Firewall, VPN and Email Gateway Zero-Days Lead a Heavy Day for Edge Devices

Palo Alto Networks and Cisco disclosed actively exploited flaws in their firewall and email security products, and CISA's Friday deadline for an Ivanti VPN zero-day is approaching. Microsoft and partners also disrupted a phishing service that impersonated couriers, tax agencies and banks, while new federal data shows the scale of healthcare breaches.

Priority at a glance

PAN-OS, Cisco Secure Email Gateway and Ivanti Connect Secure are all under confirmed active exploitation, with CISA deadlines landing Friday and Saturday this week. The phishing takedown is a completed disruption, not an ongoing exploit, but its indicators are still worth blocking.

1. Palo Alto Networks PAN-OS flaw exploited (CVE-2026-0322)

What happened. On October 14, Palo Alto Networks disclosed CVE-2026-0322, a code injection flaw in the PAN-OS management interface. It lets an authenticated attacker with network access run code as root. The vendor reports "very limited exploitation," and CISA added it to the Known Exploited Vulnerabilities (KEV) catalog with an October 17 federal deadline.

Who is affected. PA-Series and VM-Series firewalls and Panorama on PAN-OS 10.2 through 12.2 below the fixed builds. Cloud NGFW and Prisma Access are not affected.

Severity. CVSS v4.0 8.6 (High), with Palo Alto's suggested urgency at "highest." Risk is greatest where management is reachable from the internet.

What to do. — click a step to check it off

1. Upgrade to 12.2.4, 12.1.10-h2, 11.2.16 (or a branch hotfix such as 11.2.13-h3), 11.1.16-h3, 10.2.18-h12, or the matching hotfix for your branch. There's no workaround.
2. Restrict management access to trusted internal IPs or a jump host.
3. Threat Prevention subscribers can enable Threat IDs 510046 and 510047 (partial coverage; requires SSL decryption).
4. Search logs for the advisory's indicator IPs.

2. Cisco Secure Email Gateway flaw under attack (CVE-2026-76519)

What happened. On October 14, Cisco disclosed CVE-2026-76519, a path traversal flaw that lets an unauthenticated remote attacker write arbitrary files to the gateway's operating system. Cisco is aware of active exploitation, and CISA set an October 17 KEV deadline.

Who is affected. Physical and virtual gateways with File Reputation enabled in a mail policy and Content Scanner Tools earlier than 25.3.0.5525. Cisco Secure Email Cloud is already fixed.

Severity. CVSS 9.8 (Critical). An email gateway sees every inbound message, making it a valuable foothold.

What to do. — click a step to check it off, click any code snippet to copy it

1. Update Content Scanner Tools to 25.3.0.5525 or later (no restart), or upgrade AsyncOS to 15.5.5-014 or 16.5.0-780; 16.0 users must migrate.
2. Run grep "System Security" system_logs on every appliance and cluster member, and check firewall logs for unexpected transfers.
3. For a suspected compromise of a virtual appliance, preserve forensic data first, then rebuild on a fixed release without importing old configuration files, and renew credentials and keys.

3. Ivanti Connect Secure zero-day deadline is Friday (CVE-2026-104935)

What's new. We covered this flaw yesterday while the fix was still pending. Ivanti has now published the fixed versions: 22.8R2.5, 25.1.1.2, and 25.1.3.0/25.1.3.1. The privilege-escalation half of the chain is still unpatched.

What happened. Ivanti disclosed CVE-2026-104935 on October 13, and CISA urged immediate patching with an October 16 deadline for federal agencies. Volexity reports that a criminal actor it tracks as UTA0576 has exploited it since at least October 3. The actor chained it with the still-unpatched privilege escalation bug to gain root on fully patched appliances, then extracted credentials and Active Directory data and tampered with logs.

Who is affected. Connect Secure 22.8R2.4 and earlier, 25.1.1.1 and earlier, and 25.1.2.2 and earlier. CVSS 8.6. Ivanti says reliable indicators of compromise aren't available, and the actor evaded Ivanti's Integrity Checker Tool.

What to do. — click a step to check it off

1. Upgrade to 22.8R2.5, 25.1.1.2, or 25.1.3.0/25.1.3.1, and apply Ivanti's privilege escalation fix when it ships.
2. Hunt for inbound requests carrying an X-DSCGI-PATH header.
3. If compromise is suspected, follow CISA's steps: back up the configuration, factory reset and upgrade, restore, reset all domain, admin and local passwords, and reissue certificates and API keys.

