The third week of October brought an exceptionally concentrated wave of attacks targeting edge network devices and remote access systems. Reviewing security bulletins mid-week made it immediately clear that nearly all key vulnerabilities disclosed recently have landed in the CISA KEV catalog with active exploitation flags.
Administrators face a critical bug in Cisco Secure Email Gateway where ordinary email attachments enable root takeover, a management panel flaw in Palo Alto PAN-OS, a zero-day in BeyondTrust Remote Support leveraged by Armory Castle, active exploitation of Plex Media Server instances deploying XMRig cryptominers, as well as ongoing issues in Ivanti and Fortinet gateways.
1. Cisco Secure Email Gateway: Remote Root via Email Attachment (CVE-2026-76519, CVSS 9.8)
The most severe new vulnerability this week is a flaw in Cisco Secure Email Gateway appliances. Vulnerability CVE-2026-76519 received a critical CVSS 3.1 base score of 9.8 and is actively being exploited in the wild.
The defect resides in the Advanced Malware Protection (AMP) engine, specifically in email attachment handling when file reputation checking is enabled. An unauthenticated attacker requires no user accounts; sending a crafted message triggers a path traversal flaw (CWE-23) allowing arbitrary file writes and remote code execution with full root privileges.
- Identifier: CVE-2026-76519
- Base Score: CVSS 9.8 (Critical)
- Exploitation Status: Active in-the-wild exploitation, CISA KEV listed
- Affected Systems: Cisco Secure Email Gateway AsyncOS 15.x and 16.x
- Mitigation: Upgrade AsyncOS to version 15.5.5-014 or 16.5.0-780
- Source: Cisco PSIRT Advisory
2. Palo Alto Networks PAN-OS: Management Interface Code Execution (CVE-2026-0322, CVSS 8.6)
Palo Alto Networks issued an advisory warning about vulnerability CVE-2026-0322 in PAN-OS software, rated 8.6 under CVSS 3.1. The defect allows arbitrary code execution with root privileges on the firewall. CISA added the flaw to the KEV catalog on October 14 following observed exploitation attempts.
- Identifier: CVE-2026-0322
- Base Score: CVSS 8.6 (High)
- Exploitation Status: Exploitation attempts observed, CISA KEV listed
- Affected Systems: Palo Alto PAN-OS branches 10.2, 11.1, 11.2, 12.1, and 12.2
- Mitigation: Install vendor hotfixes; strictly isolate management interfaces
- Source: Palo Alto Security Advisory
3. BeyondTrust Remote Support: Armory Castle Zero-Day (CVE-2026-102764, CVSS 9.8)
BeyondTrust published disclosures concerning a vulnerability in Remote Support (formerly Bomgar). Vulnerability CVE-2026-102764 carries a CVSS 3.1 base score of 9.8. The flaw was exploited as a zero-day in targeted attacks since August 2026 by the China-linked espionage threat group Armory Castle (UNC5221).
- Identifier: CVE-2026-102764
- Base Score: CVSS 9.8 (Critical)
- Exploitation Status: Targeted APT exploitation (Armory Castle / UNC5221)
- Affected Systems: BeyondTrust Remote Support up to version 26.2.3
- Mitigation: Upgrade on-premise instances to version 26.2.4
- Source: BeyondTrust Security Blog
4. Plex Media Server: Plex2Shell Exploited in the Wild to Deploy Cryptominers
Active exploitation of exposed Plex Media Server instances has been detected in the wild. Threat actors are leveraging Plex2Shell, a public exploit chain combining four separate flaws (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656) to achieve unauthenticated remote code execution.
The attack initiates with an SSRF vulnerability targeting /player/timeline/subscribe, bypassing authentication to reach internal management functions. The exploit writes an arbitrary file and abuses an unsigned media codec loader to execute payloads. In-the-wild telemetry shows compromised instances being infected with XMRig cryptocurrency miners and proxy binaries.
- Identifiers: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656 (Plex2Shell chain)
- Impact: Unauthenticated RCE, XMRig cryptominers, residential proxy abuse
- Affected Systems: Plex Media Server prior to 1.43.3.10828 (Docker and NAS deployments)
- Mitigation: Upgrade Plex Media Server to 1.43.3.10861 or later; inspect process trees
- Source: Cyber Security News
5. Ivanti Connect Secure & Fortinet: VPN Gateway Flaws
Ivanti disclosed authentication bypass vulnerability CVE-2026-104935 (CVSS 8.6), which is actively exploited in the wild (CISA KEV). Additionally, Fortinet path traversal vulnerability CVE-2025-61624 remains under active observation tied to the PEERSTITCH malware campaign.
- Ivanti: CVE-2026-104935 (CVSS 8.6, Authentication Bypass, patches in 25.1.3.0 / 22.8R2.5)
- Fortinet: CVE-2025-61624 (Path Traversal in CLI, PEERSTITCH campaign)
- Sources: Ivanti Advisory / Fortinet Advisory
Action Items for Today
- Patch Cisco Secure Email Gateway: Apply AsyncOS hotfixes 15.5.5-014 or 16.5.0-780.
- Palo Alto PAN-OS: Firewall management interfaces from the public internet.
- BeyondTrust Remote Support: Upgrade on-premise appliances to version 26.2.4.
- Patch Plex Media Server: Upgrade instances to 1.43.3.10861+ (especially Docker and NAS units) and inspect processes.
- Ivanti & Fortinet: Deploy vendor firmware updates.
