Edge device flaws exploited in October 2026

Between 1 and 20 October 2026, CISA added 24 entries to its Known Exploited Vulnerabilities catalogue. Seven of them were in firewalls, VPN gateways, email gateways and a remote support appliance: the edge devices a small organisation buys precisely so that nobody gets in. For every one of those seven, CISA gave US federal agencies three days to act.

The pattern behind the October edge device vulnerabilities isn't new, but this month made it hard to miss. Attackers aren't walking past the security kit. They're breaking into it, because it sits on the internet by design, runs with high privilege, and holds the credentials for everything behind it.

The October 2026 KEV entries, in order

Added to KEV	CVE	Product	What it gives an attacker
1 Oct	CVE-2026-104286	Fortinet FortiMail	Unauthenticated file write (CVSS 9.8)
4 Oct	CVE-2026-88779	Citrix NetScaler ADC / Gateway	Memory overflow, denial of service
13 Oct	CVE-2026-104935	Ivanti Connect Secure	Unauthenticated command execution (8.6)
14 Oct	CVE-2026-0322	Palo Alto Networks PAN-OS	Root code execution via the management interface
14 Oct	CVE-2026-76519	Cisco Secure Email Gateway	Unauthenticated file write (9.8)
16 Oct	CVE-2026-102764	BeyondTrust Remote Support	Authentication bypass, file operations (9.3)
16 Oct	CVE-2025-61624	Fortinet FortiOS and others	Authenticated file write (6.0)

Dates come from the CISA alerts of 14 October, 16 October and the catalogue itself; scores come from each vendor's advisory, linked below. The Citrix entry is a second NetScaler bug, separate from the one we covered in Citrix underrated this NetScaler bug, and the Citrix bulletin has the fixed builds.

BeyondTrust: 47 days of exploitation before anyone was told

This one deserves the most attention, because the timeline comes from the vendor itself.

BeyondTrust's write-up says an actor exploited a zero-day in Remote Support on 29 August 2026, against one BeyondTrust-hosted instance and one self-hosted appliance. BeyondTrust found it on 28 September, shipped a patch on 8 October, and disclosed CVE-2026-102764 on 15 October. That's 47 days between first exploitation and public disclosure. Every version up to 26.2.3 is affected. SaaS customers were patched automatically; self-hosted appliances need the BT26-05 patch, and anything older than 24.3.1 has to be upgraded first.

What the attacker did once inside is the part to read twice. Per BeyondTrust, they planted a web shell, took administrative control within minutes, read the appliance's stored secrets, used it to reach downstream systems, and deleted logs on the way out. A remote support box brokers privileged access to your whole estate. Compromise it and you've handed over the map and the keys together.

Two details from that post matter for the AI-era framing. BeyondTrust's working assessment is that the actor keeps a model of target products "in an AI context" to develop exploit chains. The company says plainly it has no forensic proof of that. And BeyondTrust's own detection sensors did fire when the attacker escalated privileges, but the automated triage in a third-party tool closed those alerts as false positives. I'd take both as reasons to shorten your own patch window rather than as reasons to panic. Whether or not an attacker uses AI, the gap between disclosure and mass exploitation is the part you control.

Cisco's email gateway: one email was enough

CVE-2026-76519 scores 9.8. An unauthenticated attacker sends an email with a crafted attachment, and if the gateway has the File Reputation service (part of Cisco's Advanced Malware Protection) enabled on a mail policy, the attacker can write arbitrary files to the underlying operating system. Cisco says its PSIRT became aware of active exploitation in October 2026. There's no workaround.

The fix lives in Content Scanner Tools 25.3.0.5525 or later, which Cisco says can be applied without a software upgrade or restart. Fixed AsyncOS releases are 15.5.5-014 and 16.5.0-780; 16.0 has to migrate.

Think about what that means. The appliance whose job is to open suspicious attachments safely was the thing an attachment broke.

