CISA KEV list: week adds 10 exploited CVEs, four on listed-vendor products

CISA added 10 known-exploited vulnerabilities to its Known Exploited Vulnerabilities catalog between October 26 and November 2. That is a week above the catalog's recent run-rate of roughly seven to eight additions, and the composition matters more than the count. Four of the ten entries sit on products sold by publicly traded vendors: Cisco's Adaptive Security Appliance and Firepower Threat Defense, Broadcom's VMware ESXi hypervisor, Adobe's Commerce and Magento commerce platform, and Google's Brotli compression library.

The numbers frame the cadence. October closed with 36 additions, down from September's 43, which was the catalog's heaviest month in more than a year. But compared with a year earlier October is up sharply: 36 entries against 31 in October 2025, about 16 percent higher. Over the trailing twelve months the catalog has added 344 exploited vulnerabilities. The week of November 2 is not a record, but it did run hotter than the pace implied by the monthly totals, and it clustered the entries onto vendor products that sit inside corporate networks.

Related reading: Ivanti Connect Secure: CISA adds two exploited CVEs, Nov 2 patch deadline nears.

The four listed-vendor entries are the week's market-relevant read. Cisco's Secure Firewall ASA Software and Cisco Secure FTD Software (CVE-2026-76418) was added October 29 with a federal due date of November 1, an unusually tight window that made any agency running the gear effectively a same-week patching obligation. Broadcom's VMware ESX (CVE-2026-41709) arrived October 28 with a November 11 deadline, giving enterprises two weeks. Adobe's Commerce and Magento (CVE-2026-48356) and Google's Brotli (CVE-2026-111497) both landed October 27, each due by November 10. The same window carried GitLab and Ivanti Connect Secure entries that have drawn their own coverage; those five CVEs, plus the Cisco, Broadcom, Adobe and Google items, mean the catalogue asked a lot of patch teams in a single week.

For readers of this desk, the immediate read is operational rather than speculative. None of these entries is by itself a stock catalyst for a business the size of Cisco or Google. What they are is a deadline clock for the enterprises that run the products, and that clock hits twice more this month: the Adobe and Broadcom deadlines, November 10 and November 11, fall within days of each other. An unpatched instance past those dates is, under common cyber insurance policy language, harder to claim under and more likely to be a named exclusion. The supply chain angle is similar. A Commerce or Magento operator runs the platform on top of a hosting stack, and a hypervisor like ESXi sits beneath nearly everything else in a virtualized estate. One exploited entry on a lower layer cascades the patching urgency upward.

Related reading: GitLab critical RCE joins CISA KEV with a Nov 1 federal patch deadline.

The listed-vendor cluster also puts a sharper line under what the catalog additions mean for the three read-throughs this desk tracks. For shareholders, the entries are evidence of patch-support obligations converting into real engineering spend, but for these mega-cap vendors they are immaterial to consensus numbers. For insurers the signal is more direct: KEV coverage is a published fact that underwriting desks price, and a cluster like this week's tightens what a policy will and will not cover an operator for. For the supply chain, each entry is a set of counterparties under deadline, which is the kind of concentration a logistics or cloud customer should already be mapping.

The market backdrop did not ignore the sector. The Amplify Cyber Security ETF closed the week ended October 30 near $124.47, down about 2.6 percent from the prior week's $127.83, and the iShares Cybersecurity and Tech ETF ended near $101.03, roughly 4.8 percent below the prior week's $106.12, per Yahoo Finance weekly data. Cyber names drifted lower into the week's close against a range of macro and earnings pressures; a standing catalog addition is not on its own a driver of a broad ETF move.

Related reading: New Home Sales September 2026 Fall 5.3% to 676,000 as Supply Stays at 8.4 Months.

What is dated next on the beat: the Adobe and Broadcom federal deadlines on November 10 and November 11, and the next catalog refresh as CISA continues its twice-weekly updates. The pattern to watch is not any single CVE but whether the pipeline keeps landing exploited entries on core enterprise and platform-layer software. A month that added more exploited CVEs than a year earlier, even as the headline total cooled from September, is the trend that matters to operators, underwriters and their suppliers.

Related reading: Alphabet Q3 2026 earnings: free cash flow swings negative as AI capex builds.

This content is for informational purposes only and does not constitute financial advice. Past performance is not indicative of future results. Consult a qualified financial advisor before making investment decisions.