InfraTrust warns of exploited flaws in critical network infrastructure

InfraTrust warned of active exploitation targeting flaws in critical network infrastructure, including firewalls, VPNs, and application delivery controllers, based on 133 fresh security advisories involving 18 vendors and 2,813 vulnerabilities between September 18 and October 14.

The batch included 37 critical advisories, and five carried a maximum CVSS score of 10.0. Fifty-eight of the advisories permitted remote exploitation with no authentication required. Sixteen advisories among the new batch covered flaws already in CISA’s Known Exploited Vulnerabilities catalog.

Eclypsium publishes the October InfraTrust Pulse as a monthly digest that tracks security advisories. Its scope covers network devices and servers, along with firmware, chips, and related infrastructure. The PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 received a CVSS 9.2 rating from InfraTrust Pulse. PHP disclosed the unauthenticated remote code execution flaws on October 21.

Management interfaces on firewalls, VPN gateways, application delivery controllers, and network-attached storage devices often contain embedded PHP. Because vendors build PHP into appliance firmware, customers cannot install recent PHP security updates themselves and must wait for updated vendor firmware. Palo Alto Networks and F5 confirmed exposure to PHP2Shell products with fixes still under development, while NetScaler, Check Point, and QNAP reported affected products with fixes still under development.

Citrix disclosed CVE-2026-88771 and CVE-2026-88772 for NetScaler ADC and Gateway. The disclosure came on September 27 after attacks against unpatched appliances. CISA placed CVE-2026-88779 in its KEV catalog after detecting exploitation. The NetScaler flaw affects appliances configured for SAML.

CVE-2026-104935 in Ivanti Connect Secure lets an unauthenticated remote attacker run arbitrary commands on vulnerable VPN gateways. Ivanti reported exploitation among a limited number of customers when it published the advisory. CISA later placed the flaw in its KEV catalog.

Check Point Research observed targeted attacks exploiting CVE-2026-93616 on September 12, aimed at Spark customers. The flaw in Check Point Security Management Server permits an unauthenticated attacker to run scripts on management and logging systems.

Cisco became aware of active exploitation of CVE-2026-76504 in September. The flaw lets an unauthenticated attacker bypass authentication and reach administrator access to the management API in Cisco Catalyst SD-WAN Manager.

Cisco became aware of exploitation of CVE-2026-76519 in October. A malicious e-mail attachment can lead to arbitrary file writes. It can also result in root command execution.

Arista says CVE-2026-93952 in VeloCloud Orchestrator is under active exploitation, and it disclosed CVE-2026-114625, another separate exploited flaw, in the same product. The disclosure came on October 22. CVE-2026-93952 carries maximum severity and affects the SD-WAN Edge configuration system.

Fortinet confirmed exploitation of CVE-2026-104286 in attacks. The flaw is a critical path traversal in FortiMail. It lets an unauthenticated attacker write arbitrary files through the web interface.

F5 says CVE-2026-94127 in BIG-IP APM has been exploited. It is a critical heap overflow. The vulnerability enables unauthenticated remote code execution on OAuth authorization servers.

Palo Alto Networks reported that CVE-2026-0322 was exploited in PAN-OS management interface attacks on firewalls. An authenticated administrator with network access can execute code as root through the flaw.

InfraTrust found older exploited flaws in bundled components, including an Android kernel issue found in HP LaserJet Enterprise printers and a 2020 jQuery flaw found in Dell Data Lakehouse software. The Copy Fail Linux kernel privilege escalation issue tracked as CVE-2026-31431 appears in 29 advisories spanning eight vendors. Last month, 19 advisories spanning six vendors covered the flaw.

InfraTrust says administrators should patch NetScaler and Ivanti Connect Secure first. These remote-access gateways can act as a doorway into corporate networks. InfraTrust Pulse lists the exploited NetScaler advisory CTX697096 at CVSS 9.5 and Ivanti Connect Secure CVE-2026-104935 at CVSS 8.6 as top patching priorities.

The report urges Fortinet customers to install October 22 security updates immediately. Those updates cover FortiOS, FortiManager, and FortiAnalyzer on internet-facing devices. After that, it advises attention to Check Point Security Management Server CVE-2026-93616 at CVSS 9.8 and Cisco Catalyst SD-WAN Manager. It also lists VeloCloud Orchestrator CVE-2026-93952 at CVSS 10.0 as a priority, along with FortiMail, Cisco Secure Email Gateway, affected BIG-IP APM systems, and PAN-OS management interfaces.

Eclypsium launched InfraTrust on July 22, 2026, as a knowledge base for global hardware infrastructure risk. InfraTrust Pulse serves as a monthly digest.

Eclypsium releases InfraTrust Pulse on every fourth Wednesday of the month. The digest covers security advisories, threats, and risks. It covers hardware products over 30 days.

InfraTrust collects risk data on products. Its sources include network device manufacturers and chipmakers. It also covers PC and server OEMs and AI hardware vendors.

Yuriy Bulygin, the CEO and co-founder of Eclypsium, said hardware-level attacks have become commonplace yet remain hard to monitor through individual vendor websites and notifications. He said exploitation of edge devices and VPNs grew almost eight-fold since 2024.

Since 2024, the percentage of edge devices and VPNs as a target of vulnerability exploitation grew almost eight-fold.

Yuriy Bulygin, CEO and co-founder of Eclypsium, Yahoo! Finance

InfraTrust Pulse says prevention scores can hide post-access activity. Prevention falls sharply once attackers use valid credentials. The Blue Report 2026 evaluates defenses technique by technique. It uses 338 million simulations drawn from customer production environments.

PHP released patches for CVE-2026-109618 and CVE-2026-109619 on October 21, but Palo Alto Networks, F5, NetScaler, Check Point, and QNAP said fixes for affected products remain under development. Until those patches arrive, InfraTrust advises keeping PHP-backed management interfaces off the Internet.