Eclypsium report details exploited flaws in firewalls, VPNs and network appliances
Original title: InfraTrust report warns of exploited flaws in critical network infrastructure
InfraTrust tracked 133 new advisories covering 2,813 vulnerabilities in a month; 16 advisories involved actively exploited KEV-listed flaws.
Eclypsium's October InfraTrust Pulse report says attackers are actively exploiting vulnerabilities in critical network infrastructure, including NetScaler, Ivanti Connect Secure, Check Point, Cisco, Arista, Fortinet, F5 and Palo Alto Networks products. It also warns that PHP2Shell flaws affect PHP embedded in appliance management interfaces, where customers cannot patch PHP themselves and must wait for vendor firmware updates. The report recommends prioritizing NetScaler and Ivanti patching and applying Fortinet's October 22 updates on internet-facing devices.
Unconfirmed: Exploitation scope claims are attributed to Eclypsium's report and the individual vendors.
- 37 of the tracked advisories were rated critical; five scored a maximum CVSS of 10.0.
- Sixteen new advisories included flaws in CISA's Known Exploited Vulnerabilities catalog.
- CVE-2026-94127 in F5 BIG-IP APM is a critical exploited heap overflow.
- PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution.
- The Copy Fail Linux kernel flaw now appears in 29 advisories across eight vendors.
Impact: unauthenticated remote code execution and initial access into corporate networks
| Product | Affected | Fixed in |
|---|---|---|
| PHP | — | fixed October 21 |
| Palo Alto Networks PAN-OS management interface | — | — |
| Citrix NetScaler ADC and Gateway | — | — |
| Ivanti Connect Secure | — | — |
- 1.Prioritize patching NetScaler and Ivanti Connect Secure remote-access gateways.
- 2.Apply Fortinet's October 22 FortiOS, FortiManager and FortiAnalyzer updates on internet-facing devices.
- 3.Ensure PHP-backed management interfaces are not exposed to the Internet while awaiting PHP2Shell firmware patches.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-0322 | Authenticated root RCE in Palo Alto PAN-OS management | 8.6 | 2% | KEV | KEV |
| CVE-2026-104286 | Unauthenticated path traversal file write in Fortinet FortiMail | 9.8 | 5% | KEVPoC ×4 | KEV |
| CVE-2026-104935 | Auth Bypass to Command Execution in Ivanti Connect Secure | 8.6 | 87% | KEVPoC ×4 | KEV |
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-114625 | SQL injection in Arista VeloCloud Orchestrator grants superuser | 9.4 | 1% | KEVPoC | KEV |
| CVE-2026-31431 | Local Privilege Escalation (Copy Fail) in Linux Kernel algif_aead Interface | 7.8 | 98% | KEVPoC ×12 | KEV |
| CVE-2026-76504 | Unauthenticated admin API auth bypass in Cisco Catalyst SD-WAN Manager | 9.8 | 39% | KEVPoC ×3 | KEV |
| CVE-2026-76519 | Relative Path Traversal to Root RCE in Cisco Secure Email Gateway | 9.8 | 2% | KEVPoC | KEV |
CVE-2026-88771+1 related CVE | Unauthenticated RCE in Citrix NetScaler ADC and Gateway | 9.5 | 82% | KEVPoC ×5 | KEV |
| CVE-2026-88779 | Unauthenticated denial of service in NetScaler ADC and Gateway | 8.7 | 11% | KEV | KEV |
| CVE-2026-93616 | Unauthenticated RCE in Check Point Management Server via Directory Traversal and File Upload | 9.8 | 92% | KEVPoC | KEV |
| CVE-2026-93952 | Unauthenticated Input-Validation Flaw in VeloCloud Orchestrator (On-Prem) | 9.5 | 1% | KEV | KEV |
| CVE-2026-94127 | Unauthenticated Heap-Overflow RCE in F5 BIG-IP APM with OAuth Profile | 9.3 | 25% | KEVPoC ×2 | KEV |
From the original article
4 min read at bleepingcomputer.com
Attackers are actively exploiting vulnerabilities across critical network infrastructure, and PHP flaws known as "PHP2Shell" put the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances at risk. [...]
By Lawrence Abrams · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.