Who this is for: network and security teams running VPN appliances, firewalls, email gateways and other edge devices (equipment that sits between your network and the internet). This page is based on the vendors' security advisories and CISA's public data. It does not cover how the attacks work.
Developing: this page will be updated as more is published
As of October 24, 2026Not yet known
- Fixed Ivanti Connect Secure releases per code line (this site could not retrieve the text of Ivanti's advisory)
- A fix for the reported Ivanti Connect Secure privilege escalation flaw
- How many organisations were affected by each flaw
All five flaws are in KEV and each vendor has released fixes. For Ivanti Connect Secure, a fix for a privilege escalation flaw used in the same attacks is reported to be still to come. This page will be updated when the advisories are revised.
Quick check: does this affect you?
The table lists the date each flaw was added to KEV (CISA's catalog of vulnerabilities known to be exploited) and the due date for US federal agencies, as recorded in KEV.
| Product | CVE | Login needed? | KEV added / due | What to do |
|---|---|---|---|---|
| Ivanti Connect Secure (VPN) | CVE-2026-104935 | No | Oct 13 / Oct 16 | Upgrade; investigate for compromise |
| Palo Alto Networks PAN-OS (firewall) | CVE-2026-0322 | Yes (high privilege) | Oct 14 / Oct 17 | Upgrade; restrict management access |
| Fortinet FortiOS and others | CVE-2025-61624 | Yes (admin) | Oct 16 / Oct 19 | Upgrade; migrate from 7.2 and older |
| Cisco Secure Email Gateway | CVE-2026-76519 | No | Oct 14 / Oct 17 | Update Content Scanner Tools or AsyncOS |
| Atlassian Data Center products | CVE-2026-21589 | No | Oct 15 / Oct 18 | Upgrade; restrict external access |
Oct 13
Ivanti added (due 16th)
Oct 14
PAN-OS, Cisco added (due 17th)
Oct 15
Atlassian added (due 18th)
Oct 16
Fortinet added (due 19th)
Ivanti Connect Secure (CVE-2026-104935)
- Type
- Authentication bypass by spoofing (CWE-290). A remote, unauthenticated attacker can run arbitrary commands
- Severity
- CVSS v3.1 8.6
- Affected
- 25.1.1.1 and earlier, 25.1.2.2 and earlier, 22.8R2.4 and earlier (CISA alert)
- Fixed
- Confirm the fixed release for your code line in Ivanti's advisory
- Exploitation
- Ivanti said at disclosure that it was aware of limited exploitation in the wild. CISA added it to KEV on October 13 and says it is being used for credential theft and data exfiltration
Ivanti published its advisory on October 13; in a blog post the same day it asked customers on affected versions to upgrade to the fixed version immediately and to run its Integrity Checker Tool regularly. This site could not retrieve the text of Ivanti's advisory, so fixed version numbers are not listed here. Check the advisory for the fixed release on your code line. According to CISA, the 22.8 line reaches end of life on January 31, 2027.
CISA says that because the attacker's commands run in memory, Ivanti's Integrity Checker Tool may not detect exploitation, and that network and memory forensics are needed to determine whether you were compromised. If compromise is suspected, CISA recommends the following.
Back up the configuration
Take a backup of the appliance configuration.
Factory reset and upgrade
Reset the appliance to factory settings and upgrade to the latest version. For virtual and cloud systems, rebuild the instance and upgrade.
Restore the configuration
Restore the configuration from the backup.
Rotate credentials
Reset passwords for all domain, administrator and local accounts, revoke and reissue stored certificates, and reset stored API keys and license server credentials.
Reported, not yet confirmed
A US security firm that investigated the attacks wrote on October 13 that it saw exploitation from October 3, and that the attacks chained three flaws: an authentication bypass, a file write and a privilege escalation. It says Ivanti plans to fix the privilege escalation flaw in a release in the coming weeks. This site has not been able to confirm this in the text of Ivanti's advisory. After upgrading, keep watching for Ivanti's next advisory.
