Attackers don't always need to bypass a company's defenses. Sometimes, taking control of one gives them exactly the access they're looking for. Firewalls control network access, email gateways intercept malicious attachments, and backup servers provide a last line of defense against ransomware. Yet compromising any one of them can give attackers privileges and opportunities that would be far harder to obtain through an ordinary application.
CISA included several vulnerabilities impacting products from Palo Alto Networks, Cisco, and Ahsay in its Known Exploited Vulnerabilities (KEV) catalog, and another vulnerability that was being actively exploited, affecting Ivanti Connect Secure, was added.
Their severity scores tell only part of the story. What matters more is how much control an attacker could gain, and how much of an organization's security would remain intact afterward.
1. Cisco Secure Email Gateway: When scanning an attachment gives attackers root access
Email security appliances check messages for potential threats before they reach employees, and Cisco's most recent vulnerability shows what happens when the inspection process becomes an entry point for an attacker. Disclosed October 14, the flaw affects the Advanced Malware Protection functionality in Cisco Secure Email Gateway. Improper handling of specially crafted email attachments can allow an unauthenticated remote attacker to write arbitrary files and execute commands with root privileges.
No employee needs to open the attachment. Under vulnerable configurations, the gateway's own inspection process can trigger the exploit Cisco confirms that affected devices must have File Reputation enabled under an applicable mail policy and be running Content Scanner Tools older than version 25.3.0.5525.
The implications go beyond faulty email filtering, since obtainable root access could reveal sensitive mail traffic, appliance credentials, and possibly other connected infrastructure. The company notes that SSH keys used for communication between clustered gateways could put other members at risk if compromised.
What to prioritize: Verify the Content Scanner Tools version, update affected installations, and inspect the system logs for compromise indicators. Cisco recommends rebuilding compromised virtual appliances rather than trusting an ordinary software upgrade to remove malicious access.
Source: Cisco Security Advisory, October 14.
2. Ivanti Connect Secure: Remote access becomes the entry point
Remote-access gateways are unusually sensitive because they let legitimate users connect to internal systems from outside the corporate network, making them a desirable target for attackers seeking a foothold.
On October 13 CISA included CVE-2026-104935 in its list of exploited vulnerabilities. The authentication-bypass flaw affects Ivanti Connect Secure and lets an unauthenticated remote attacker run arbitrary commands.
This is different from the case where stolen administrator credentials are required, since an authentication bypass can weaken the very mechanism which is meant to keep outsiders out. Successful exploitation can thus pose a serious threat to the gateway itself, and the extent of any further intrusion will depend on network segmentation, available privileges, and the systems reachable from the appliance.
In cases where organizations make use of remote-access infrastructure, their response to a problem should not be limited to verifying that a patch has been installed; they also have to determine if exploitation took place before carrying out remedial action, investigate authentication and network activity, and look into the integrity of the systems that have been affected.
What to prioritize: Identify affected Connect Secure installations, follow Ivanti's security advisory, investigate indicators of compromise, and restrict unnecessary exposure.
Source: CISA KEV entry for CVE-2026-104935.
3. AhsayCBS: Attackers reach the systems organizations rely on for recovery
Few infrastructure compromises are more concerning than attacks against backup management systems. The outcome after a ransomware attack depends on whether reliable backups are available, since if the attackers gain access to the backup system then the company's ability to recover will be compromised before the full-scale incident occurs.
AhsayCBS, a backup management platform used by service providers and businesses, contains a command-injection vulnerability tracked as CVE-2026-105134.
Exploitation can allow attackers to execute commands on affected servers without authentication. Researchers have also documented attacks in which compromised AhsayCBS servers were used to deploy cryptocurrency-mining malware.
The key point is to differentiate between the campaign as demonstrated and the broader possible consequences. The fact that cryptomining activity exists does not prove that the attackers destroyed the backups, but if a backup management server has been compromised it should be investigated whether the recovery environment is intact.
Ahsay's response also exposed another operational problem: an earlier patch did not fully resolve the vulnerabilities. The company subsequently released replacement hotfixes for affected versions.
What to prioritize: Apply the latest Ahsay hotfix, investigate potential compromise, and verify backup integrity and recovery credentials. Previously compromised servers may require additional remediation beyond patching.
Source: Ahsay security update, October 13.
4. Palo Alto Networks PAN-OS: Valid credentials become root access
Firewalls are meant to enforce boundaries between networks, and if an attacker gains control of the management interfaces of such equipment they can obtain control over the equipment which is responsible for maintaining those boundaries. Palo Alto Networks made public the CVE-2026-0322 entry on October 14, stating that the vulnerability was being actively exploited. This vulnerability enables an attacker who has already been authenticated and has access to the PAN-OS management interface to run arbitrary code with root privileges.
This is different from the Cisco and Ivanti vulnerabilities mentioned above in that attacks require existing high-level privileges. While this limits the opportunities for an attack, it should not lead the affected organisations to become careless.
If administrator passwords have been stolen, management interfaces have been exposed, or privileged accounts have been compromised, then an existing access problem can lead to full control of the firewall.
The products in question are the PA-Series and VM-Series firewalls as well as the Panorama management systems. Palo Alto has confirmed that Cloud NGFW and Prisma Access are not affected.
What to prioritize: Apply the relevant PAN-OS update, restrict management access to trusted internal addresses, and review privileged-account activity. Internet-accessible management interfaces deserve particular attention.
Source: Palo Alto Networks advisory.
5. AhsayCBS: Authentication controls fail before backup access is established
The second AhsayCBS vulnerability highlights a separate weakness in the platform's authentication mechanisms.
The issue is listed as CVE-2026-105133 and concerns incorrect authentication within an application interface. An attacker could take advantage of vulnerabilities in the way the server checks access by altering a request parameter. Although the command-injection problem poses a greater direct risk of execution, authentication failures are especially worrying in systems that manage recovery infrastructure, since the measures designed to protect backup administration are valuable precisely because attackers may want to disrupt the restoration process.
Both Ahsay vulnerabilities are confirmed as exploited, and both required additional hotfixes after earlier fixes proved incomplete.
What to prioritize: Apply the corrected hotfixes, review administrative activity, investigate potential unauthorized access, and verify that backup systems remain trustworthy.
Source: Ahsay's updated remediation notice.
Security Priorities Shaped by Vulnerabiltiies
All of the affected products have something in common; firewalls, email gateways, remote-access appliances, and backup platforms are given exceptional access because the work they carry out requires it.
Compromising one of these systems can be more valuable than exploiting an ordinary application. Attackers may gain privileged access, intercept sensitive network traffic, or disrupt the infrastructure defenders rely on during an incident.
Severity scores help organizations in understanding technical risk, but on their own they are not sufficient for determining the order in which to carry out remediation. Factors such as exposure, the attacker's prerequisites, operational importance, and confirmed exploitation should all be taken into account.