Threat forecast · Thu 05 Nov 2026

What attackers are using, and what is next.

Two lists, updated every morning from public exploit data: the vulnerabilities confirmed as exploited in the wild, and the ones most likely to be exploited in the next 30 days.

Likely nextAlready exploitedHow it is built
34vulnerabilities confirmed exploited in the last 30 days
36added to the CISA catalog in October, against a monthly average of 26 over the year before
26came with a three-day fix deadline for federal agencies
4,382known vulnerabilities carry a better than even chance of exploitation in the next 30 days

Watchlist

Likely next.

Fourteen vulnerabilities with a better than 70% public probability of exploitation in the next 30 days, ranked by Cycurion Priority. None is in the CISA catalog yet.

Public probability0 to 100%The FIRST EPSS estimate of the chance a vulnerability sees exploitation activity in the next 30 days. It knows the vulnerability, not your environment.
Cycurion Priority0 to 100Likelihood multiplied by what the attacker would gain, scaled so the most damaging confirmed attack scores 100. Higher means deal with it first.
89.7Linksys E4200OS Command Injection96.2%probability

CVE-2025-34037 · Code execution ×1.4

#3 on probability+3.4 pts, 30 days

92.8% chance thirty days ago, 96.2% today.

87.8LinuxOut-of-Bounds Write94.1%probability

CVE-2026-43500 · Code execution ×1.4

#4 on probability+91.9 pts, 30 days

2.3% chance thirty days ago, 94.1% today.

86.6Microsoft SharePoint Enterprise Server 2016Improper Authentication99.9%probability

CVE-2025-53771 · Data exposure ×1.3

#1 on probabilitysteady, 30 days

99.8% chance thirty days ago, 99.9% today.

86.0Vercel next.jsImproper Authorization99.2%probability

CVE-2025-29927 · Data exposure ×1.3

#2 on probabilitysteady, 30 days

99.2% chance thirty days ago, 99.2% today.

80.7FlowiseAI FlowiseCode Injection86.5%probability

CVE-2025-59528 · Code execution ×1.4

#7 on probabilitysteady, 30 days

86.2% chance thirty days ago, 86.5% today.

79.7Shenzhen Aitemi E Commerce Co. Ltd. M300 Wi-Fi RepeaterOS Command Injection85.3%probability

CVE-2025-34152 · Code execution ×1.4

#9 on probability-1.5 pts, 30 days

86.8% chance thirty days ago, 85.4% today.

78.7Invisioncommunity Invision Power BoardTemplate Injection84.3%probability

CVE-2025-47916 · Code execution ×1.4

#10 on probability+0.7 pts, 30 days

83.6% chance thirty days ago, 84.3% today.

77.2Apache Software Foundation Apache Tika coreXML External Entity89.0%probability

CVE-2025-66516 · Data exposure ×1.3

#5 on probabilitysteady, 30 days

89.0% chance thirty days ago, 89.0% today.

77.1redisUse-After-Free82.6%probability

CVE-2025-49844 · Code execution ×1.4

#11 on probabilitysteady, 30 days

82.3% chance thirty days ago, 82.6% today.

75.8Sawtooth Software Lighthouse StudioTemplate Injection81.3%probability

CVE-2025-34300 · Code execution ×1.4

#12 on probability+1.2 pts, 30 days

80.0% chance thirty days ago, 81.3% today.

75.2Glpi-project glpiSQL Injection86.8%probability

CVE-2025-24799 · Data exposure ×1.3

#6 on probabilitysteady, 30 days

86.7% chance thirty days ago, 86.8% today.

74.3Microsoft Windows Server 2012Stack-Based Buffer Overflow79.6%probability

CVE-2026-41089 · Code execution ×1.4

#13 on probability+78.6 pts, 30 days

1.0% chance thirty days ago, 79.6% today.

74.1xwiki-platformSQL Injection85.5%probability

CVE-2025-32429 · Data exposure ×1.3

#8 on probability-1.6 pts, 30 days

87.1% chance thirty days ago, 85.5% today.

73.2Palo Alto Networks Cloud NGFWOS Command Injection78.4%probability

CVE-2025-0107 · Code execution ×1.4

#14 on probabilitysteady, 30 days

78.5% chance thirty days ago, 78.4% today.

The highest-probability vulnerabilities with a CVE from 2025 or later that CISA has not yet confirmed as exploited. Tap one for its 30-day trend.

Confirmed in the last 30 days

Already being exploited.

34 vulnerabilities CISA has confirmed as exploited in the wild in the last 30 days, ranked by Cycurion Priority, with the date federal agencies must have them fixed. 12 give an attacker code execution.