Palo Alto Networks PAN-OS (CVE-2026-0322)
- Type
- Code injection in the management interface (CWE-94). An authenticated attacker can run arbitrary code as root on the firewall
- Severity
- CVSS v4.0 8.6; 8.5 if management access is restricted to a jump box
- Conditions
- Network access to the management interface and a high-privilege login. No special configuration needed
- Affected
- PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 on PA-Series, VM-Series and Panorama
- Not affected
- Cloud NGFW and Prisma Access (no action needed)
- Exploitation
- Palo Alto Networks says it has seen very limited exploitation targeting the management interface
Fixed releases are split finely by train and by hotfix (-h) level. At the top of each train: 12.2.4 or later, 12.1.10-h2 or later, 11.2.16 or later, 11.1.16-h3 or later, and 10.2.18-h12 or later. Check the advisory's table for hotfix releases on intermediate versions (for example 11.2.13-h3). Unsupported versions should move to a supported fixed release.
The advisory says there are no known workarounds. Risk is highest when the management interface is reachable from the internet, and the vendor recommends allowing management access only from trusted internal IP addresses. Customers with Threat Prevention get limited coverage from Threat IDs 510046 and 510047, which require SSL decryption. Upgrading is the recommended fix.
Fortinet FortiOS and others (CVE-2025-61624)
- Type
- Path traversal in the CLI (CWE-22). A privileged attacker can write or delete arbitrary files by passing crafted arguments to existing commands
- Severity
- CVSS v3 6.0 (Fortinet rates it Medium)
- Conditions
- An admin login. KEV says an admin profile with at least read-write permissions is required
- Published
- April 14, 2026 (initial advisory). Added to KEV on October 16
- Exploitation
- The advisory lists it as Known Exploited: Yes, without further detail
This flaw was disclosed six months ago and only now added to KEV. If you deferred it in April as a medium-severity, admin-only issue, revisit it now.
| Product | Affected | Action |
|---|---|---|
| FortiOS 7.6 | 7.6.0 to 7.6.4 | Upgrade to 7.6.5 or later |
| FortiOS 7.4 | 7.4.0 to 7.4.9 | Upgrade to 7.4.10 or later |
| FortiOS 7.2, 7.0, 6.4 | All versions | Migrate to a fixed release |
| FortiProxy 7.6 / 7.4 | 7.6.0-7.6.4 / 7.4.0-7.4.11 | 7.6.5+ / 7.4.12+ (migrate from 7.2, 7.0) |
| FortiPAM 1.7 | 1.7.0 | 1.7.1+ (migrate from 1.6 and older; 1.8 not affected) |
| FortiSwitchManager 7.2 / 7.0 | 7.2.0-7.2.7 / 7.0.0-7.0.6 | 7.2.8+ / 7.0.7+ |
The advisory lists no workaround. Fortinet says a virtual patch (a FortiGuard signature) is available. Because an admin account is the precondition, restrict who can reach the management interface, disable unused admin accounts, and require multi-factor authentication for admin logins (this site's recommendation).
Cisco Secure Email Gateway (CVE-2026-76519)
- Type
- Relative path traversal (CWE-23) leading to arbitrary file write. Triggered by an email with a crafted attachment, and can lead to command execution as root
- Severity
- CVSS v3.1 9.8
- Conditions
- No login. Affected only if File Reputation (part of Cisco AMP) is enabled and assigned to a mail policy, and Content Scanner Tools is earlier than 25.3.0.5525
- Fixed
- Content Scanner Tools 25.3.0.5525 or later (no restart needed), or AsyncOS 15.5.5-014 or 16.5.0-780. 16.0 and releases before 16.5 should migrate to 16.5.0-780
- Not affected
- Secure Email and Web Manager, Secure Web Appliance. Cisco has fixed the cloud service and customers need not update, but it has contacted customers with indicators of compromise and recommends renewing credentials and keys
- Exploitation
- Cisco PSIRT says it became aware of active exploitation in October 2026
There is no workaround. The mail-receiving side cannot be closed, but Cisco’s hardening advice is to separate management from mail traffic onto different network interfaces and allow only known, trusted hosts to reach the appliance. In the web interface, check whether Enable File Reputation is ticked under the Advanced Malware Protection settings of your mail policies, and check the Content Scanner Tools version in the CLI (contentscannerstatus). If affected, update Content Scanner Tools. Turning on automatic updates helps the next fix arrive sooner.
