34 flaws attackers used,
and two Windows versions near their end.

What attackers used

Between 4 October and 3 November 2026, CISA, the US cybersecurity agency, added 34 flaws to its catalogue of Known Exploited Vulnerabilities. A flaw goes on that list when CISA has reliable evidence that attackers have exploited it.

• The edge leads. Ten of the 34 sit at the edge of the network: remote-access gateways and appliances, firewalls, an email gateway and an SD-WAN orchestrator. Most of them face the internet by design.
• Old flaws still work. Five, added together on 8 October, date from 2015 to 2023: in an FTP server, a DNS server, Apache Struts, ONLYOFFICE and Strapi. Their fixes have been out for years; the flaws work wherever nobody applied them.
• Flaws in sets. CISA lists 12 of the 34 as usable together, in four sets: three in Ivanti Connect Secure, four in Plex Media Server, two in AhsayCBS, and two in PHP that can be combined with one in the Linux kernel to plant web shells and run commands as root. When you patch one flaw in a set, patch the rest of the set with it.

CISA gave US federal civilian agencies three days to act on 27 of the 34, and two weeks for the other seven. If you run any of these products, those deadlines show how fast the US government expects its own agencies to move.

One thing worth checking

Windows versions near their end. Support for Windows 11 Enterprise and Education, version 23H2, ends on 10 November 2026, and for Windows Server 2016 on 12 January 2027. After those dates the regular monthly security updates stop, and new flaws in them stay open. Windows 11 Home and Pro, version 24H2, passed that point on 13 October.

How to check. To list every computer account in the domain, with the system each one last reported, run this in PowerShell with the Active Directory module. Windows 11 23H2 shows build 22631 in the version column and 24H2 shows build 26100; the system column gives the edition (Pro, Enterprise or Education) and names Windows Server 2016.

Get-ADComputer -Filter * `
  -Properties OperatingSystem,
    OperatingSystemVersion,
    LastLogonDate |
  Sort-Object OperatingSystem |
  Select-Object Name,
    OperatingSystem,
    OperatingSystemVersion,
    LastLogonDate

On a single machine, winver shows the same. A computer whose last logon is months old may be switched off or gone, and machines outside the domain do not appear at all. Each machine you find either moves to a supported version or gets a written exception: why it stays, who owns it, and what limits the risk.

If this takes more hours than your team has, that is the work we do: finding what runs, carrying out the updates and logging every step. Write to us whenever it suits you.

Cosmin L. NeaguH2 Labs

Sources

1. CISA, Known Exploited Vulnerabilities Catalog, version 2026.11.04, released on 4 November 2026, read from its JSON feed: the 34 entries added from 4 October to 3 November 2026, with the products, the flaws listed as usable together and the federal deadlines as the catalogue gives them.
2. Microsoft, Windows 11 release information: the end of updates by version and edition, build 22631 for version 23H2 and build 26100 for version 24H2.
3. Microsoft Lifecycle, Windows Server 2016: extended support ends on 12 January 2027.
4. Microsoft Lifecycle, Windows 11 Home and Pro: version 24H2 ended on 13 October 2026.
5. Microsoft, Get-ADComputer: the command and the properties it reads.

Dates and figures checked on 5 November 2026.