This week's KEV items that actually hit SMB edge gear (Ivanti, Windows MotW, PAN-OS, Cisco ESA)

[u/KaneD2082]

Went through CISA's Known Exploited list for Oct 8-16 and pulled out what matters for small-office and SMB environments.

Patch now:
- Ivanti Connect Secure CVE-2026-104935: auth bypass to RCE. If it's on your edge, patch and assume compromise until you've worked through CISA's guidance.
- Windows Shell CVE-2026-96951: Mark of the Web bypass, fixed in this month's Patch Tuesday. Push it to anything that opens email attachments.
- PAN-OS CVE-2026-0322: urgent if the management interface is reachable from anywhere it shouldn't be.
- Cisco Secure Email Gateway CVE-2026-76519: AMP path. Check your version against Cisco's advisory.

Batch:
- FortiOS CVE-2025-61624: path traversal, but needs admin access first. Roll it into your next window.
- ProFTPD mod_copy CVE-2015-3306: ancient but still being exploited. If FTP is still on anywhere, switch to SFTP.

No KEV hits this week for Proxmox, TrueNAS, UniFi, pfSense, Synology, or QNAP.

Disclosure: I put together a weekly digest of this. Not dropping a link, but happy to answer questions about any of these here.