Small Town Sysadmin: Security alertsActively exploited vulnerabilities and urgent patches for small offices.https://smalltownsysadmin.com/FreeSWITCH phone systems need version 1.11.3 now — CVE-2026-116779 is being exploitedhttps://smalltownsysadmin.com/articles/freeswitch-kev-2026-11/https://smalltownsysadmin.com/articles/freeswitch-kev-2026-11/A critical FreeSWITCH flaw that allows command execution through SIP text messages is on CISA's exploited list. Here's who is affected and what to do.Mon, 09 Nov 2026 00:00:00 GMTVMware ESX logging flaw is on CISA's exploited list: patch the whole advisory, because it also fixes critical bugshttps://smalltownsysadmin.com/articles/vmware-esx-kev-2026-10/https://smalltownsysadmin.com/articles/vmware-esx-kev-2026-10/CVE-2026-41709 is a low-severity ESX flaw, but CISA lists it as exploited. The same Broadcom advisory fixes critical vCenter and ESX flaws. Here is what to check and install.Fri, 06 Nov 2026 00:00:00 GMTUpdate WordPress to 7.1.4 or your branch's latest release: a flaw in the update process is being exploitedhttps://smalltownsysadmin.com/articles/wordpress-upgrade-window-kev-2026-11/https://smalltownsysadmin.com/articles/wordpress-upgrade-window-kev-2026-11/CISA added a WordPress core flaw to its exploited list on November 3. Sites that update normally are protected once on a fixed release, and auto-updates should deliver it.Wed, 04 Nov 2026 00:00:00 GMTCisco ASA and FTD firewalls: an exploited VPN flaw can force reboots, and the fix is a software updatehttps://smalltownsysadmin.com/articles/cisco-asa-ftd-vpn-dos-kev-2026-10/https://smalltownsysadmin.com/articles/cisco-asa-ftd-vpn-dos-kev-2026-10/CVE-2026-76418 lets an unauthenticated attacker crash Cisco ASA and FTD firewalls that use secondary authentication on the SSL VPN. It is exploited now. Here is how to check and what to install.Fri, 30 Oct 2026 00:00:00 GMTBrotli decoder flaw is being exploited: check Node.js, .NET and Linux packageshttps://smalltownsysadmin.com/articles/brotli-kev-2026-10/https://smalltownsysadmin.com/articles/brotli-kev-2026-10/CVE-2026-111497 is a critical memory flaw in the Brotli decompression library that CISA says is exploited. Here is which software carries it, which versions are fixed, and how to check.Wed, 28 Oct 2026 00:00:00 GMTPatch self-hosted Jira, Confluence, and Bitbucket: an unauthenticated file-access flaw is now on CISA's exploited listhttps://smalltownsysadmin.com/articles/atlassian-data-center-kev-2026-10/https://smalltownsysadmin.com/articles/atlassian-data-center-kev-2026-10/CVE-2026-21589 affects eight Atlassian Data Center products. CISA listed it as exploited on October 15. Here's who is affected, which versions fix it, and what to do if you can't patch yet.Fri, 23 Oct 2026 00:00:00 GMTPHP2Shell: two critical flaws in PHP itself are being attacked, and updating WordPress won't fix themhttps://smalltownsysadmin.com/articles/php2shell-php-flaws-2026-10/https://smalltownsysadmin.com/articles/php2shell-php-flaws-2026-10/Two critical flaws in the PHP runtime (CVE-2026-109618 and CVE-2026-109619) let attackers run code on web servers. Here is who is affected, what to ask your host, and what IT should patch.Wed, 21 Oct 2026 00:00:00 GMTInstall October's Windows updates: an exploited flaw lets a booby-trapped file skip Windows' safety warninghttps://smalltownsysadmin.com/articles/windows-shell-motw-bypass-kev-2026-10/https://smalltownsysadmin.com/articles/windows-shell-motw-bypass-kev-2026-10/Microsoft says attackers are already exploiting a Windows Shell flaw that bypasses Mark of the Web. Here is what that means, which updates fix it, and how to check your PCs.Mon, 19 Oct 2026 00:00:00 GMTFortinet path traversal flaw is now exploited: what to patch and who it affectshttps://smalltownsysadmin.com/articles/fortinet-path-traversal-kev-2026-10/https://smalltownsysadmin.com/articles/fortinet-path-traversal-kev-2026-10/CISA added a Fortinet path traversal flaw (CVE-2025-61624) to its exploited list on October 16. It needs an admin login, but 7.2, 7.0 and 6.4 FortiOS have no fix.Sat, 17 Oct 2026 00:00:00 GMTPatch BeyondTrust Remote Support now: an exploited flaw let attackers act on the appliance, and patching alone may not be enoughhttps://smalltownsysadmin.com/articles/beyondtrust-remote-support-kev-2026-10/https://smalltownsysadmin.com/articles/beyondtrust-remote-support-kev-2026-10/CISA added a critical BeyondTrust Remote Support flaw on October 16 with a three-day deadline. Self-hosted servers need the BT26-05 patch, and exposed ones should be checked for compromise.Fri, 16 Oct 2026 00:00:00 GMTPatch