--- title: October 2026 CVE Landscape | daily.dev description: Insikt Group identified 82 high-impact vulnerabilities worth prioritizing in October, 52 rated Very Critical, a 13% drop from the prior month. Longlegs... canonical: https://daily.dev/posts/october-2026-cve-landscape-ktrcyt7c5 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: October 2026 CVE Landscape | daily.dev og:description: Insikt Group identified 82 high-impact vulnerabilities worth prioritizing in October, 52 rated Very Critical, a 13% drop from the prior month. Longlegs... og:url: https://daily.dev/posts/october-2026-cve-landscape-ktrcyt7c5 og:image: https://api.daily.dev/og/posts/ktrcyT7c5.png og:image:alt: October 2026 CVE Landscape og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # October 2026 CVE Landscape **[Recorded Future Blog](https://daily.dev/sources/recorded-future-blog)** · 3 min read · 0 upvotes · 0 comments ## Summary Insikt Group identified 82 high-impact vulnerabilities worth prioritizing in October, 52 rated Very Critical, a 13% drop from the prior month. Longlegs (Storm-2603) exploited four SharePoint Server CVEs (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771) via the ToolShell chain to hit critical infrastructure and deploy Warlock ransomware, Symantec reported. Exploitation of a PAN-OS flaw (CVE-2026-0257) was linked to Qilin, Settra, and Tarnished Scorpius, with reporting describing use of BloodHound and SharpHound. CL-STA-0954 exploited FortiManager and FortiOS CVEs, stealing data tied to over 500 FortiGate firewalls and deploying PEERSTITCH, per Unit 42. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What CVEs did the Storm-2603 group exploit in the SharePoint ToolShell attacks? Storm-2603, also tracked as Longlegs, exploited CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771, all affecting SharePoint Server. Using the ToolShell exploit chain, the actor accessed critical infrastructure organizations, moved laterally, disabled endpoint protections, and deployed Warlock ransomware by staging binaries in a domain replication path to propagate them across domain controllers. _Track emerging SharePoint exploitation activity and ransomware chains like this one on daily.dev._ ### What vulnerabilities did CL-STA-0954 exploit in Fortinet products? CL-STA-0954 exploited CVE-2024-47575 in FortiManager and CVE-2025-61624 in FortiOS. According to Unit 42, the attacker executed commands, stole sensitive data tied to over 500 managed FortiGate firewalls, intercepted traffic, and deployed malware called PEERSTITCH. _Security teams patching Fortinet gear can follow exploitation reports like this on daily.dev._ ### Which ransomware groups are linked to the PAN-OS vulnerability CVE-2026-0257? CVE-2026-0257, a PAN-OS vulnerability, has been linked to exploitation by Qilin, Settra, and Tarnished Scorpius, which overlaps with activity tracked as INC Ransom. The attackers used BloodHound and SharpHound tooling to map Active Directory relationships during these intrusions. _Teams prioritizing PAN-OS patches can keep tabs on active exploitation trends via daily.dev._ ## Similar posts on daily.dev - [September 2026 CVE Landscape](https://daily.dev/posts/september-2026-cve-landscape-7rqel5aap) · Recorded Future Blog · 0 upvotes · 0 comments - [July 2026 CVE Landscape](https://daily.dev/posts/july-2026-cve-landscape-iupqvq66f) · Recorded Future Blog · 0 upvotes · 0 comments - [The vulnerability landscape in Q1 2026](https://daily.dev/posts/the-vulnerability-landscape-in-q1-2026-nw1rzlyy2) · Securelist · 0 upvotes · 0 comments - [Security briefing: October 2026](https://daily.dev/posts/security-briefing-october-2026-uxnqjrxgv) · Sysdig Blog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ransomware](https://daily.dev/tags/ransomware), [#active-directory](https://daily.dev/tags/active-directory), [#sharepoint](https://daily.dev/tags/sharepoint) [View this post on daily.dev](https://daily.dev/posts/october-2026-cve-landscape-ktrcyt7c5) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"October 2026 CVE Landscape","url":"https://daily.dev/posts/october-2026-cve-landscape-ktrcyt7c5","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/october-2026-cve-landscape-ktrcyt7c5"},"datePublished":"2026-11-06T18:27:43.511Z","dateModified":"2026-11-06T18:37:01.657Z","description":"Insikt Group identified 82 high-impact vulnerabilities worth prioritizing in October, 52 rated Very Critical, a 13% drop from the prior month. Longlegs...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0e9c4f49a56dfbd6c1d9497614d83dc5?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0e9c4f49a56dfbd6c1d9497614d83dc5?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Recorded Future Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Recorded Future Blog","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/recorded-future-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/october-2026-cve-landscape-ktrcyt7c5","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ransomware,active-directory,sharepoint","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Recorded Future Blog","item":"https://daily.dev/sources/recorded-future-blog"},{"@type":"ListItem","position":3,"name":"October 2026 CVE Landscape"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/october-2026-cve-landscape-ktrcyt7c5#faq","mainEntity":[{"@type":"Question","name":"What CVEs did the Storm-2603 group exploit in the SharePoint ToolShell attacks?","acceptedAnswer":{"@type":"Answer","text":"Storm-2603, also tracked as Longlegs, exploited CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771, all affecting SharePoint Server. Using the ToolShell exploit chain, the actor accessed critical infrastructure organizations, moved laterally, disabled endpoint protections, and deployed Warlock ransomware by staging binaries in a domain replication path to propagate them across domain controllers. Track emerging SharePoint exploitation activity and ransomware chains like this one on daily.dev."}},{"@type":"Question","name":"What vulnerabilities did CL-STA-0954 exploit in Fortinet products?","acceptedAnswer":{"@type":"Answer","text":"CL-STA-0954 exploited CVE-2024-47575 in FortiManager and CVE-2025-61624 in FortiOS. According to Unit 42, the attacker executed commands, stole sensitive data tied to over 500 managed FortiGate firewalls, intercepted traffic, and deployed malware called PEERSTITCH. Security teams patching Fortinet gear can follow exploitation reports like this on daily.dev."}},{"@type":"Question","name":"Which ransomware groups are linked to the PAN-OS vulnerability CVE-2026-0257?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-0257, a PAN-OS vulnerability, has been linked to exploitation by Qilin, Settra, and Tarnished Scorpius, which overlaps with activity tracked as INC Ransom. The attackers used BloodHound and SharpHound tooling to map Active Directory relationships during these intrusions. Teams prioritizing PAN-OS patches can keep tabs on active exploitation trends via daily.dev."}}]} ```