Bastion Codex – Weekly Defender Brief (2026-10-05)

This weekly defender brief summarizes vulnerability movement observed over the past 7 and 30 days.

The goal is simple: highlight signal that matters to frontline defenders — patch workload pressure, severity shifts, and KEV movement.

Bastion Codex – Weekly Defender Brief

Week of 2026-10-05

Executive Snapshot

  • 2517 CVEs observed in the last 7 days
  • 218 Critical
  • 832 High
  • 9 KEV-listed vulnerabilities in last 30 days

Week-over-Week Movement

  • Total CVEs: -1797 (from 4314 to 2517, -41.7%)
  • Critical: -125 (from 343 to 218, -36.4%)
  • High: -941 (from 1773 to 832, -53.1%)
  • Medium: -482 (from 1371 to 889, -35.2%)
  • Low: -78 (from 176 to 98, -44.3%)
  • Unknown: -171 (from 651 to 480, -26.3%)

Defender Takeaways

  • Elevated volume of Critical vulnerabilities this week. Prioritize external-facing asset review.
  • Recently added KEV vulnerabilities detected. Review CISA remediation timelines.
  • High severity volume suggests increased patch workload. Focus on internet-exposed services first.

Severity Breakdown (7 Days)

  • Critical: 218
  • High: 832
  • Medium: 889
  • Low: 98
  • Unknown: 480

Top Vendors (30 Days)

  • Citrix: 3
  • Zammad GmbH: 2
  • Apple: 1
  • Cisco: 1
  • Fortinet: 1
  • WordPress: 1

Top Products (30 Days)

  • NetScaler: 3
  • Zammad: 2
  • Catalyst SD-WAN Manager: 1
  • Core: 1
  • FortiMail: 1
  • Multiple Products: 1

Priority Watchlist (Top 10)

  • CVE-2020-0796 | CVSS: 10.0 | KEV: True | A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain reque
  • CVE-2010-2861 | CVSS: 9.8 | KEV: True | Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to re
  • CVE-2012-1710 | CVSS: 9.8 | KEV: True | Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers t
  • CVE-2016-1019 | CVSS: 9.8 | KEV: True | Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbit
  • CVE-2018-7602 | CVSS: 9.8 | KEV: True | A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit
  • CVE-2018-19323 | CVSS: 9.8 | KEV: True | The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26,
  • CVE-2019-2725 | CVSS: 9.8 | KEV: True | Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are
  • CVE-2020-12812 | CVSS: 9.8 | KEV: True | An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log
  • CVE-2018-19949 | CVSS: 9.8 | KEV: True | If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue
  • CVE-2026-24061 | CVSS: 9.8 | KEV: True | telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a “-f root” value for the USER environment variable.

Generated via Bastion Codex pipeline at 2026-10-05T19:25:52.568186+00:00