Palo Alto PAN-OS: the management page on the internet

CVE-2026-0322 needs an authenticated attacker, which sounds reassuring until you read the rest. It gives root code execution on the firewall through the management interface, Palo Alto has seen very limited exploitation targeting that interface, and there are no known workarounds. The advisory is blunt that risk is highest when the management interface accepts connections from internet addresses. Cloud NGFW and Prisma Access aren't affected. Fixed builds exist for every supported branch from 10.2 to 12.2.

If your firewall's admin login page answers from the internet, that is the finding, regardless of this CVE.

Ivanti and Fortinet: the patch existed, just not everywhere

Ivanti's advisory for CVE-2026-104935 contains an uncomfortable admission. Ivanti found part of the bug itself and fixed it in Connect Secure 25.1.3.0 in July. It was still backporting the fix to older supported lines when attackers started exploiting a limited number of customers. Resolved versions are 25.1.1.2, 25.1.3.0 and later, and 22.8R2.5. Also in that advisory: the 22.7 and 22.8 lines reach end of life on 31 January 2027. That date is the next deadline for anyone still on them.

FortiMail CVE-2026-104286 (9.8) is another unauthenticated file write, this time through the IBE encryption feature over HTTP or HTTPS. Fortinet's workaround is to switch IBE off or restrict the webmail interface to trusted networks.

Then there's CVE-2025-61624, the quiet one. Fortinet published it in April 2026, rated it Medium (CVSS 6.0), and it needs an attacker who already has admin read-write access. It entered KEV in October anyway. We've argued before that CVSS alone is not a priority order, and this is the case in miniature: a medium-rated flaw that's useful to someone holding a stolen admin login.

What Cyber Essentials actually asks of edge kit

Firewalls are the first section of the scheme, and a VPN or email gateway on your internet connection is in scope like any other device. Three requirements from the NCSC's Requirements for IT Infrastructure v3.3 map straight onto this month:

Patch within 14 days. Updates must be applied within 14 days of release when the vendor rates the fix critical or high, when it fixes a CVSS v3 score of 7 or above, or when the vendor gives no severity at all. Every vendor-scored flaw in the table above clears that bar except the Fortinet 6.0. Under the new Danzell question set, failing the patching questions is an automatic fail of the whole assessment. The /cyber-essentials guide covers the rest of what changed in April.

Keep the admin interface off the internet. The firewall's administrative interface must not be reachable from the internet unless there's a documented business need, and then it must be protected by MFA or by an IP allow list plus a properly managed password. That's exactly the condition Palo Alto describes as highest risk.

Remove what's unsupported. Software that no longer gets security updates has to come out of scope or out of service. We wrote about why end-of-life software fails Cyber Essentials outright, and the Check Point gateways in the VPN flaw that skipped the login screen showed what it looks like on a perimeter device: four branches that will never get a fix.

For Cyber Essentials Plus the external test is stricter still. Per the NCSC's CE Plus test specification, any internet-facing service carrying a vulnerability scored 7.0 or above is a fail on the day of the test, with no 14-day window.

Who this is really for

A 20-person firm doesn't run a security operations centre. It runs a firewall that a reseller installed in 2021, maybe a remote support tool for the IT contractor, and an email filter it hasn't logged into since setup. That's the organisation these appliances were sold to, and it's the one least likely to notice a KEV alert on a Tuesday.

CyberSpec scans what you expose to the internet and flags end-of-life software and CVSS 7.0+ findings an assessor would likely fail you on. It won't certify you or patch anything. It tells you that the management page is answering, or that the version banner is one of the ones in the table above.

Edge device checklist

• List every internet-facing appliance: firewall, VPN, email gateway, remote support, backup server. Include the ones a reseller or contractor manages.
• For each, record the vendor, model, firmware version and support end date.
• Check the October entries above against that list today. Patch critical, high or CVSS 7+ fixes within 14 days at most, and faster for anything in KEV.
• Confirm no admin or management interface answers from the internet. If one must, put MFA or an IP allow list in front of it and write down why.
• Turn off features you don't use (FortiMail IBE, AMP File Reputation, legacy VPN modes) so a bug in them can't reach you.
• Plan replacement for anything with a published end-of-life date, starting with Ivanti 22.x before 31 January 2027.
• Forward appliance logs somewhere the appliance can't delete them.