Network-Appliance

vulnerabilities 2026-11-13
Check Point Gaia CVE-2026-123039: DynamicCLI Root Zero-Day Chained With PHP2Shell to Backdoor Gateways and Wipe ESXi
Attackers used PHP2Shell against Check Point Mobile Access portals, then an unauthenticated root socket in Gaia's DynamicCLI daemon (CVE-2026-123039), to backdoor gateways and wipe VMware ESXi hosts. Install the November Jumbo Hotfix and hunt for compromise.
active-exploitation zero-day network-appliance privilege-escalation backdoor vpn
vulnerabilities 2026-11-13
Barracuda ESG CVE-2026-116606 + CVE-2026-111560: Pre-Auth Root Chain Now Exploited, CISA KEV Deadline Today
Barracuda confirms exploitation of an ESG authorization bypass chained with a root command injection; CISA added both to KEV with a November 13 federal deadline.
active-exploitation cisa-kev authentication-bypass command-injection network-appliance email-security
vulnerabilities 2026-11-07
CVE-2026-19868: SonicWall SonicOS SSL-VPN SAML Bypass Exploited in the Wild, CISA Deadline November 20
SonicWall patched an actively exploited SonicOS SSL-VPN flaw that lets attackers with valid credentials sidestep SAML-enforced MFA; CISA added it to KEV on November 6.
active-exploitation cisa-kev authentication-bypass vpn network-appliance sonicwall
vulnerabilities 2026-11-05 Critical
Zyxel GS1900 Zero-Day CVE-2026-107441 Bypassed the CVE-2026-7273 Patch and Hit Nearly 1,000 Switches
Binarly found that attacks on ~1,000 Zyxel GS1900 switches used a separate CGI out-of-bounds write, CVE-2026-107441, that defeats the earlier CVE-2026-7273 fix; Zyxel's new firmware is out.
zero-day active-exploitation network-appliance cisa-kev rce memory-corruption
vulnerabilities 2026-11-03 High
Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527: The Missing Privilege Escalation Zero-Days in the UTA0576 Root Chain Are Patched
Ivanti has patched the two remaining Connect Secure zero-days that UTA0576 chained with the CVE-2026-104935 auth bypass to reach root; both are in CISA KEV.
ivanti vpn zero-day privilege-escalation network-appliance active-exploitation cisa-kev
vulnerabilities 2026-10-29
Cisco ASA and FTD Second SSL VPN Zero-Day Since August: CVE-2026-76418 Reloads Firewalls via Secondary Authentication Logic Flaw
Cisco patched CVE-2026-76418, an actively exploited unauthenticated flaw in ASA and FTD Remote Access SSL VPN that lets attackers force firewall reloads when secondary authentication is configured.
active-exploitation zero-day network-appliance vpn denial-of-service
vulnerabilities 2026-10-26 High
k0t Campaign Exposes 70,000+ Credentials from FortiGate, FortiWeb and GlobalProtect Edge Devices
Group-IB and NyxLab detail a suspected access-broker campaign against Fortinet and Palo Alto edge devices that leaked 70,000+ credential records, with unconfirmed ties to ransomware crews.
network-appliance vpn credential-theft access-broker ransomware active-exploitation
vulnerabilities 2026-10-25
SiteGuard WAF CVE-2026-106931: Exploited Command Injection Gives Root/SYSTEM, and Patching Can Erase the Evidence
EG Secure Solutions' SiteGuard Server Edition WAF has an exploited OS command injection in its default-on statistics feature; CISA added it to KEV and the vendor says to save diagnostics before patching.
active-exploitation cisa-kev command-injection waf network-appliance rce
vulnerabilities 2026-10-24
CVE-2026-114625: Arista VeloCloud Orchestrator SQL Injection Exploited in the Wild, Third VCO Zero-Day in Four Months
CISA added Arista VeloCloud Orchestrator SQL injection CVE-2026-114625 (CVSS 9.9) to KEV; any authenticated user can escalate to operator-level superuser on on-prem deployments.
zero-day active-exploitation cisa-kev network-appliance privilege-escalation sd-wan
vulnerabilities 2026-10-20
Unpatched Broadcom WPS Flaw Gives Radio-Range Root on ISP Gateways, No Password Required
Researcher Quentin Kaiser showed at Hexacon that Broadcom's proprietary Wi-Fi Protected Setup code can be corrupted by crafted packets, giving an attacker in radio range root code execution on home gateways with no Wi-Fi password. No CVE has been assigned.
