CISA's newest exploited-vulnerability feed is a useful morning test for small businesses: can you quickly find out who owns the systems sitting between your company and the internet?
The Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities JSON feed was updated Oct. 4. The newest entries include Citrix NetScaler, Zammad, and Fortinet FortiMail vulnerabilities added between Oct. 1 and Oct. 4. CISA's public KEV catalog is the agency's list of vulnerabilities with evidence of active exploitation.
That does not mean every small business uses these products. It does mean owners should know who can answer the question quickly.
The products in this batch sit in places that matter. NetScaler is often used at the network edge for application delivery and gateway functions. Zammad is a help desk platform. FortiMail is an email security product. Those are not casual tools. They can touch remote access, support tickets, customer messages, internal identities, and the traffic that flows in and out of the business.
The Specifics Owners Should Send
CISA's Oct. 4 feed lists CVE-2026-88779 for Citrix NetScaler, with a federal due date of Oct. 7. It also lists two Zammad vulnerabilities, CVE-2026-102489 and CVE-2026-102490, both added Oct. 2 with an Oct. 5 due date. Fortinet FortiMail CVE-2026-104286 was added Oct. 1 with an Oct. 4 due date.
Those deadlines apply to federal civilian agencies under CISA rules. For a private business, the useful signal is urgency. If a vulnerability is in KEV, attackers are not waiting for your next quarterly maintenance window.
Send this to your MSP, web host, IT contractor, or internal technical owner:
CISA added Citrix NetScaler CVE-2026-88779, Zammad CVE-2026-102489 and CVE-2026-102490, and Fortinet FortiMail CVE-2026-104286 to the Known Exploited Vulnerabilities catalog in early October. Please confirm whether we use any of these products directly or through a vendor, whether any affected system is internet-facing, whether vendor mitigation or updates have been applied, and whether log review or forensic triage is recommended.
That ticket is intentionally boring. Boring is good. It asks for the product, exposure, patch status, and evidence.
Why This Is More Than a Patch Note
Small businesses usually get hurt by the gap between responsibility and visibility.
The owner assumes the MSP handles security. The MSP assumes the software vendor handles hosted systems. The software vendor assumes the customer reads advisories. The person who set up a gateway two years ago no longer works with the company. Everyone is busy. Nothing gets written down.
An exploited-vulnerability listing cuts through that fog. It gives the business a concrete reason to ask who owns a system, whether it is exposed, and whether the fix has been applied.
CISA's broader BOD 26-04 directive is written for federal agencies, but the triage logic is useful for owners: prioritize known exploited vulnerabilities, internet-exposed assets, systems tied to identity or sensitive data, and cases where successful exploitation gives an attacker meaningful control.
That is a better workflow than patching whatever happens to be loudest.
Make the Vendor Prove the Answer
A reassuring sentence is not enough. Ask for a short status note you can save:
- Product in use or not in use
- Affected version or not affected
- Internet-facing or internal only
- Patch, mitigation, or upgrade applied
- Date applied
- Whether logs were checked
- Next owner for follow-up
If the answer is "we do not use any of these," that is still useful. Save it in your vendor inventory. The next advisory will be faster because you know where these systems do and do not live.
If the answer is "we are checking," set a same-day follow-up time. A KEV item should not sit in an open ticket with no owner.
If nobody can answer, the problem is bigger than this advisory. You have an inventory gap around edge, help desk, or email infrastructure. That is fixable, but it needs a name next to it.
The Owner Takeaway
Do not turn this into a cybersecurity research project. Turn it into three accountable questions.
Do we use the affected product? Is it exposed? Has the fix been applied and verified?
For small businesses, the main value of CISA's October KEV update is not memorizing CVE numbers. It is forcing a cleaner relationship with vendors before a real incident forces the same conversation under pressure.