Firewalls & VPN
CISA Confirms Exploitation of SonicOS SSLVPN Authentication BypassNew!!
CISA confirms SonicOS SSLVPN exploitation. Upgrade affected Gen7 or Gen8 systems, verify SAML and MFA enforcement, and retain authentication evidence.
CISA Adds Two Chained Ivanti Connect Secure Flaws to KEV
CISA adds two chained Ivanti Connect Secure flaws to KEV. Apply Ivanti guidance, triage exposed appliances, preserve evidence, and meet due dates.
CISA Confirms Cisco ASA and FTD SSL VPN DoS Exploitation
CISA confirms exploitation of Cisco ASA and FTD SSL VPN CVE-2026-76418. Verify the required configuration, update, review reloads, and retain evidence.
Sophos Issues Manual Patch for UTM Pre-Auth Root RCE
Sophos UTM has a critical pre-auth root RCE in Email Protection. Apply the manual patch or migrate, validate mail flow, and retain evidence.
CISA Adds Exploited Fortinet Path Traversal to KEV
CISA added exploited Fortinet CVE-2025-61624 to KEV. Validate privileged CLI exposure, update by October 19, triage, and retain evidence.
Palo Alto PAN-OS Management RCE Is Listed as Attacked
Palo Alto confirms limited CVE-2026-0322 exploitation and lists three associated IPs. Patch PAN-OS, investigate management access, and retain evidence.
Palo Alto Revises Three PAN-OS Advisories With Available Fixes
Palo Alto revised three PAN-OS advisories after fixed builds became available. Map each product and branch, update, validate, and retain evidence.
Forcepoint Security Engine Updates Fix Policy Bypass
Forcepoint Security Engine has a policy-bypass flaw with non-contiguous affected versions and a vendor-reported exploitation signal. Match the exact branch, obtain the supported fix, and avoid inventing packet-level workarounds from the sparse public description.
F5 BIG-IP APM Hotfixes Address Critical OAuth Vulnerability
BIG-IP APM OAuth Authorization Server configurations face an exploited unauthenticated code-execution flaw. Preserve evidence, obtain F5's supported mitigation and hotfix, and keep forensic triage separate from successful patch installation.
Check Point Revises Management Server RCE Advisory for Active Exploitation
Check Point reports active exploitation of unauthenticated file upload and script execution on management and log servers. Restrict management access, apply the branch-specific hotfix, and investigate compromise; Firewall Appliance and Spark products are outside this scope.