network-appliance rce unpatched firmware wireless zero-day
deep-dives 2026-10-18
Patching Is Not Eviction: What Ivanti, BeyondTrust, and NetScaler Teach Us About Post-Patch Compromise
Three edge-appliance zero-days in six weeks, three different persistence models, and one shared lesson: the patch closes the door but doesn't remove whoever is already inside. A practical playbook for compromise assessment after you upgrade.
network-appliance zero-day incident-response detection-engineering cisa-kev infrastructure-hardening
vulnerabilities 2026-10-18
SonicWall SMA1000 CVE-2026-102255: CVSS 10.0 Pre-Auth SSRF Probed Within Two Days of Patch
SonicWall's SNWLID-2026-0017 patches CVE-2026-102255, a maximum-severity pre-auth SSRF in SMA1000 that attackers reach an internal CouchDB through; exploitation attempts began two days after the fix.
network-appliance vpn ssrf authentication-bypass sonicwall active-exploitation
vulnerabilities 2026-10-17
PEERSTITCH: Memory-Only FortiGate Implant Deployed via FortiOS CVE-2025-61624 After FortiManager Breach
Unit 42 details PEERSTITCH, a fileless implant injected into FortiOS miglogd and iked after FortiJump and a CVE-2025-61624 path traversal gave root on FortiGate firewalls.
fortinet apt network-appliance vpn privilege-escalation post-exploitation
vulnerabilities 2026-10-16 Critical
BeyondTrust Remote Support CVE-2026-102764: Unauthenticated File-Operation Zero-Day Exploited by China-Linked Armory Castle
A CVSS 4.0 9.3 unauthenticated flaw in self-hosted BeyondTrust Remote Support has been exploited since late August by a China-linked cluster Google tracks as Armory Castle; patch BT26-05-RS and assume compromise on exposed appliances.
zero-day active-exploitation cisa-kev remote-access apt network-appliance
vulnerabilities 2026-10-15
Cisco Secure Email Gateway CVE-2026-76519: Unauthenticated Root File Write via AMP Exploited in the Wild
Cisco confirms in-the-wild exploitation of CVE-2026-76519, a CVSS 9.8 path traversal in Secure Email Gateway's AMP File Reputation that lets unauthenticated attackers write files and run commands as root.
active-exploitation cisa-kev rce path-traversal network-appliance email-security cisco
vulnerabilities 2026-10-15
Palo Alto PAN-OS CVE-2026-0322: Management Interface Code Injection Gives Root on Firewalls, Exploited as Zero-Day
Palo Alto Networks patched CVE-2026-0322, a code injection flaw in the PAN-OS management interface that lets an authenticated attacker run code as root; limited exploitation observed and CISA has added it to KEV.
palo-alto pan-os zero-day active-exploitation cisa-kev rce network-appliance
vulnerabilities 2026-10-14 High
Ivanti Connect Secure CVE-2026-104935: Auth-Bypass Zero-Day Chained to Root by UTA0576, Added to CISA KEV
Ivanti patched an authentication-bypass-by-spoofing zero-day in Connect Secure that Volexity saw chained with a still-unpatched privilege escalation for root access. CISA added it to KEV with an October 16 deadline.
ivanti vpn zero-day authentication-bypass network-appliance active-exploitation cisa-kev
vulnerabilities 2026-10-05
CVE-2026-88779: NetScaler SAML Memory Overflow Zero-Day Crashes Auth, Hits Freshly Patched Appliances
Citrix confirms exploitation of a NetScaler ADC/Gateway SAML memory overflow (CVSS 8.7) that crashes authentication services; honeypot data suggests appliances patched for the previous batch are also being hit.
active-exploitation cisa-kev zero-day network-appliance authentication-bypass vpn
2026-10-04
Two Parsers, One URL: The Interpretation-Conflict Bug Is Eating Authentication in 2026
Cisco SD-WAN, UniFi OS, Starlette and Clerk all fell to the same flaw this year: the component that decides who gets in and the component that decides where the request goes read the URL differently. Here is why it keeps happening and how to stop shipping it.
opinion authentication-bypass network-appliance detection-engineering infrastructure-hardening
vulnerabilities 2026-10-02
MikroTik RouterOS CVE-2026-84411: Pre-Auth Integer Underflow in Web Management Gives Root RCE
CISA's ICS advisory ICSA-26-272-06 flags a CVSS 9.8 pre-authentication integer underflow in the RouterOS web management service that a single crafted HTTP request can turn into root code execution or a crash.
rce network-appliance mikrotik routeros authentication-bypass edge-devices