LLM Security News Tracker: The October 2026 Action Queue

On October 21, 2026, CISA's machine-readable Known Exploited Vulnerabilities catalog reached version 2026.10.21 with 1,754 entries. The current feed includes vulnerabilities in LiteLLM and MLflow. It also includes Langflow vulnerabilities. That changes the operating question for a CISO. A newly disclosed defect belongs in an action queue only after the team establishes the exploitation evidence, affected asset, reachable path, and control that buys time before remediation.

I maintain this tracker around those decisions. The broader LLM security vulnerabilities guide owns the recurring defect taxonomy. This page owns the dated queue.

TL;DR

• CISA KEV inclusion is the clearest trigger in this tracker because it records evidence of exploitation in the wild.
• The October 21 feed names current AI-stack entries affecting LiteLLM and MLflow. It also names Langflow.
• EPSS adds a daily 30-day exploitation probability and percentile, but CISA recommends using it with KEV and CVSS rather than alone.
• DeepInspect can provide a compensating control only when the vulnerable path involves deliberately routed, authenticated HTTP traffic to an LLM.

Current queue for October 23, 2026

The CISA KEV catalog describes itself as the authoritative catalog of vulnerabilities exploited in the wild. CISA also recommends that organizations use KEV as an input to vulnerability-management prioritization. I would put a KEV match ahead of a glossy vendor severity badge every time. One records observed exploitation; the other may only describe technical impact.

The current CISA KEV JSON feed includes LiteLLM CVE-2026-59822 and CVE-2026-42271, MLflow CVE-2026-64849, plus several Langflow vulnerabilities. Those identifiers are the verified facts available in the feed snapshot. The queue below deliberately avoids guessing at an affected version or defect mechanism when the inspected source set does not establish it.

• LiteLLM CVE-2026-59822 and CVE-2026-42271: identify every deployed LiteLLM instance and owner, then check the applicable vendor or project advisory for affected versions and remediation. Preserve exposed-route logs before changing the service. If model traffic can bypass the normal gateway, record that bypass as a separate exposure.
• MLflow CVE-2026-64849: find reachable MLflow services and assign remediation to the service owner. MLflow management and artifact surfaces sit outside an LLM request gateway unless a specific model call is deliberately routed through it.
• Langflow entries: enumerate each installed Langflow version against the current KEV feed and its corresponding advisory. Treat the service, its management plane, stored credentials, and downstream model routes as separate assets during triage.

A whiteboard with four columns is enough for the first pass: CVE, reachable asset, named owner, and due date. If the reachable asset column is blank, the organization has an inventory problem before it has a patch-priority answer.

Evidence changes the response tier

KEV inclusion should trigger an immediate reachability and exposure review. The next decision depends on what the vulnerable component can reach and what evidence shows in the environment. A deployed instance that is isolated behind a restricted management plane presents a different response problem than the same software exposed through an internet-facing route. The CVE identifier alone cannot settle that distinction. Active exploitation of Langflow CVE-2026-55255 was reported on July 8, 2026; it is a CVSS 9.9 cross-tenant IDOR in an AI-orchestration platform often deployed alongside MCP servers and agents.

I use three response tiers. The first is patching with an owner and a verified completion record. The second adds temporary restrictions around reachable services while remediation proceeds. The third opens incident response because local evidence indicates suspicious activity or because the vulnerable service handled sensitive routes that lack adequate historical evidence.

The AI incident response playbook covers containment and forensic handoff in detail. For this tracker, the trigger is narrower: move an item into incident response when the team has evidence to investigate, and preserve request, host, identity, and application records before remediation changes the scene.

EPSS informs order inside the queue

The FIRST Exploit Prediction Scoring System estimates the probability that a CVE will be exploited in the next 30 days. FIRST publishes daily probabilities and percentiles. It recommends combining EPSS with CVSS and KEV, which is the useful operating model for this queue.

KEV answers whether exploitation in the wild has been established for a cataloged vulnerability. EPSS supplies a changing probability signal across a much larger population. CVSS describes severity characteristics. Asset reachability and business context remain local facts. A security team can therefore use KEV to identify urgent known-exploited work, then use EPSS to order other vulnerabilities that compete for the same maintenance window.

The score should be captured with its date because EPSS changes daily. A ticket that says only "high EPSS" loses the evidence needed to reconstruct the decision a week later. Record the probability, percentile, retrieval date, asset, owner, and chosen action in the same work item.

Compensating controls have a narrow job

A compensating control is credible when it interrupts the actual attack path. DeepInspect may block or record a model request only when an authenticated user or agent deliberately sends HTTP traffic through its policy point. That route can support identity-bound policy decisions that allow or deny a request and redact specified content while a vulnerable component awaits remediation.

Several adjacent surfaces remain outside that boundary. DeepInspect cannot patch server remote code execution, inspect an unsafe model artifact before loading, secure a local transport, or repair a vulnerable management plane. It also misses any request that calls the target directly and bypasses the gateway. Those paths belong to patching, segmentation, artifact controls, host monitoring, and application architecture.

This boundary belongs in every exception record. A sentence such as "gateway rule deployed" is incomplete. The record should name the routed endpoint, authenticated identity source, policy version, start time, bypass test, and planned removal date. The AI security vendor evaluation criteria provide a useful review format for the enforcement point and its evidence.

Update method for this tracker

Each refresh starts with the CISA catalog page and JSON feed. New AI-stack entries receive a dated line in the queue only after the identifier is present in the official feed. The service owner then supplies affected-version evidence from the relevant project advisory before a remediation statement is added. EPSS is captured on the same date for prioritization context.

The tracker records six fields for each item: advisory date, CVE, affected deployment, exploitation evidence, chosen action, and closure evidence. A compensating control gets an additional route-boundary note. Incident response gets a case reference rather than a vague "monitor" status.

I dislike vulnerability trackers that become headline archives. A queue has to tell an owner what changes before the next maintenance window. Entries that lack a reachable asset or assigned owner stay visibly incomplete instead of being dressed up as intelligence.

DeepInspect

DeepInspect can govern the part of this queue that crosses an authenticated HTTP-to-LLM boundary. Its stateless proxy evaluates deliberately routed model requests against identity-aware policy and produces a per-decision record. That can reduce exposure on a named route while the service owner patches the underlying component.

The control stops at that route. Native SaaS inference, direct calls, local execution, management planes, and vulnerable artifacts remain outside DeepInspect. A useful readiness review maps those exclusions beside the routes the proxy actually receives. Book a technical deep dive at deepinspect.ai.