93WordPress WordPress CoreTime-of-check Time-of-use (TOCTOU) Race ConditionNov 3

Code execution · CVE-2026-119977 · fix by Nov 6

Public probability before CISA confirmation0.6%
Public probability today1.2%
  • Panoptic shows whether your assets have it and verifies the fix
  • Habit catches it in use and contains it
93GitLab Community Edition and Enterprise EditionInteger Overflow or WraparoundOct 29

Code execution · CVE-2026-97229 · fix by Nov 1

Public probability before CISA confirmation18.4%
Public probability today65.2%
  • Panoptic shows whether your assets have it and verifies the fix
  • Habit catches it in use and contains it
93Adobe Commerce and MagentoUnrestricted Upload of File with Dangerous TypeOct 27

Code execution · CVE-2026-48356 · fix by Nov 10

Public probability before CISA confirmation1.0%
Public probability today47.5%
  • Panoptic shows whether your assets have it and verifies the fix
  • Habit catches it in use and contains it
93Google BrotliUnchecked Return ValueOct 27

Code execution · CVE-2026-111497 · fix by Nov 10

Public probability before CISA confirmation36.0%
Public probability today82.6%
  • Panoptic shows whether your assets have it and verifies the fix
  • Habit catches it in use and contains it
93PHP Group PHPStale Internal Request-StateOct 26

Code execution · CVE-2026-109619 · fix by Oct 29

Public probability before CISA confirmation100.0%
Public probability today100.0%
  • Panoptic shows whether your assets have it and verifies the fix
  • Habit catches it in use and contains it
93PHP Group PHPMemory CorruptionOct 26

Code execution · CVE-2026-109618 · fix by Oct 29

Public probability before CISA confirmation100.0%
Public probability today100.0%
  • Panoptic shows whether your assets have it and verifies the fix
  • Habit catches it in use and contains it
93Collabora Collabora Online - Built-in CODE ServerOS Command InjectionOct 23

Code execution · CVE-2026-110447 · fix by Oct 26

Public probability before CISA confirmation1.2%
Public probability today73.3%
  • Panoptic shows whether your assets have it and verifies the fix
  • Habit catches it in use and contains it
93EG Secure Solutions SiteGuard Server EditionOS Command InjectionOct 20

Code execution · CVE-2026-106931 · fix by Oct 23

Public probability before CISA confirmation0.7%
Public probability today2.5%
  • Panoptic shows whether your assets have it and verifies the fix
  • Habit catches it in use and contains it
93Ahsay AhsayCBSCommand InjectionOct 14

Code execution · CVE-2026-105134 · fix by Oct 17

Public probability before CISA confirmation1.8%
Public probability today81.8%
  • Panoptic shows whether your assets have it and verifies the fix
  • Habit catches it in use and contains it
93Palo Alto Networks PAN-OSCode InjectionOct 14

Code execution · CVE-2026-0322 · fix by Oct 17

Public probability before CISA confirmationNo score
Public probability today1.7%
  • Panoptic shows whether your assets have it and verifies the fix
  • Habit catches it in use and contains it

What Cycurion does with these lists

Panopticfinds it in your environment and verifies the fixHabitcatches it in use and contains itFathommodels the attack path through it and gives you time to act

What do you run?

Your threat forecast.

Pick the technologies you run and both lists narrow to what applies to you, with the Cycurion tool that handles each finding.

Build your forecast

The pace

October ran above the monthly average.

CISA added 36 vulnerabilities to its catalog in October. The count for 2026 stands at 284, already past the 245 in all of 2025.

31
11
20
17
28
26
31
21
23
26
31
43
36
ONDJFMAMJJASO

Added to the CISA catalog, by month. Oct 2025 to Oct 2026

1,768vulnerabilities in the catalog
400,564vulnerabilities carrying a public score

Method

How the forecast is built.

LikelihoodHow likely is it?
×
ImpactHow bad is it?
=
Priority0 to 100. What to deal with first.
Likelihood, when confirmedIf the vulnerability is in the CISA Known Exploited Vulnerabilities catalog, exploitation is a fact, and likelihood is 1.0.
Likelihood, when not confirmedThe FIRST EPSS probability: the estimated chance of exploitation activity in the next 30 days.
ImpactA weight for what the attacker gains, read from the weakness type recorded for each vulnerability.
×1.5Ransomware-linked×1.4Code execution×1.3Privilege escalation×1.3Data exposure×1.0Other

Cycurion Priority is likelihood times the impact weight, divided by the top weight of 1.5, times 100.

Worked example · likely next

Linksys E4200

96.2% × 1.4 ÷ 1.5 × 100 = 89.7

Not confirmed yet, so the public probability stands in for likelihood. Code execution hands an attacker the system, so the weight is 1.4.

Worked example · confirmed

WordPress WordPress Core

1.0 × 1.4 ÷ 1.5 × 100 = 93

CISA confirmed it on November 3, so likelihood is certain. Every confirmed code execution flaw scores 93; a confirmed ransomware-linked one would score 100.

Confirmed exploitation from the CISA Known Exploited Vulnerabilities catalog, version 2026.11.04. Probabilities from FIRST EPSS, scores dated November 5, 2026.

Predict. Protect. Prevail.

This is everyone’s forecast. Get yours.

Fathom runs the same question against your own assets, identities and telemetry.

Book a demo Explore Cycurion Fathom
Book a demo