This roundup covers the week of 12 to 16 October 2026. It was a dense week: the CISA Known Exploited Vulnerabilities (KEV) catalogue grew by eleven entries over five days, and five of them concern products common in mid-sized organisations as well.
The pattern of the week is clear. Four of the five flaws sit on machines whose job is to manage something else, a VPN gateway, a firewall, an email gateway or a backup server, and they hand an attacker administrator or root rights directly. In two cases, Ivanti and Ahsay, the first patch released did not stop the attack, and the vendor had to ship another one.
In this roundup you will find five vulnerabilities with what to do and by when, a summary priority table, and one item from the wider security world about a large-scale disruption of a network that sold phishing tools.
1. Ivanti Connect Secure, attackers bypassed authentication before the fix reached everyone
CVE-2026-104935 · CVSS 8.6 · actively exploited as a zero-day · fix available (partial)
Ivanti Connect Secure is a VPN gateway for remote employee access to the corporate network. Organisations deploy it so that people working from home or travelling can log in securely to internal systems.
The flaw lies in how the gateway handles requests to the publicly reachable endpoint /dana-na/auth/url_default/welcome.cgi. An attacker adds an X-DSCGI-PATH header that redirects the gateway to a resource that would normally require authentication, and runs commands with the rights of the low-privileged cgi-server account. According to Volexity, which investigated the incident, the attacker then chained this flaw with a separate, still unpatched privilege-escalation bug to obtain root rights even on a fully updated appliance.
What makes it worse is that this was a zero-day: Ivanti had already shipped part of the fix in the July 2026 release, version 25.1.3.0, but the backport to other supported branches rolled out gradually, and attackers used the gap before the fix reached everyone. The Integrity Checker Tool may also fail to detect compromise, because the attacker commands run only in memory and leave no trace on disk.
What to do: Update to version 25.1.1.2, 25.1.3.0 or 25.1.3.1 depending on your branch, or to 22.8R2.5. Affected are version 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier, version 22.7R2.14 and earlier are not affected. Where you cannot update immediately, restrict access to the VPN gateway to known IP addresses and run network and memory forensics, not just the Integrity Checker Tool. CISA added the flaw to the KEV catalogue on 13 October 2026, with a remediation deadline for federal agencies of 16 October 2026.
2. Palo Alto Networks PAN-OS, firewall management can be abused to run code as root
CVE-2026-0322 · CVSS 8.6 (CVSS 4.0) · actively exploited on a limited scale · fix available
PAN-OS is the operating system of Palo Alto Networks PA and VM series firewalls and of the Panorama management platform. Organisations use it to control traffic and policy at the network perimeter.
The flaw is a code injection issue (CWE-94) in the management interface. An attacker who already holds valid, highly privileged credentials and network access to the management interface can use it to run their own code with root privileges on the entire firewall.
The vulnerability is therefore not unauthenticated, but that reduces the risk less than it sounds: firewall management interfaces are often reachable from anywhere on the internet in practice, because a vendor or integrator set it up that way and nobody checked it later. Palo Alto Networks confirmed limited exploitation in targeted attacks against interfaces exposed this way and assigned the flaw its highest urgency rating.
What to do: Install the fix for your PAN-OS branch, the latest are 12.2.4, 12.1.10-h2, 11.2.16, 11.1.16-h3 and 10.2.18-h12, the exact list for your build is in the vendor advisory. Where you cannot update immediately, restrict access to the management interface to trusted internal addresses straight away, ideally through a dedicated jump box, the vendor states no other workaround exists. CISA added the flaw to the KEV catalogue on 14 October 2026, with a remediation deadline for federal agencies of 17 October 2026.
3. Cisco Secure Email Gateway, a single email attachment led to root
CVE-2026-76519 · CVSS 9.8 · actively exploited · fix available
Cisco Secure Email Gateway is an email gateway that filters incoming and outgoing mail and inspects attachments through the Advanced Malware Protection module before delivering a message to the inbox.
The flaw is a path traversal issue (CWE-23) in how the file reputation module processes attachments. An attacker sends an email with a crafted attachment that, once processed, writes an arbitrary file to the gateway operating system, and because the mail pipeline runs with high privileges, the write happens as root.
A single email is enough, with no authentication and no action from the recipient, the gateway triggers the attack itself while checking the attachment. Cisco first fixed this flaw back in September 2026 under a different identifier, CVE-2026-76440, and only renamed it to CVE-2026-76519 on 14 October after confirming active exploitation in the wild.
What to do: Vulnerable gateways have File Reputation, part of AMP, enabled on a mail policy and a Content Scanner Tools version earlier than 25.3.0.5525. Update AsyncOS 15.5 to build 15.5.5-014 or 16.5 to 16.5.0-780, the 16.0 branch has no fix and requires moving to 16.5. Cisco states no workaround exists, until you can update, consider temporarily disabling File Reputation on the incoming policy. CISA added the flaw to the KEV catalogue on 14 October 2026, with a remediation deadline for federal agencies of 17 October 2026.
4. Windows Shell, the Mark of the Web bypass has now been exploited three times this year
CVE-2026-96951 · CVSS 8.8 · actively exploited as a zero-day · fix available
Mark of the Web is the tag Windows adds to every file downloaded from the internet, and it is the basis for the warning the system shows before opening risky content.
The flaw in Windows Shell lets a specially crafted file bypass this warning, so it opens without any prompt, as if it had been created locally. Microsoft classifies the flaw as command injection that lets an attacker defeat a security feature over the network.
