I’ve been through CISA's Known Exploited list for Oct 8-16 and pulled out what matters for small-office and SMB environments.

Patch now: \- Ivanti Connect Secure CVE-2026-104935: auth bypass to RCE. If it's on your edge, patch and assume compromise until you've worked through CISA's guidance. \- Windows Shell CVE-2026-96951: Mark of the Web bypass, fixed in this month's Patch Tuesday. Push it to anything that opens email attachments. \- PAN-OS CVE-2026-0322: urgent if the management interface is reachable from anywhere it shouldn't be. \- Cisco Secure Email Gateway CVE-2026-76519: AMP path. Check your version against Cisco's advisory.

Batch: \- FortiOS CVE-2025-61624: path traversal, but needs admin access first. Roll it into your next window. \- ProFTPD mod\copy CVE-2015-3306: ancient but still being exploited. If FTP is still on anywhere, switch to SFTP.

No KEV hits this week for Proxmox, TrueNAS, UniFi, pfSense, Synology, or QNAP.

Disclosure: I put together a weekly digest of this. Not dropping a link, but happy to answer questions about any of these here.