Week of October 12, 2026: BeyondTrust KEV Addition and New CISOs at Acronis, Nike, Pega

Security leaders tracked CISA's rapid-fire additions of actively exploited BeyondTrust Remote Support, Ivanti Connect Secure, Atlassian, Palo Alto Networks, Cisco, and Ahsay vulnerabilities to its Known Exploited Vulnerabilities catalog between October 13 and October 16, 2026, alongside a joint CISA-FBI warning to election officials about midterm-targeted phishing and smishing. The same week, Park Dental Partners filed an updated cybersecurity disclosure with the SEC, and Acronis, Pega, Nike, and Accenture Federal Services each announced new chief information security officers.

CISA Flags Actively Exploited BeyondTrust Remote Support Flaw

CISA warned that threat actors were actively exploiting a critical authentication-bypass vulnerability, CVE-2026-102764, in BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier, using it to gain initial access before establishing persistence, escalating privileges, and moving laterally. The agency added the flaw to its Known Exploited Vulnerabilities catalog on October 16, 2026, and urged organizations running self-hosted appliances older than version 24.3.1 to upgrade, apply BeyondTrust's BT26-05-RS patch, rotate stored credentials, and revoke active support sessions. (CISA)

Ivanti Connect Secure Exploitation Prompts KEV Addition

CISA disclosed that threat actors were exploiting a newly identified Ivanti Connect Secure vulnerability, CVE-2026-104935, affecting versions 25.1.1.2 and prior, enabling remote unauthenticated execution of arbitrary commands used for credential theft and data exfiltration. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 13, 2026, and urged organizations to update to the latest version, noting that Ivanti's Integrity Checker Tool might not detect exploitation because threat actor commands execute in memory. (CISA)

CISA Adds Four More Exploited Vulnerabilities to KEV Catalog

CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog on October 14, 2026: a code injection flaw in Palo Alto Networks PAN-OS (CVE-2026-0322), a relative path traversal vulnerability in Cisco Secure Email Gateway (CVE-2026-76519), and two Ahsay AhsayCBS vulnerabilities for improper authentication and command injection (CVE-2026-105133 and CVE-2026-105134). The agency reiterated that Binding Operational Directive 26-04 requires federal civilian agencies to prioritize rapid remediation of KEV-listed vulnerabilities on publicly exposed assets that grant total control post-exploitation. (CISA)

Atlassian Exposure Vulnerability Joins KEV Catalog

CISA added CVE-2026-21589, an Atlassian multiple-products vulnerability that leaves files or directories accessible to external parties, to its Known Exploited Vulnerabilities catalog on October 15, 2026, citing evidence of active exploitation. The agency said such vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise, and it again pointed federal agencies to Binding Operational Directive 26-04 for prioritizing remediation of publicly exposed, high-risk assets. (CISA)

CISA and FBI Warn Election Officials of Phishing and Smishing Threats

CISA and the FBI issued a joint public service announcement on October 16, 2026, warning election and campaign officials about cyber threats ahead of the 2026 U.S. midterm elections. The agencies said malicious actors were increasingly running sophisticated phishing and smishing campaigns, including convincing emails, text messages, audio, and video content, designed to steal credentials or install malware on election officials, candidates, and political organizations because of their access to voter registration data and sensitive campaign information. (CISA)

Park Dental Partners Updates SEC Disclosure on August Data Breach

Park Dental Partners filed a Form 8-K update on October 13, 2026, describing continued fallout from unauthorized network access identified on August 28, 2026 that resulted in unauthorized acquisition of protected health information. The filing disclosed that the company faced four state court class-action lawsuits in Minnesota's Second Judicial District, the first filed September 3, 2026, and that plaintiffs moved to consolidate the four actions on October 7, 2026. The company said it had not identified any material financial impact to date. (SEC EDGAR)

CISO Moves: Pega, Nike, and Accenture Federal Services Make Appointments

SecurityWeek's industry-moves roundup for the week of October 12, 2026 logged a wave of CISO hires: Sean Croston joined Pega as CISO after previous CISO roles at USAA, Truist, BNP Paribas/Bank of the West, and Santander US; Adam Zolle joined Nike as CISO after serving as CISO at CrowdStrike, Providence, and GE Healthcare; and Accenture Federal Services named Nathaniel Parker, a former Boston Consulting Group CISO, to the role. (SecurityWeek)