30 security flaws were added in the last 30 days to the federal list of vulnerabilities attackers are actually using, 5 of them this week. The list is CISA's Known Exploited Vulnerabilities catalog (1,739 entries in all); federal agencies must patch everything on it by a deadline. For a small business or a medical office, it's the shortest honest answer to "which updates do I do first?"
4 of this month's additions are flaws five or more years old, newly confirmed as exploited. Old routers, old servers and old software that never got updated are exactly what they're hitting.
Grouped below by where you'd actually have the thing. If you see something you run, update it today; if there's no update, check the vendor's advice or unplug it from the internet.
On your computers, phones and office software (3)
| What | Added | Details |
|---|---|---|
| Apple Multiple Products Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution. | Sep 29 | CVE-2026-86950 |
| Microsoft SharePoint Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network. | Sep 25 | CVE-2026-65660 |
| Google Pixel Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges. | Sep 16 | CVE-2026-58704 |
Your router, firewall, VPN or file server (13)
| What | Added | Details |
|---|---|---|
| Citrix NetScaler Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a de... | Oct 4 | CVE-2026-88779 |
| Fortinet FortiMail Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via cr... | Oct 1 | CVE-2026-104286 |
| Cisco Catalyst SD-WAN Manager Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI enco... | Sep 30 | CVE-2026-76504 |
| Citrix NetScaler Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service | Sep 27 | CVE-2026-88772 |
| Citrix NetScaler Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands. | Sep 27 | CVE-2026-88771 |
| MikroTik RouterOS Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to ... | Sep 25 | CVE-2026-67279 |
| F5 BIG-IP APM F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote c... | Sep 22 | CVE-2026-94127 |
| Arista VeloCloud Orchestrator Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitatio... | Sep 22 | CVE-2026-93952 |
| Check Point Multiple Products Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to uploa... | Sep 22 | CVE-2026-93616 |
| Check Point Multiple Products Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to exe... | Sep 22 | CVE-2026-85102 |
| Zyxel GS1900 Series Switches Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a cr... | Sep 21 | CVE-2026-7273 |
| Cisco Identity Services Engine Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized ... | Sep 16 | CVE-2026-76460 |
| Cisco Secure Email Gateway Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying... | Sep 14 | CVE-2026-76461 |
Remote-support, IT-management and backup tools (1)
| What | Added | Details |
|---|---|---|
| Acronis Backup Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation. | Sep 16 | CVE-2026-87886 |
Your website, web apps and servers (11)
| What | Added | Details |
|---|---|---|
| Strapi Strapi Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could ... | Oct 8 | CVE-2023-22894 |
| ONLYOFFICE Docs ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution. | Oct 8 | CVE-2021-3199 |
| Apache Struts Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled. | Oct 8 | CVE-2016-3081 |
| ISC BIND ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries. | Oct 8 | CVE-2015-5477 |
| ProFTPD ProFTPD ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. | Oct 8 | CVE-2015-3306 |
| WordPress Core WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directorie... | Sep 25 | CVE-2026-87902 |
| Adobe Commerce and Magento Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction. | Sep 24 | CVE-2026-71362 |
| WSO2 Multiple Products WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution. | Sep 24 | CVE-2026-5430 |
| Linux Kernel Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-impo... | Sep 18 | CVE-2026-53266 |
| Linux Kernel Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state. | Sep 18 | CVE-2025-39964 |
| Linux Kernel Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-typ... | Sep 18 | CVE-2025-39682 |
Everything else on the list (2)
| What | Added | Details |
|---|---|---|
| Zammad GmbH Zammad Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489. | Oct 2 | CVE-2026-102490 |
| Zammad GmbH Zammad Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490. | Oct 2 | CVE-2026-102489 |
Doing it without an IT department
- Turn on automatic updates on every computer, phone and browser, and restart when they ask. Most of the first group is fixed that way.
- Check the router and firewall. They don't update themselves unless you set them to, and they're the most common entry point on this list. Log into the admin page or the vendor's app and install the latest firmware.
- If you have remote-support or backup software an IT company installed, ask them whether it's on this list and patched.
- Retire what can't be patched. Equipment past its end of support stays vulnerable.
Medical, dental and therapy offices: HIPAA's Security Rule makes a risk analysis Required, "an accurate and thorough assessment of the potential risks and vulnerabilities" to electronic patient information, along with risk management: "security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level" (45 CFR 164.308). A known-exploited flaw on an office computer or firewall is exactly the kind of risk that review should catch. This page is a checklist, not legal or compliance advice.
Want a second set of hands?
PJ goes through your office's computers, phones, router and software against this list and gets them updated. Tech help, $100 an hour, Solana Beach to Encinitas, or remote. Text PJ
Source: CISA, Known Exploited Vulnerabilities catalog (version 2026.10.08), details from NIST's National Vulnerability Database; 45 CFR 164.308 on eCFR. Rebuilt every morning; checked October 13, 2026. More: the free public data behind SideGuy.
Need a human?
This page is built every morning from public data by SideGuy, run by PJ, a local in Solana Beach. If something looks off, or you want a hand with your plans, text PJ at 858-461-8054. A real person answers.
Local help, free to read: make your fix plan · senior benefits checkup · lower your SDG&E bill · Medicare Extra Help · every 2027 Medicare plan · is my medication recalled? · the next 90 days. Plans start as low as $25. Your parent lives here and you don't? The Parent Check-In Plan, $25 a month.
Questions people ask
Which security updates should a small business install first?
The ones on CISA's Known Exploited Vulnerabilities catalog: flaws attackers are using right now. 30 were added in the last 30 days, including Strapi Strapi, ONLYOFFICE Docs, Apache Struts, ISC BIND.
What is the CISA Known Exploited Vulnerabilities catalog?
CISA's list of security flaws confirmed exploited in the wild, with a deadline by which federal agencies must fix each one. Anyone can use it to decide what to patch first.
Does HIPAA require patching?
HIPAA's Security Rule makes a risk analysis and risk management Required for covered entities and business associates (45 CFR 164.308). Known-exploited flaws on systems with patient data are the kind of risk those cover.
Know someone who needs this?
Got a question about this? Ask PJ a question. A real person in Solana Beach texts you back.
Something changed here? Text PJ the fix: if it changes this page, you get $5. How it works.
Spotted something new around town? Text it in. What do you want to see here? Ask PJ for a page. No login, a real person reads it.
More free local tools: the North County toolkit.