AhsayCBS backup servers again: two chained flaws are being exploited, and the first patches weren't enoughhttps://smalltownsysadmin.com/articles/ahsaycbs-kev-2026-10/https://smalltownsysadmin.com/articles/ahsaycbs-kev-2026-10/CISA added two AhsayCBS flaws to its exploited list on October 14. Ahsay says earlier patches did not fully fix them. Here is which hotfix to apply, who can get it, and what to check.Thu, 15 Oct 2026 00:00:00 GMTPatch Palo Alto PAN-OS and Panorama: an exploited flaw gives logged-in attackers root, and there is no workaroundhttps://smalltownsysadmin.com/articles/palo-alto-panos-kev-2026-10/https://smalltownsysadmin.com/articles/palo-alto-panos-kev-2026-10/CISA added PAN-OS CVE-2026-0322 to its exploited list on October 14. Here are the fixed versions, the limited mitigation, and the one thing that shrinks your risk today.Wed, 14 Oct 2026 00:00:00 GMTPatch Ivanti Connect Secure now: a zero-day login bypass is being exploited, and the integrity checker won't catch ithttps://smalltownsysadmin.com/articles/ivanti-connect-secure-kev-2026-10/https://smalltownsysadmin.com/articles/ivanti-connect-secure-kev-2026-10/CISA added an exploited Ivanti Connect Secure authentication bypass on October 13, 2026. Here is who is affected, what to do today, and how to respond if the VPN may already be compromised.Tue, 13 Oct 2026 00:00:00 GMTUpdate iPhones, iPads, and Macs now: Apple fixed an exploited flaw in how images and files are processedhttps://smalltownsysadmin.com/articles/apple-coregraphics-kev-2026-10/https://smalltownsysadmin.com/articles/apple-coregraphics-kev-2026-10/Apple patched a flaw it says was exploited in a targeted attack, and CISA lists it as exploited. Here is who needs to update, to which version, and how.Thu, 08 Oct 2026 00:00:00 GMTPatch Cisco Secure Email Gateway: an exploited flaw gives attackers root, and there is no workaroundhttps://smalltownsysadmin.com/articles/cisco-secure-email-gateway-kev-2026-09/https://smalltownsysadmin.com/articles/cisco-secure-email-gateway-kev-2026-09/A critical SQL injection flaw in Cisco Secure Email Gateway is being exploited. Here are the fixed releases, who is affected, and how to check your mail logs.Wed, 07 Oct 2026 00:00:00 GMTZammad helpdesk flaws are being exploited: check your version and who can reach ithttps://smalltownsysadmin.com/articles/zammad-kev-2026-10/https://smalltownsysadmin.com/articles/zammad-kev-2026-10/CISA added two Zammad flaws to its exploited list on October 2. Versions 6.5 and older are the exposed ones, and the second flaw has no vendor fix yet. Here's how to check and what to do.Mon, 05 Oct 2026 00:00:00 GMTPatch Citrix NetScaler again: a SAML flaw is being exploited, even if you patched last weekhttps://smalltownsysadmin.com/articles/citrix-netscaler-saml-kev-2026-10/https://smalltownsysadmin.com/articles/citrix-netscaler-saml-kev-2026-10/CISA added CVE-2026-88779 on October 4. It hits NetScaler Gateways and ADCs doing SAML sign-in, and the September fixes don't cover it. Here's who's affected and which builds fix it.Sun, 04 Oct 2026 00:00:00 GMTPatch Cisco Catalyst SD-WAN Manager: an exploited login bypass with no workaroundhttps://smalltownsysadmin.com/articles/cisco-sdwan-manager-kev-2026-09/https://smalltownsysadmin.com/articles/cisco-sdwan-manager-kev-2026-09/CISA added a critical Cisco SD-WAN Manager flaw to its exploited list on September 30 with a three-day deadline. Here are the fixed releases and how to check your logs.Fri, 02 Oct 2026 00:00:00 GMTPatch FortiMail now: an exploited path traversal flaw, rated 9.8https://smalltownsysadmin.com/articles/fortimail-kev-2026-10/https://smalltownsysadmin.com/articles/fortimail-kev-2026-10/CISA added a FortiMail flaw to its exploited list on October 1 with a three-day deadline. Here are the fixed versions, the workaround, and what to check if you can't patch today.Thu, 01 Oct 2026 00:00:00 GMTPatch on-premises SharePoint: a code-execution flaw fixed in August is now being exploitedhttps://smalltownsysadmin.com/articles/sharepoint-server-kev-2026-09/https://smalltownsysadmin.com/articles/sharepoint-server-kev-2026-09/CISA added a Microsoft SharePoint Server flaw (CVE-2026-65660) to its exploited list on September 25. Microsoft fixed it in August. Here's which builds are safe and how to check yours.Wed, 30 Sep 2026 00:00:00 GMTPatch Check Point gateways and management servers: two flaws are being exploitedhttps://smalltownsysadmin.com/articles/check-point-kev-2026-09/https://smalltownsysadmin.com/articles/check-point-kev-2026-09/CISA added two critical Check Point flaws on September 22, one in VPN gateways