Edge Device Zero Days, October 2026: NetScaler, PAN-OS, Ivanti, Cisco

Between 27 September and 16 October 2026, CISA added actively exploited flaws in Citrix NetScaler, Palo Alto Networks PAN-OS, Ivanti Connect Secure, Cisco Secure Email Gateway and Fortinet FortiOS to its Known Exploited Vulnerabilities catalog. If you run any of these appliances, check exposure, preserve evidence, hunt for compromise, patch, then reset credentials and sessions.

That order matters. CISA and several vendors say patching does not tell you whether someone got in first. This post collects the verified CVE IDs, dates and vendor guidance, then lays out a response playbook that works across vendors.

What happened

Every date below comes from a CISA alert, the CISA KEV catalog, or the vendor's own advisory. Where reporting disagrees, we say so in the product notes further down.

The due dates are for US federal civilian agencies. CISA's October alerts tie them to Binding Operational Directive 26-04, which applies only to those agencies, and the same alerts encourage every other organisation to treat KEV entries as a priority. A three day window is unusually short. It tells you how CISA rated the risk.

The same alerts listed items that are not edge appliances, such as Windows CVE-2026-96951 (13 Oct), two Ahsay AhsayCBS flaws (14 Oct) and Atlassian CVE-2026-21589 (15 Oct), so we leave them out. CISA also added BeyondTrust Remote Support CVE-2026-102764 on 16 October. We could not load BeyondTrust's advisory to check it, so it is not in the table.

Which products and CVEs are affected

Citrix NetScaler ADC and Gateway

Citrix's bulletin CTX697096 rates CVE-2026-88771 and CVE-2026-88772 at 9.5 under CVSS v4.0. The first is an unauthenticated code execution flaw that affects default configurations. The second is a memory overflow that matters when DTLS is enabled, which Citrix notes is the default on VPN virtual servers. Citrix states plainly: "Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed." Fixed builds are 14.1-73.37 and 13.1-64.23 or later, with separate FIPS and NDcPP builds listed in the bulletin.

CVE-2026-88779 (CTX697174) affects appliances configured as a SAML service provider or identity provider. Citrix scores it 8.7 and describes a denial of service. Fixed builds are 14.1-73.41 and 13.1-64.28 or later. If you already upgraded for the September bulletin and you use SAML, you need to upgrade again, as BleepingComputer reported Citrix saying. CISA adds a detail worth knowing: a forced reboot on an unpatched box could help an attacker run code previously planted through CVE-2026-88771.

Sources differ on exploitation of CVE-2026-88779. The Citrix bulletin we read did not state exploitation, while BleepingComputer quotes Citrix as having observed targeted attacks leading to denial of service. CISA lists it in KEV, which requires evidence of exploitation.

Ivanti Connect Secure

Ivanti disclosed CVE-2026-104935 on 13 October and said "Ivanti is aware of limited exploitation in the wild." BleepingComputer lists affected versions as 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Ivanti's advisory page did not render for us, so take fixed builds from that page directly.

Volexity, which found the activity, says exploitation began on 3 October against an appliance that was fully patched at the time. BleepingComputer reports that another firm, Defused, saw activity from 1 October. Volexity tracks the actor as UTA0576. The chain also used a privilege escalation flaw that Ivanti had not yet fixed when Volexity published, so keep watching the advisory.

The detection detail matters most here. Volexity reports that Ivanti's Integrity Checker Tool did not detect this compromise, because the attacker changed code in memory only and removed log entries. Ivanti still advises running the tool regularly. Treat a clean result as one input, not a verdict.

Palo Alto Networks PAN-OS

CVE-2026-0322 is an authenticated code injection flaw in the PAN-OS management interface, scored 8.6 under CVSS v4.0. It affects PA-Series and VM-Series firewalls and Panorama. Cloud NGFW and Prisma Access are not affected. The advisory says "Very limited exploitation has been observed targeting the Palo Alto Networks management interface." The attacker needs credentials and network access to that interface, so restricting it to trusted internal addresses cuts most of the risk.

