cyber.hendryadrian.com
Security Report · bleepingcomputer.com

InfraTrust Report Warns of Exploited Flaws in Critical Network Infrastructure

· Original article ↗

Summary

Eclypsium’s October InfraTrust Pulse tracked 2,813 vulnerabilities across 133 advisories. It highlights actively exploited network-appliance flaws and warns that PHP2Shell vulnerabilities may affect embedded management interfaces awaiting vendor firmware updates.

Key points

  • InfraTrust tracked 133 new advisories across 18 vendors from September 18 to October 14, covering 2,813 vulnerabilities; 16 advisories included flaws listed in CISA’s Known Exploited Vulnerabilities catalog.
  • The report says 58 vulnerabilities could be exploited remotely without authentication; 37 advisories were rated critical and five vulnerabilities had a maximum CVSS score of 10.0.
  • The report highlights active exploitation affecting network infrastructure products from Citrix, Ivanti, Check Point, Cisco, Arista, Fortinet, F5, and Palo Alto Networks.
  • PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution. Appliances embedding PHP in management interfaces may require vendor firmware updates to receive fixes.
  • Palo Alto Networks, F5, NetScaler, Check Point, and QNAP said some products were affected while fixes were still in development.
  • InfraTrust recommends keeping PHP-backed management interfaces off the Internet while awaiting patches and prioritizing updates for exposed remote-access gateways and other listed products.
  • The report says Linux kernel privilege-escalation flaw Copy Fail (CVE-2026-31431) appeared in 29 advisories across eight vendors, up from 19 advisories across six vendors the previous month.

Article Details

Publisher
Eclypsium
Report Period
September 18–October 14, 2026
Scope
Security advisories affecting network devices, servers, firmware, chips, and other infrastructure.
Sample Size
133 advisories across 18 vendors, covering 2,813 vulnerabilities.
Key Statistics
  • 37 of the 133 advisories were rated critical.
  • Five vulnerabilities had a maximum CVSS score of 10.0.
  • 58 vulnerabilities could be exploited remotely without authentication.
  • 16 newly published advisories included vulnerabilities listed in CISA's KEV catalog as actively exploited.
Recommendations
  • Keep PHP-backed management interfaces off the Internet while awaiting PHP2Shell patches.
  • Prioritize patching NetScaler and Ivanti Connect Secure remote-access gateways.
  • Apply Fortinet's October 22 FortiOS, FortiManager, and FortiAnalyzer security updates to internet-facing devices.
  • Prioritize updates for Check Point Security Management Server, Cisco Catalyst SD-WAN Manager, VeloCloud Orchestrator, FortiMail, Cisco Secure Email Gateway, affected BIG-IP APM systems, and PAN-OS management interfaces.

CVE

CVE-2026-0322PAN-OS management interface: Palo Alto Networks reported exploitation of CVE-2026-0322 in attacks on firewalls, allowing an authenticated administrator with network access to execute code as root.CVE-2026-104286FortiMail: CVE-2026-104286 is a critical path traversal flaw that allows an unauthenticated attacker to write arbitrary files through the web interface.CVE-2026-104935Ivanti Connect Secure: CVE-2026-104935 allows an unauthenticated remote attacker to execute arbitrary commands on vulnerable VPN gateways.CVE-2026-109618The two PHP flaws, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution, and the PHP project fixed them on October 21.CVE-2026-109619The two PHP flaws, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution, and the PHP project fixed them on October 21.CVE-2026-114625Arista says it is being actively exploited and later disclosed a second, separate exploited vulnerability (CVE-2026-114625) in the same product on October 22.CVE-2026-31431CVE-2026-31431, a Linux kernel privilege escalation flaw known as Copy Fail, has now appeared in 29 advisories across eight vendors, up from 19 advisories from six vendors last month.CVE-2026-76504Cisco Catalyst SD-WAN Manager: CVE-2026-76504 allows an unauthenticated attacker to bypass authentication and gain administrator access to the management API.CVE-2026-76519Cisco Secure Email Gateway: CVE-2026-76519 can allow a malicious email attachment to lead to arbitrary file writes and command execution as root on vulnerable systems.CVE-2026-88771Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772 were disclosed on September 27 after attacks had already been observed against unpatched appliances.CVE-2026-88772Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772 were disclosed on September 27 after attacks had already been observed against unpatched appliances.CVE-2026-88779A separate NetScaler flaw, CVE-2026-88779, affecting appliances configured for SAML was also later added to CISA's KEV catalog after exploitation was detected.CVE-2026-93616Check Point Security Management Server: CVE-2026-93616 allows an unauthenticated attacker to upload and execute scripts on management and logging systems.CVE-2026-93952Arista VeloCloud Orchestrator: CVE-2026-93952 is a maximum-severity flaw affecting the system used to configure SD-WAN Edge devices.CVE-2026-94127F5 BIG-IP APM: CVE-2026-94127 is a critical heap overflow that can allow unauthenticated remote code execution on systems configured as OAuth authorization servers.