This is already the third zero-day of this kind in 2026, after CVE-2026-21510 in February and CVE-2026-32202 in April. The bypass alone does not run anything, but it is a key step in a common chain: a user opens an attachment or downloaded file, Windows does not warn, and the next stage of the attack, a macro, a script or an installer, proceeds without a hitch.
What to do: Install the cumulative update from 13 October 2026 for your version of Windows, Microsoft lists no other workaround. Affected are Windows 10 1607, 1809, 21H2 and 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 R2 through 2025, the specific update identifier differs by version and is listed in the MSRC Security Update Guide. CISA added the flaw to the KEV catalogue on 13 October 2026, with a remediation deadline for federal agencies of 16 October 2026, which is today.
5. AhsayCBS, the backup server stayed vulnerable even after the first fix
CVE-2026-105133 and CVE-2026-105134 · CVSS 7.3 and 9.3 · actively exploited · fix available after two attempts
AhsayCBS is the central server through which providers and MSP companies manage backups for dozens to hundreds of customer environments at once.
CVE-2026-105133 is an authentication flaw: according to analysis by Horizon3.ai, the function that is supposed to verify the administrator password in the API is skipped whenever a request carries the flag FromServlet set to Y. CVE-2026-105134 is a follow-on command injection flaw in the replication function, which an attacker uses after bypassing the login to run commands with system privileges. The CVSS score for the first flaw differs between sources, 7.3 under CVSS 3.1, but only 5.5 to 6.9 under the newer CVSS 4.0 methodology.
What makes it worse is that the first fix released, version 10.3.4.0 from 4 August 2026, and hotfix 9.15.2.59, did not, by the vendor own account on 10 October, fully close either flaw. Meanwhile Huntress confirmed attacks against at least five organisations by 8 October 2026, with attackers installing web shells and cryptocurrency miners disguised as a Microsoft Edge process through the vulnerable servers. Because this is a central backup management server, a successful attack endangers not only the server itself but the backups of every connected client.
What to do: On AhsayCBS v10, apply hotfix 10.3.4.45, on v9 apply hotfix 9.15.2.70, on v7 and v8 first move to v9.15.0.0 and then apply the same hotfix. Older versions and version 10.3.4.0 alone are not sufficient according to the vendor. Also check the server for unexpected JSP files in the webapps folder, unknown replication receivers or new administrator accounts, and restrict management access to trusted addresses or a VPN. CISA added both flaws to the KEV catalogue on 14 October 2026.
Summary of priorities
| Vulnerability | Impact | Exploited | Fix | Priority |
|---|---|---|---|---|
| Ivanti Connect Secure (CVE-2026-104935) | Unauthenticated command execution on the VPN gateway | Yes | Available, partial | Immediate |
| Palo Alto PAN-OS (CVE-2026-0322) | Code execution as root via firewall management | Yes, limited | Available | Immediate |
| Cisco Secure Email Gateway (CVE-2026-76519) | File write and commands as root via email | Yes | Available | Immediate |
| Windows Shell (CVE-2026-96951) | Bypass of the warning for a risky downloaded file | Yes | Available | High |
| AhsayCBS (CVE-2026-105133, CVE-2026-105134) | Login bypass and command execution on the backup server | Yes | Available, after two attempts | Immediate |
Elsewhere in security
Microsoft and Health-ISAC dismantled a network selling phishing tools
Microsoft and the non-profit Health-ISAC, according to Microsoft announcement of 14 October 2026, seized domains of three services, YAM Store, CoGUI and Iron Man, under an order from the US District Court for the Southern District of Florida. Attackers rented these services as a phishing toolkit, ready-made accounts, templates impersonating companies and institutions, and infrastructure for sending messages. Microsoft said the network had enabled more than one billion fraudulent messages since January 2026 and that attackers used it against organisations in more than 150 countries, including financial institutions and healthcare organisations. Health-ISAC joined the lawsuit after attackers repeatedly used the infrastructure against hospitals.
Microsoft said it disabled more than 20,000 accounts tied to YAM Store and is blocking more than 100,000 domains used for fraud, and described Iron Man as offering more than 2,300 templates impersonating banks, carriers, retailers and government agencies. The action is a civil lawsuit, not a criminal case, and targets only part of a wider criminal network. It will, for a time, make it harder for attackers to obtain ready-made templates and accounts for further campaigns.
What to take from this week
Four of the five flaws this week sit on machines a company usually does not think about as long as they work, firewall management, a VPN gateway, an email gateway or a backup server, and they hand an attacker root or administrator rights directly. In two cases, Ivanti and Ahsay, the first patch released did not stop the attack, so after installing an update it is worth confirming with the vendor directly that it is the final fixed version, not just the first response.
This week, check whether management of your VPN gateway, firewall and email gateway is reachable from the public internet, and if it is, restrict it to selected IP addresses or a VPN.
Cannot keep up with this?
We publish this roundup every week. Following it is only the first step. The harder part is knowing which vulnerabilities actually affect you, in what order to address them, and who in your organisation is responsible.
We help with that: security assessment and vulnerability management · external security leadership · technology selection and deployment
Free consultation · Dealing with an incident right now?
We will tell you plainly what is worth addressing first. The introductory consultation is free.
Sources: CISA, Known Exploited Vulnerabilities catalogue · CISA, alert on Ivanti Connect Secure · CISA, four vulnerabilities added to the catalogue · Palo Alto Networks, security advisory for CVE-2026-0322 · Cisco, security advisory for CVE-2026-76519 · Ahsay, announcement on the AhsayCBS vulnerability · Microsoft, Security Update Guide for CVE-2026-96951 · Microsoft, announcement on disrupting YAM Store, CoGUI and Iron Man