4. Phishing service that impersonated couriers, tax agencies and banks disrupted

What happened. On October 14, Microsoft's Digital Crimes Unit and Threat Intelligence team, with law enforcement, Health-ISAC, Japan's JC3, Resecurity and others, disrupted a Chinese-speaking phishing ecosystem. Microsoft attributes three kits (CoGUI, Haozi and Iron Man System) to a group it tracks as Storm-2990.

Who is affected. Microsoft says the kits sent over one billion phishing emails and texts since January to more than 75,000 organizations, including healthcare, financial and IT firms. Resecurity found the most-imitated brands were DHL (dhl.com), DPD (dpd.com), Apple (apple.com) and GLS (gls-group.com), followed by Spain's tax agency, American Express and Amazon. Lures warn of unpaid tolls, traffic fines or missed deliveries.

Technique. Brand-impersonation pages on frequently rotated domains registered by the kit's customers. The aim is credential and card theft, then account takeover. Neither Microsoft nor Resecurity published the individual lookalike domains, and Resecurity says the operation was still active at the time of its report.

What to do. — click a step to check it off

1. Block the operator infrastructure Resecurity published, and filter newly registered domains.
2. Use phishing-resistant MFA or passkeys, especially for admins, and limit MFA registration to trusted devices.
3. Monitor new domain registrations and Certificate Transparency logs for your brand, and enforce DMARC at p=reject.
4. Tell staff and customers to reach couriers, toll agencies and banks by typing the address or using a bookmark. Password managers and passkeys will not fill in on a lookalike site.

Compliance and personal data

This section is general information, not legal advice.

Also notable

Touchpoint's Take

The appliances trusted to protect the network are being used to get into it. Firewalls, VPNs and email gateways are exposed by design, run with high privilege and often sit outside endpoint monitoring. Keep an inventory of every internet-facing appliance, keep management interfaces off the internet, patch these devices within days, and bring them into logging and threat hunting.

The phishing takedown shows that controls must hold up when people are in a hurry. Passkeys, phishing-resistant MFA and simple reporting channels take that burden off individuals. When incidents happen, the people whose data is involved deserve prompt, plain-language notice and practical help.

If you would like help assessing your exposure or notification readiness, Touchpoint Security's team is available to talk.

Sources

• Palo Alto Networks: CVE-2026-0322 PAN-OS Authenticated RCE in the Management Interface
• CISA Known Exploited Vulnerabilities catalog (official data feed)
• SecurityWeek: Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution
• Cisco: Secure Email Gateway Arbitrary File Write Vulnerability (cisco-sa-esa-afw-zqYJkjxp)
• The Hacker News: Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability
• Canadian Centre for Cyber Security: Ivanti security advisory (AV26-1035)
• Volexity: Chained exploitation of Ivanti Connect Secure zero-days
• Rapid7: Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)
• The Hacker News: CISA Urges Immediate Ivanti Connect Secure Updates
• BleepingComputer: Ivanti warns of Connect Secure zero-day exploited in attacks
• The HIPAA Journal: Ivanti Connect Secure Zero Day Exploited in Attacks
• Microsoft Threat Intelligence: The hidden network inside the phishing infrastructure ecosystem powering global cybercrime
• Resecurity: Iron Man and YAM Store, powering a global phishing-as-a-service ecosystem
• The Hacker News: Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages
• FTC: FTC sues operator of sextortion relief scheme
• The HIPAA Journal: July 2026 Healthcare Data Breach Report
• The Record: FTC says company netted at least $60 million charging sextortion victims
• Ahsay: Patch update for CVE-2026-105133 and CVE-2026-105134
• The Hacker News: AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes
• Microsoft Security Update Guide: CVE-2026-96951
• Help Net Security: Microsoft fixes exploited Mark of the Web bypass vulnerability
• GitGuardian: GhostAction GitHub Actions supply chain attack returns
• The Hacker News: GhostAction Compromises About 1,900 GitHub Accounts
• SecurityWeek: Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach
• US Attorney's Office, Northern District of Ohio: 14 indicted in North Korean remote IT worker conspiracy