and one in management servers. LivePatch covers the VPN flaw but not the management server flaw.Mon, 28 Sep 2026 00:00:00 GMTPatch Citrix NetScaler now: two flaws are being exploitedhttps://smalltownsysadmin.com/articles/citrix-netscaler-kev-2026-09/https://smalltownsysadmin.com/articles/citrix-netscaler-kev-2026-09/CISA added two NetScaler ADC and Gateway flaws to its exploited-vulnerabilities list with a September 30 deadline. One affects every deployment, even default configurations. Here's what to patch.Mon, 28 Sep 2026 00:00:00 GMTPatch FortiGate firewalls: an exploited FortiOS flaw, and no fix for 6.4https://smalltownsysadmin.com/articles/fortinet-fortios-kev-2026-09/https://smalltownsysadmin.com/articles/fortinet-fortios-kev-2026-09/CISA added a FortiOS heap overflow to its exploited list on September 9. Here are the fixed versions, a workaround if you can't upgrade yet, and why FortiOS 6.4 needs to go.Mon, 28 Sep 2026 00:00:00 GMTPatch MikroTik RouterOS now: attackers are taking over routers through SSHhttps://smalltownsysadmin.com/articles/mikrotik-routeros-kev-2026-09/https://smalltownsysadmin.com/articles/mikrotik-routeros-kev-2026-09/CISA lists three exploited RouterOS flaws from September, and CERT Polska says attacks began by September 2. Here are the fixed versions and how to check for compromise.Mon, 28 Sep 2026 00:00:00 GMTPatch N-able N-central to 2026.3 Hotfix 4: pre-authentication code executionhttps://smalltownsysadmin.com/articles/n-central-kev-2026-09/https://smalltownsysadmin.com/articles/n-central-kev-2026-09/A critical flaw can let an attacker run code on an on-premises N-central server without logging in. CISA added it to its exploited list on September 8. Hosted customers are already patched.Mon, 28 Sep 2026 00:00:00 GMTUpdate ConnectWise ScreenConnect to 26.6.5: an exploited flaw lets files run on remote PCshttps://smalltownsysadmin.com/articles/screenconnect-kev-2026-09/https://smalltownsysadmin.com/articles/screenconnect-kev-2026-09/CISA added a ScreenConnect client flaw to its exploited list on September 11. Cloud instances are updated, but on-premises servers need 26.6.5 and every host client needs reinstalling.Mon, 28 Sep 2026 00:00:00 GMTTwo Windows flaws from September Patch Tuesday are being exploitedhttps://smalltownsysadmin.com/articles/windows-exploited-september-2026/https://smalltownsysadmin.com/articles/windows-exploited-september-2026/Microsoft confirmed attacks using two Windows privilege-escalation flaws fixed on September 8. If your September updates aren't installed yet, install them now.Mon, 28 Sep 2026 00:00:00 GMTUpdate WordPress now: a critical flaw is being exploitedhttps://smalltownsysadmin.com/articles/wordpress-core-kev-2026-09/https://smalltownsysadmin.com/articles/wordpress-core-kev-2026-09/If your business website runs on WordPress, make sure it has updated to 7.1.2 or a patched older release. CISA added the flaw to its exploited list on September 25.Mon, 28 Sep 2026 00:00:00 GMTUpdate Zyxel GS1900 switches: an exploited flaw lets attackers on your network take overhttps://smalltownsysadmin.com/articles/zyxel-gs1900-kev-2026-09/https://smalltownsysadmin.com/articles/zyxel-gs1900-kev-2026-09/CISA added a Zyxel GS1900 switch flaw to its exploited list on September 21. It's reachable from inside your network, not the internet, but it's being used. Here's the firmware for each model.Mon, 28 Sep 2026 00:00:00 GMTIf you manage Cisco firewalls through an on-prem FMC, patch it nowhttps://smalltownsysadmin.com/articles/cisco-fmc-authbypass-kev-2026-09/https://smalltownsysadmin.com/articles/cisco-fmc-authbypass-kev-2026-09/A critical, unauthenticated flaw in Cisco Secure Firewall Management Center gives root access with no login. It's under active exploitation and in CISA's KEV catalog.Sun, 27 Sep 2026 00:00:00 GMTPatch SonicWall SMA1000 now — two exploited flaws chain to remote code executionhttps://smalltownsysadmin.com/articles/sonicwall-sma1000-kev-2026-09/https://smalltownsysadmin.com/articles/sonicwall-sma1000-kev-2026-09/A critical, unauthenticated SSRF and a command injection bug in SonicWall SMA1000 are being chained for remote code execution. What's affected and what to do today.Sat, 26 Sep 2026 00:00:00 GMTPatch Sangoma Switchvox now — an unauthenticated flaw is being exploitedhttps://smalltownsysadmin.com/articles/switchvox-sqli-rce-2026-09/https://smalltownsysadmin.com/articles/switchvox-sqli-rce-2026-09/A critical, unauthenticated SQL injection in Switchvox SMB is being actively exploited to plant reverse shells. Here's what's affected and what to do today.Fri, 25 Sep 2026 00:00:00 GMT