Cisco's advisory includes a procedure for checking the system logs for signs of compromise; run it on every cluster member. If an indicator is found, or the scan does not complete, Cisco asks you to contact Cisco TAC. Because root access lets attackers hide evidence, Cisco also recommends reviewing network and firewall logs for suspicious uploads to external addresses.
Atlassian Data Center products (CVE-2026-21589)
On October 5, Atlassian disclosed a flaw that lets an unauthenticated attacker read specific files within the web application root in all versions of Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo and Crowd Data Center, plus Crucible and Fisheye (CVSS v4.0 9.3, Atlassian's rating). It was added to KEV on October 15. Atlassian says it cannot confirm whether customers' instances have been affected, and recommends asking your security team to check them for signs of compromise. Cloud products have been patched.
Fixed versions vary by product (for example, Confluence Data Center 9.2.26 and 10.2.19; Jira Software Data Center 9.12.40, 10.3.26 and 11.3.12). If you cannot upgrade right away, Atlassian suggests taking the instance off the internet or restricting external access, and blocking suspicious URLs with a WAF or reverse proxy rule.
What these five have in common
All five sit on devices or servers reachable from the internet, and exploitation can give an attacker a way into the internal network. Even the two that need a login (PAN-OS and FortiOS) are one stolen admin password away from being exploitable if the management interface is open to the internet.
Operations that will repeat this next time
- Management interfaces reachable from anywhere on the internet
- Treating the job as done once the patch is applied
- Deferring flaws because they need a login
- No inventory of which products and versions you run
Operations that limit the damage next time
- Management interfaces reachable only from admin networks or over VPN
- Preserving logs before upgrading and checking for compromise with vendor guidance
- Fixing KEV-listed flaws within days, login required or not
- An inventory of edge devices, versions and management exposure
In this site's view, an edge device is not done once it is patched. For Ivanti Connect Secure, CISA writes that the vendor's own check tool may miss exploitation, and a further unfixed flaw has been reported. Patching closes the entry point but does not remove an attacker already inside. For KEV-listed edge devices, treat upgrading, checking for compromise and rotating credentials as one job.
How to find exposed management interfaces is covered in How to defend VPN devices and remote access, and how to prioritise using KEV in How to decide which CVEs to fix first (CVSS, EPSS, KEV). In the same month, an SD-WAN management platform was also exploited (VeloCloud Orchestrator CVE-2026-114625).
Sources
- CISA, Known Exploited Vulnerabilities Catalog (JSON feed, version of October 23, 2026) — cisa.gov
- CISA, "CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure" (October 13, 2026) — cisa.gov
- Ivanti, Security Advisory Ivanti Connect Secure (CVE-2026-104935) — hub.ivanti.com
- Ivanti, "October 2026 Security Update" (October 13, 2026) — ivanti.com
- Singapore CSA, "Active Exploitation of Vulnerability in Ivanti Connect Secure" (AL-2026-147) — csa.gov.sg
- A US security firm's analysis of the Ivanti Connect Secure attacks (October 13, 2026) — security firm blog
- Palo Alto Networks, "CVE-2026-0322 PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface" — security.paloaltonetworks.com
- Fortinet, FG-IR-26-122 "Path Traversal in CLI" (CVE-2025-61624) — fortiguard.fortinet.com
- Cisco, "Cisco Secure Email Gateway Arbitrary File Write Vulnerability" (cisco-sa-esa-afw-zqYJkjxp) — cisco.com
- Atlassian, "CVE-2026-21589 - Arbitrary File Access Vulnerability impacts Multiple Products" — confluence.atlassian.com
Update history
2026-10-24: First published. Based on the vendors' advisories and CISA's KEV catalog and alert.
Read next
- Defending exposed devices: How to defend VPN devices and remote access
- Prioritising fixes: How to decide which CVEs to fix first (CVSS, EPSS, KEV)
- Exploited the same month: VeloCloud Orchestrator CVE-2026-114625
- Checking for compromise: How to check whether your server was compromised
- Terms: What is path traversal? / What is CVSS?