBSImproper Authentication | Data exposure | CVE-2026-105133 | Oct 14 | Oct 17 | 0.4% | 79.5% |
| 87 | Ivanti Connect SecureAuthentication Bypass by Spoofing | Data exposure | CVE-2026-104935 | Oct 13 | Oct 16 | No score | 88.9% |
| 87 | ONLYOFFICE DocsServer Path Traversal | Data exposure | CVE-2021-3199 | Oct 8 | Oct 11 | 8.2% | 30.2% |
| 87 | ProFTPD ProFTPDImproper Access Control | Data exposure | CVE-2015-3306 | Oct 8 | Oct 11 | 96.8% | 99.5% |
| 67 | Ivanti Connect SecureGeneration of Predictable Numbers or Identifiers | Other | CVE-2026-118527 | Oct 30 | Nov 13 | No score | 0.8% |
| 67 | Cisco Secure Firewall ASA Software and Cisco Secure FTD SoftwareUnchecked Return Value to NULL Pointer Dereference | Other | CVE-2026-76418 | Oct 29 | Nov 1 | No score | 0.8% |
| 67 | Linux KernelMissing Initialization of a Variable | Other | CVE-2026-46300 | Oct 28 | Oct 31 | 10.2% | 16.1% |
| 67 | Broadcom VMware ESXVMWare ESX Insufficient Logging | Other | CVE-2026-41709 | Oct 28 | Nov 11 | 0.3% | 0.7% |
| 67 | Plex Media ServerExternal Control of File Name or Path | Other | CVE-2026-96656 | Oct 20 | Oct 23 | 0.4% | 1.8% |
| 67 | Plex Media ServerImproper Neutralization of Encoded URI Schemes in a Web Page | Other | CVE-2026-96654 | Oct 20 | Oct 23 | 0.2% | 1.9% |
| 67 | Siemens Software CenterUncontrolled Search Path Element | Other | CVE-2026-110936 | Oct 20 | Nov 3 | 0.1% | 1.0% |
| 67 | Atlassian Multiple ProductsFiles or Directories Accessible to External Parties | Other | CVE-2026-21589 | Oct 15 | Oct 18 | 2.8% | 99.7% |
| 67 | Strapi StrapiCleartext Storage of Sensitive Information | Other | CVE-2023-22894 | Oct 8 | Oct 11 | 1.7% | 4.1% |
| 67 | ISC BINDData Processing Errors | Other | CVE-2015-5477 | Oct 8 | Oct 11 | 91.3% | 99.6% |
What do you run?
Your threat forecast.
Pick the technologies you run on the home page and both lists narrow to what applies to you, with the Cycurion tool that handles each finding.
The pace
October ran above the monthly average.
CISA added 36 vulnerabilities to its catalog in October. The count for 2026 stands at 284, already past the 245 in all of 2025.
- 1,768vulnerabilities in the catalog
- 400,564vulnerabilities carrying a public score
Added to the CISA catalog, by month
View as a table
| Month | Added |
|---|---|
| October 2025 | 31 |
| November 2025 | 11 |
| December 2025 | 20 |
| January 2026 | 17 |
| February 2026 | 28 |
| March 2026 | 26 |
| April 2026 | 31 |
| May 2026 | 21 |
| June 2026 | 23 |
| July 2026 | 26 |
| August 2026 | 31 |
| September 2026 | 43 |
| October 2026 | 36 |
Method
How the forecast is built.
How likely is it?
Confirmed exploitation counts as certain. Otherwise, the probability of exploitation in the next 30 days.
How bad is it?
A weight for what the attacker gains, from the threat-vector logic in Cycurion Panoptic.
0 to 100
What to deal with first.
- ×1.5Ransomware-linked
- ×1.4Code execution
- ×1.3Privilege escalation
- ×1.3Data exposure
- ×1.0Other
1. Likelihood, when confirmed
If the vulnerability is in the CISA Known Exploited Vulnerabilities catalog, exploitation is a fact, and likelihood is 1.0. CISA adds a vulnerability when there is reliable evidence it is being used in real attacks.
1. Likelihood, when not confirmed
Otherwise, the FIRST EPSS probability: the estimated chance of exploitation activity in the next 30 days, from 0 to 100%.
2. Impact
A weight for what the attacker gains, read from the weakness type recorded for each vulnerability: ransomware-linked 1.5, code execution 1.4, privilege escalation and data exposure 1.3, everything else 1.0.
3. Cycurion Priority
Likelihood multiplied by the impact weight, divided by the top weight of 1.5, times 100. The most damaging confirmed attack scores 100. Higher means deal with it first.
Linksys E4200
96.2%likelihood×1.4code execution÷1.5top weight×100=89.7
Not confirmed yet, so the public probability stands in for likelihood. Code execution hands an attacker the system, so the weight is 1.4. A 89.7 means: deal with this before almost anything else on the watchlist.
WordPress WordPress Core
1.0confirmed×1.4code execution÷1.5top weight×100=93
CISA confirmed it on November 3, so likelihood is certain. Every confirmed code execution flaw scores 93; a confirmed ransomware-linked one would score 100.
Confirmed exploitation from the CISA Known Exploited Vulnerabilities catalog, version 2026.11.04. Probabilities from FIRST EPSS, scores dated November 5, 2026.
Predict. Protect. Prevail.
This is everyone's forecast. Get yours.
Fathom runs the same question against your own assets, identities and telemetry.