Fixed versions vary by branch, from 10.2 hotfixes through 12.2.4. There are no workarounds; Threat Prevention signatures give limited coverage and need SSL decryption. The advisory lists three IP addresses tied to exploit attempts.

Cisco Secure Email Gateway

CVE-2026-76519 is a path traversal flaw in the Advanced Malware Protection feature, rated 9.8 under CVSS v3.1. An unauthenticated attacker can send a crafted attachment through an unpatched gateway, write files and run commands as root. It applies when File Reputation is enabled on a mail policy and Content Scanner Tools is older than 25.3.0.5525. Cisco says it learned of active exploitation in October 2026 and that "There are no workarounds that address this vulnerability."

SecurityWeek reports that the fixed AsyncOS releases, 15.5.5-014 and 16.5.0-780, shipped on 14 September, when the issue was grouped under a different CVE. If you patched in September, you may already be covered, but run the compromise check anyway. Cisco says compromise of one appliance can expose cluster SSH keys, so every cluster member needs attention.

Fortinet FortiOS and related products

CVE-2025-61624 is a medium severity path traversal in the CLI of FortiOS, FortiProxy, FortiPAM and FortiSwitchManager. Fortinet published it in April 2026 and marks it as known exploited. It needs a privileged account, which is why it scored low. Unit 42 explains why it still mattered: attackers who had stolen a FortiManager configuration archive recovered admin credentials, then used this flaw to reach root on FortiGate firewalls and install a memory resident implant called PEERSTITCH. Unit 42 says configuration data for more than 500 managed firewalls was taken, and stresses that this is exposure of credential material, not confirmed intrusion into those downstream networks.

How these attacks work

These appliances sit at the network boundary, answer requests from the whole internet, and handle authentication for everyone behind them. They hold VPN sessions, SAML trust, LDAP bind accounts, RADIUS secrets and certificates. One foothold on the device gives an attacker a view of all of that.

They also run vendor firmware. You usually cannot install an endpoint agent on them or rebuild them from your own source, and their local logs rotate quickly. Volexity reports that the Ivanti attacker deleted log entries, and Unit 42 describes an implant that leaves no binary on disk and opens no listening port. Cisco warns that an attacker with root can tamper with logs, which is why it asks you to check network and firewall logs from other systems too.

Finally, a patch closes the door but does not remove anyone already inside. CISA's NetScaler alert asks defenders to check for compromise before patching and to preserve evidence first, because updating can reduce forensic visibility. Cisco says the same for virtual appliances: upgrading destroys the forensic data.

What to do now: an edge appliance response playbook

This playbook follows vendor and CISA guidance. Placeholders such as the management address are in angle brackets inside the code blocks; replace them with your own values.

1. Build the list. Pull every KEV entry added since late September and match it against your appliance inventory.

curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json \
  | jq -r '.vulnerabilities[]
      | select(.dateAdded >= "2026-09-27")
      | [.dateAdded, .dueDate, .cveID, .vendorProject, .product] | @tsv'

2. Check versions on each device. Use the vendor's own CLI.

# Palo Alto Networks PAN-OS
show system info | match sw-version

# Cisco Secure Email Gateway (AsyncOS CLI)
version
contentscannerstatus

# Fortinet FortiOS
get system status

# Citrix NetScaler, from the appliance shell: are SAML SP or IdP profiles configured?
grep -E "add authentication saml(Action|IdPProfile)" /nsconfig/ns.conf

For Ivanti Connect Secure, read the version in the admin console and compare it with the advisory.

3. Check exposure from outside your network. Management interfaces should not answer from the internet. Citrix puts it bluntly: "The NetScaler Management Services should never be exposed to the public internet." Test from a host outside your perimeter.

curl -sk -o /dev/null -w "%{http_code}\n" --max-time 5 https://<management-address>/

Any response other than a timeout means the interface is reachable. Restrict it to a jump host or trusted internal ranges, as Palo Alto recommends for PAN-OS.

4. Preserve evidence before you patch. Citrix's compromise guide (CTX694799) asks for a VPX snapshot, logs from remote syslog and NetScaler Console, a support bundle and a core file. Cisco asks virtual appliance owners to preserve forensic data before upgrading. Forward logs to a SIEM or log store now, because local logs rotate.

