Edge Appliances Remain the Front Door: Unauthenticated Access to Network Perimeter Gear

Three of this week's entries are pre-authentication or auth-bypass flaws in devices that sit at the network boundary, and they deserve the first slot in your triage queue. CVE-2026-104935 (Ivanti Connect Secure) is an authentication bypass by spoofing that gives a remote, unauthenticated attacker arbitrary command execution. Its deadline was October 16, so it is already overdue. CVE-2026-102764 (BeyondTrust Remote Support) is a similar spoofing-based bypass that allows file operations on the appliance. Its deadline is today, October 19. CVE-2026-76519 (Cisco Secure Email Gateway) is a relative path traversal that lets an unauthenticated remote attacker write arbitrary files to the underlying OS. Its deadline was October 17, also overdue.

These products share a risk profile: they are privileged, internet-reachable, and trusted. An SSL VPN, a remote support broker, and an email gateway each hold credentials, session material, or mail flow that attackers can use to pivot. Arbitrary file write on an email gateway is commonly a short step to a webshell or persistence. File operations on a remote support appliance can expose session tokens or enable tampering with the platform that technicians use to reach downstream endpoints.

Practical guidance:

• Treat patching as necessary but not sufficient. For Ivanti and Cisco, assume compromise if the device was exposed and unpatched during the window before the deadline, and run integrity checks and the vendor's detection tooling.
• Follow CISA's "Forensics Triage Requirements" referenced in the required action. Preserve logs, snapshots, and configuration exports before rebuilding or upgrading, since patching can destroy evidence.
• Rotate credentials, certificates, API keys, and service accounts that the appliance stored or could access. For Connect Secure, that includes LDAP/AD bind accounts and any VPN-issued secrets.
• For BeyondTrust, check for unexpected files, new accounts, and outbound connections from the appliance. Confirm whether you run a cloud-hosted instance, since BOD 26-04 cloud guidance may apply.
• If you cannot mitigate promptly, restrict management and service interfaces to known source ranges or take the device offline. The required action explicitly allows discontinuing use where mitigations are unavailable.

Chained Flaws and Trusted-Admin Abuse: Ahsay, Palo Alto, and Fortinet

This cluster is less about anonymous internet scanning and more about what happens once an attacker has some foothold, whether obtained through a chain or by abusing credentials.

Ahsay AhsayCBS is the clearest case. CVE-2026-105133 is an improper authentication flaw in the checkSysPwd function of the API component, exploited by manipulating the random parameter. CVE-2026-105134 is a command injection in the Replication Receiver's /rps/api/json/UpdateReceivers.do endpoint. CISA notes the two can be chained, which turns an authentication bypass into unauthenticated OS command execution. Both had October 17 deadlines and are overdue. AhsayCBS is backup infrastructure, so compromise gives an attacker access to backup data, stored credentials, and a possible path to destroy recovery options ahead of ransomware. Verify that neither fix alone is treated as complete, and patch both. Review whether the management and replication endpoints were ever exposed to the internet. Audit backup sets and encryption keys, and confirm the integrity of offline or immutable copies.

CVE-2026-0322 (Palo Alto Networks PAN-OS) is a code injection flaw allowing an authenticated attacker with network access to run code as root on the firewall. The authentication requirement lowers urgency only slightly. Exposed management interfaces and stolen credentials are common, and root on a firewall means access to traffic, decryption keys, and routing trust. The deadline was October 17, so it is overdue. Confirm that management interfaces are not reachable from untrusted networks, review admin accounts and recent configuration changes, and rotate administrative credentials and any stored secrets.

CVE-2025-61624 (Fortinet FortiOS, FortiPAM, FortiProxy, FortiSwitchManager) is a path traversal that lets an authenticated administrator with at least read-write permissions write or delete arbitrary files through specific CLI commands. Its deadline is today, October 19. This is a post-authentication flaw, but it matters because it can be used to tamper with files, remove logs, or establish persistence after an attacker obtains admin access. Limit admin profiles to least privilege, review CLI audit logs for unusual file operations, and check for missing or modified logs and system files.