Only one of the eight exploited flaws is in a network appliance

On 8 October 2026, the cybersecurity agencies of seven countries —Spain's CNI among them— published joint advisory AA26-281A on the activity of a Chinese government-linked group, enabled by Integrity Technology Group and tracked, depending on the vendor, as Flax Typhoon, Ethereal Panda or Red Juliett. The advisory carries a table of eight CVEs exploited successfully. Of those eight, one is in a network appliance: a Pulse Connect Secure. The other seven are in software running on general-purpose servers.

That ratio does not measure your estate, and it is worth saying before going on: eight is not a sample, it is the curated list of what one actor used. What it does show is where they came in, and where they came in is not where most companies have their inventory focus.

The eight, with name, version and score

* The three starred rows have no primary NVD v3.1 score: what you see there is later CISA-ADP enrichment on the record. They are 2014 and 2015 flaws, predating NVD scoring in v3.1 by default. Bash also carries a 10.0 on the v2 scale: same vulnerability, two scores, two decades of scales.

How each of the seven got there

The seven did not arrive the same way, and the difference matters because it determines who ought to be watching them:

The appliance, by contrast, has a serial number, an invoice and a renewal date somebody gets by email once a year. That annual reminder is, in practice, half the inventory most companies have. And by design it covers none of the seven.

Three were already on the list. Two of them since November 2021

Of the eight, three were already in CISA's exploited-vulnerabilities catalogue before this advisory. The GitLab and Pulse Connect Secure entries went in on 3 November 2021, and both carry the "known use in ransomware campaigns" flag. The federal deadline for the GitLab entry expired on 17 November 2021; the Pulse one on 3 May 2022. The Bash entry went in on 2 October 2025, with a deadline of the 23rd. The list was public, free, downloadable as JSON and dated. What was missing was the other half of the cross-check.

The 4.9 that is in and the 10.0 that spent eleven years out

Sort that table by score and you understand nothing. The ProFTPD one is a 10.0 published in 2015 and it took eleven years to reach the catalogue. The Strapi one is a 4.9 primary NVD score —a textbook "medium"— and it went in with a three-day deadline.

There are two reasons and both are written down. The first, on the catalogue entry itself: "This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution". That second CVE is an authenticated server-side template injection (SSTI), scored 7.2, that runs code through a doctored email template. The 4.9 on its own leaks user data to someone who already has admin-panel access; chained, it is code execution. The second reason is on the NVD record: alongside the primary 4.9 sits a secondary CISA-ADP score of 7.2. The body that puts the CVE in the catalogue rates it considerably higher than the body that scored it first.

Where the three-day deadline comes from (and why it does not bind you)

The five new entries were added on 8 October with an 11 October due date. Three days, and the third fell on a Sunday. It comes from directive BOD 26-04, dated 10 June 2026, which replaced the single deadline with a scale based on exposure, attack automation and technical impact. How long that scale actually runs is something you can check by counting the catalogue itself, taking nobody's word for it:

curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json -o kev.json

jq -r '[.vulnerabilities[] | select(.dateAdded >= "2026-06-10")
  | ((.dueDate|strptime("%Y-%m-%d")|mktime) - (.dateAdded|strptime("%Y-%m-%d")|mktime))/86400]
  | group_by(.) | map({dias: .[0], n: length})' kev.json

On catalogue version 2026.10.08 you get two values and nothing else: 99 entries with a three-day deadline and 23 with fourteen. Not a single intermediate figure. The three days are for what is internet-exposed, automatable to exploit and gives total control of the asset, forensic triage included; the fourteen, for the rest of what is exposed. Longer timeframes are left for what does not face the internet.

That directive binds US federal agencies. None of it binds your company, and it would be dishonest to sell you a three-day deadline as if it were law here. What does travel is the ranking criterion: exposure, automation and impact, ahead of the CVSS score. Copying it is free.

Nine scanners and 1,300 scripts

The usual objection is "we are too small for anyone to come looking". The advisory dismantles it by describing the procedure: reconnaissance with BBScan, dirsearch, Fscan, ksubdomain, masscan, Nmap, OneForAll, ShuiZe and wpscan —nine public tools, the same ones everybody uses— plus MicroScan, a Python tool the advisory describes as carrying over 1,300 penetration-testing scripts. The sweep does not pick a target: it picks a port.

And for persistence, a detail worth more than any sermon: they install a SoftEther VPN client configured to reconnect at startup, renaming the installer conhost.exe or dllhost.exe so it passes for a Windows binary. The command-and-control traffic leaves looking like one more corporate VPN. If your detection consists of eyeing the firewall for something out of place, this is not out of place.

The other half of the cross-check

The list of vulnerable products is handed to you. The list of your products has to be built, and the opening question cannot be what you hold a contract for. Three questions for every thing listening on a port:

We keep NetBox as the source of truth for addressing and devices, and we apply the same discipline to our own internal tooling: the self-hosted n8n we automate tasks with is inventoried, with an owner and an update window, like any production server. That n8n is exactly the kind of thing this advisory is about: software someone stood up one day because it was needed. The difference is that it has a name next to it.

The cut-off versions and the two traps

What we are not going to tell you

If reading the table made you think "I believe we have one of those", that doubt is already the result of the audit. What is missing is the name and the date. We wrote the other half of this knot in July, off the back of a WordPress flaw that was already being exploited the same afternoon the patch shipped: there too the operational question was not which component, but who had it on their plate to apply it —WP2Shell: the question is not which plugin, it is who maintains your website.

Sources (verified 11 Oct 2026): joint advisory AA26-281A (FBI, CISA and NSA of the US; NCSC-UK; Australia's ASD's ACSC; Canadian Centre for Cyber Security; Japan's NPA and NCO; NCSC-NZ; and Spain's CNI), 8 Oct 2026: table of exploited CVEs, reconnaissance tooling, MicroScan and SoftEther persistence. Dates added, due dates, required action and the CVE-2023-22621 chaining note: CISA KEV catalogue, version 2026.10.08 (open JSON); the 99/23 deadline count is ours, reproducible with the command published above. Deadline scale: BOD 26-04, 10 June 2026. CVSS scores (primary and secondary) and affected versions: NVD (NIST).