Bastion Codex – Weekly Defender Brief (2026-10-12)

This weekly defender brief summarizes vulnerability movement observed over the past 7 and 30 days.

The goal is simple: highlight signal that matters to frontline defenders — patch workload pressure, severity shifts, and KEV movement.

Bastion Codex – Weekly Defender Brief

Week of 2026-10-12

Executive Snapshot

  • 3192 CVEs observed in the last 7 days
  • 313 Critical
  • 996 High
  • 6 KEV-listed vulnerabilities in last 30 days

Week-over-Week Movement

  • Total CVEs: 675 (from 2517 to 3192, 26.8%)
  • Critical: 95 (from 218 to 313, 43.6%)
  • High: 164 (from 832 to 996, 19.7%)
  • Medium: 323 (from 889 to 1212, 36.3%)
  • Low: 11 (from 98 to 109, 11.2%)
  • Unknown: 82 (from 480 to 562, 17.1%)

Defender Takeaways

  • Elevated volume of Critical vulnerabilities this week. Prioritize external-facing asset review.
  • Recently added KEV vulnerabilities detected. Review CISA remediation timelines.
  • High severity volume suggests increased patch workload. Focus on internet-exposed services first.

Severity Breakdown (7 Days)

  • Critical: 313
  • High: 996
  • Medium: 1212
  • Low: 109
  • Unknown: 562

Top Vendors (30 Days)

  • Zammad GmbH: 2
  • Cisco: 1
  • Citrix: 1
  • Fortinet: 1
  • Google: 1

Top Products (30 Days)

  • Zammad: 2
  • FortiMail: 1
  • Identity Services Engine: 1
  • NetScaler: 1
  • Pixel: 1

Priority Watchlist (Top 10)

  • CVE-2015-3306 | CVSS: 10.0 | KEV: True | The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

  • CVE-2021-41277 | CVSS: 10.0 | KEV: True | Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`

  • CVE-2025-55182 | CVSS: 10.0 | KEV: True | A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 inclu

  • CVE-2025-52691 | CVSS: 10.0 | KEV: True | Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail s

  • CVE-2026-10520 | CVSS: 10.0 | KEV: True | An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user

  • CVE-2026-48558 | CVSS: 10.0 | KEV: True | SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication

  • CVE-2026-48282 | CVSS: 10.0 | KEV: True | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory (‘Path Traver

  • CVE-2026-76460 | CVSS: 10.0 | KEV: True | A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication.

  • CVE-2017-12149 | CVSS: 9.8 | KEV: True | In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOn

  • CVE-2020-9054 | CVSS: 9.8 | KEV: True | Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerabi

Generated via Bastion Codex pipeline at 2026-10-12T14:59:49.364623+00:00