Vendors

Arista NetworksArista VeloCloud Orchestrator: CVE-2026-93952 is a maximum-severity flaw affecting the system used to configure SD-WAN Edge devices.Check PointCheck Point Security Management Server: CVE-2026-93616 allows an unauthenticated attacker to upload and execute scripts on management and logging systems.CiscoCisco Catalyst SD-WAN Manager: CVE-2026-76504 allows an unauthenticated attacker to bypass authentication and gain administrator access to the management API.CitrixCitrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772 were disclosed on September 27 after attacks had already been observed against unpatched appliances.F5F5 BIG-IP APM: CVE-2026-94127 is a critical heap overflow that can allow unauthenticated remote code execution on systems configured as OAuth authorization servers.FortinetFortinet confirmed it was exploited in attacks.IvantiIvanti Connect Secure: CVE-2026-104935 allows an unauthenticated remote attacker to execute arbitrary commands on vulnerable VPN gateways.Palo Alto NetworksPAN-OS management interface: Palo Alto Networks reported exploitation of CVE-2026-0322 in attacks on firewalls, allowing an authenticated administrator with network access to execute code as root.QNAPSoon after the disclosure, Palo Alto Networks, F5, NetScaler, Check Point, and QNAP confirmed that some of their products were affected, while they still developed fixes for appliances.

Products

Arista VeloCloud OrchestratorArista VeloCloud Orchestrator: CVE-2026-93952 is a maximum-severity flaw affecting the system used to configure SD-WAN Edge devices.BIG-IP APMF5 BIG-IP APM: CVE-2026-94127 is a critical heap overflow that can allow unauthenticated remote code execution on systems configured as OAuth authorization servers.Check Point Security Management ServerCheck Point Security Management Server: CVE-2026-93616 allows an unauthenticated attacker to upload and execute scripts on management and logging systems.Cisco Catalyst SD-WAN ManagerCisco Catalyst SD-WAN Manager: CVE-2026-76504 allows an unauthenticated attacker to bypass authentication and gain administrator access to the management API.Cisco Secure Email GatewayCisco Secure Email Gateway: CVE-2026-76519 can allow a malicious email attachment to lead to arbitrary file writes and command execution as root on vulnerable systems.FortiAnalyzerNext, it recommends Fortinet's October 22 FortiOS, FortiManager, and FortiAnalyzer security updates for internet-facing devices.FortiMailFortiMail: CVE-2026-104286 is a critical path traversal flaw that allows an unauthenticated attacker to write arbitrary files through the web interface.FortiManagerNext, it recommends Fortinet's October 22 FortiOS, FortiManager, and FortiAnalyzer security updates for internet-facing devices.FortiOSNext, it recommends Fortinet's October 22 FortiOS, FortiManager, and FortiAnalyzer security updates for internet-facing devices.Ivanti Connect SecureIvanti Connect Secure: CVE-2026-104935 allows an unauthenticated remote attacker to execute arbitrary commands on vulnerable VPN gateways.NetScaler ADCCitrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772 were disclosed on September 27 after attacks had already been observed against unpatched appliances.PAN-OSPAN-OS management interface: Palo Alto Networks reported exploitation of CVE-2026-0322 in attacks on firewalls, allowing an authenticated administrator with network access to execute code as root.

Related Articles