5. Hunt per vendor guidance. Run the checks each vendor published.

# Cisco Secure Email Gateway, on every cluster member
grep "System Security" system_logs

# Fortinet FortiOS: review auto-scripts for unexpected entries (Unit 42 hunting guidance)
show system auto-script

For NetScaler, CISA and Citrix point to the indicators in NetScaler Console and CISA's SIGMA rules repository. For PAN-OS, search firewall and proxy logs for the three IP addresses in the advisory. For Ivanti, run the Integrity Checker Tool and, given Volexity's findings, also review network telemetry and consider memory forensics.

6. Patch to the fixed build. For NetScaler with SAML, confirm you are on the October builds, not only the September ones. For Cisco, also update Content Scanner Tools to 25.3.0.5525 or later; Cisco says that update needs no restart.

7. Reset credentials and sessions. Citrix lists what to rotate if compromise is suspected: service account passwords, LDAP and RADIUS secrets, OAuth tokens, API keys, SNMP community names, passwords for users who signed in through the device, and certificates and private keys stored on it. End active VPN and authentication sessions after patching so stolen session tokens stop working. Unit 42 makes the same point for Fortinet: stolen trust material stays valid until you rotate it.

8. Rebuild if you find anything. Citrix recommends replacing a compromised VPX and restoring from a backup that predates the compromise, after upgrading. Cisco recommends a fresh VM on a fixed release with the configuration rebuilt by hand, not imported. CISA asks for rotation of all restored secrets.

9. Watch closely afterwards. Citrix advises monitoring a rebuilt system for at least 90 days.

What would have helped

Practices any team can use

An appliance inventory you can query in minutes. Most teams know their servers better than their edge boxes. Keep a list of every VPN, gateway, firewall and mail appliance with its vendor, model, firmware version, owner and management address. When a KEV alert lands, you should be able to answer "do we run this, and which version" before lunch.

Subscriptions to vendor advisories and the KEV feed. These advisories arrived with little notice. Subscribe to each vendor's security notifications, poll the KEV JSON feed daily and route matches to the device owner.

Management planes off the internet. The PAN-OS flaw needed access to the management interface. Citrix and Palo Alto both say management services belong on internal networks only, reached through a jump host or an allow list.

Logs that live somewhere else. When attackers can delete local logs, the only reliable record is the copy that already left the box. Forward appliance logs to a central store with retention longer than your detection time.

A rehearsed patch path for appliances. Firmware upgrades on a VPN concentrator need a change window and a failover pair. Practise it; the federal windows here were three days.

Credential hygiene behind the device. Scope the service accounts edge devices use tightly and rotate them on a schedule, so a forced rotation is routine.

Where Safeguard fits

Be clear about the boundary. These appliances run vendor firmware. Safeguard scans repositories, container images and SBOM files, which means it covers software you build and ship. It does not scan a NetScaler, a FortiGate or an email gateway, it does not hunt for implants on them, and it would not have prevented any of these compromises.

Here is where it does help in a week like this one:

• Your own exposed code. The same weeks brought flaws in software teams build on, such as PHP2Shell. Safeguard generates SBOMs and scans dependencies in repos, images and SBOM files (safeguard scan --dir ., --image <name>, --sbom <file>, with JSON results under ./output), and the platform shows which projects contain a given component and version.
• Prioritising by exploitation. Vulnerability matching includes KEV enrichment, and reachability analysis helps separate findings that matter from noise, so a KEV listed library flaw in your code rises to the top.
• Vendor SBOMs, where you get them. If an appliance vendor gives you an SBOM, safeguard scan --sbom <file> will check the third-party components it declares. It cannot find a zero-day in the vendor's own code, and it is only as complete as the file.
• Scripting the response. The Safeguard CLI's assistant can write and run a script like the KEV filter above against your inventory file, asking before each command. /permissions lets you choose Ask, Accept edits, Plan, Auto (the default) or Strict.
• Gates and fixes for your software. Policies and gates evaluated in the platform can block a release that carries a KEV listed component, and autonomous remediation can open fix PRs (it ships off by default).

For component level response, see finding affected products fast with an SBOM. For the wider month, see October 2026 security incidents and what would have helped.

Common mistakes

Patching and calling it done. Every vendor here, and CISA, says to check for compromise. A patched appliance with a live implant is still compromised.

Patching before preserving evidence. Upgrading can wipe the very memory and logs an investigator needs. Snapshot first where you can.

Trusting a single integrity check. Volexity's Ivanti findings show a clean Integrity Checker result is not proof. Combine vendor tools with network logs.

Rotating the admin password and stopping. The device held LDAP, RADIUS, SAML and certificate secrets. Rotate those too, and end live sessions.

Assuming the September patch covered October. NetScaler customers using SAML needed a second upgrade.

FAQ

Are all of these flaws unauthenticated?

No. The NetScaler, Ivanti and Cisco flaws can be exploited without credentials, according to their advisories. The PAN-OS flaw needs authenticated access to the management interface, and the Fortinet flaw needs a privileged account. Unit 42 shows how attackers got those credentials through an earlier breach.

I am not a US federal agency. Do the KEV deadlines apply to me?

Not legally. BOD 26-04 binds federal civilian agencies. CISA still encourages every organisation to prioritise KEV entries, and the short windows reflect how serious CISA judged these.

Is it enough to run the vendor's integrity checker?

Run it, but do not stop there. Volexity reports Ivanti's tool missed a memory-only compromise, and Cisco warns that root access lets an attacker tamper with logs. Cross-check with network and firewall logs from other systems.

Does Safeguard scan my firewall or VPN appliance?

No. Safeguard scans repositories, container images and SBOM files. Appliance firmware is outside that scope unless the vendor provides an SBOM, and even then it shows third-party components only.

Were any of these patched before they were exploited?

Cisco's fixed AsyncOS releases shipped in September, before Cisco announced exploitation in October, per SecurityWeek. Fortinet's advisory dates from April 2026. The NetScaler, Ivanti and PAN-OS flaws were exploited before or at disclosure.

Try it yourself

If you want to see the CLI work through a fix on a real repo, you can download Safeguard and read the CLI documentation.

This demo shows a real CLI session that fixes a lodash CVE in a repo, asking before each command and pushing nothing.

Click through it at your own pace, or open it full screen.

This demo shows how to set up the runner on your own machine, approve it with a device code and scan from the terminal.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• CISA: Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway
• CISA: Adds Two Known Exploited Vulnerabilities to Catalog (13 Oct 2026)
• CISA: Adds Four Known Exploited Vulnerabilities to Catalog (14 Oct 2026)
• CISA: Adds One Known Exploited Vulnerability to Catalog (15 Oct 2026)
• CISA: Known Exploited Vulnerabilities Catalog
• CISA: KEV catalog JSON feed
• Citrix: CTX697096, NetScaler ADC and Gateway Security Bulletin for CVE-2026-88771 through CVE-2026-88778
• Citrix: CTX697174, Security Bulletin for CVE-2026-88779
• Citrix: CTX694799, Steps to Take if NetScaler ADC is Suspected to be Compromised
• Palo Alto Networks: CVE-2026-0322 PAN-OS Authenticated RCE in the Management Interface
• Cisco: Secure Email Gateway Arbitrary File Write Vulnerability (cisco-sa-esa-afw-zqYJkjxp)
• Fortinet: FG-IR-26-122, Path Traversal in CLI
• Ivanti: October 2026 Security Update
• Volexity: Chained Exploitation of Ivanti Connect Secure Zero-Days
• Unit 42: FortiManager CVE-2024-47575 and PEERSTITCH malware
• BleepingComputer: Ivanti warns of Connect Secure zero-day exploited in attacks
• BleepingComputer: Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks
• BleepingComputer: Cisco patches actively exploited Secure Email Gateway zero-day
• BleepingComputer: Citrix patches NetScaler SAML zero-day exploited in attacks
• The Hacker News: Two unpatched Citrix NetScaler flaws exploited
• SecurityWeek: Cisco warns of exploited Secure Email Gateway vulnerability

Last reviewed: 21 October 2026. This is a developing story; check the linked advisories for the latest status.