CISA Reports Active Exploitation of Palo Alto, Ivanti, BeyondTrust Edge Devices

Cluster of Edge-Device Exploits Targets Enterprise Perimeter Infrastructure

CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog between October 14 and October 20, four of which affect internet-facing security and remote-access appliances. The flaws span Palo Alto Networks firewalls, Ivanti Connect Secure VPN, BeyondTrust Remote Support, and Cisco Secure Email Gateway. All four enable attackers to gain initial access, execute arbitrary code, or bypass authentication on devices that sit at the boundary between enterprise networks and external threats.

For enterprise buyers, this is an exposure-management problem before it is a patching problem. These devices handle privileged access, encrypt traffic, and enforce access policy. Compromise at this layer gives attackers root-level control, credential harvesting capability, and direct routes into internal networks. The fact that exploitation began before patches were available in at least two cases means patching alone does not guarantee a clean state.

Palo Alto PAN-OS Flaw Grants Root Access via Management Interface

Palo Alto Networks disclosed CVE-2026-0322 on October 14, and CISA classified it as actively exploited the same day. The vulnerability affects the PAN-OS management interface and allows an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.

The issue is not that authentication is bypassed—it is that authenticated access to the management interface, which should be isolated, can escalate to full system control. Attackers who obtain credentials through phishing, credential stuffing, or prior compromise can use this flaw to take over the firewall itself. Root access on a perimeter firewall means visibility into all traffic, the ability to modify rules, and a foothold for lateral movement.

Enterprises running PAN-OS should verify whether management interfaces are reachable from untrusted networks, apply emergency patches immediately, and audit privileged access to management consoles. Security teams should also review whether out-of-band management, privileged-access management, or attack-surface monitoring tools would have detected or prevented this type of access. This incident increases scrutiny of management-plane isolation across all firewall platforms, including Fortinet FortiGate, Cisco Secure Firewall, and Check Point Quantum.

Ivanti Connect Secure Authentication Bypass Exploited as Zero-Day

CISA identified CVE-2026-104935 in Ivanti Connect Secure as exploited in attacks beginning at least October 1. The flaw is an authentication bypass with a CVSS score of 8.6 that permits a remote, unauthenticated attacker to execute arbitrary commands without user interaction. Ivanti Connect Secure is the company's SSL-VPN and remote-access appliance, formerly one of the most widely deployed enterprise VPN platforms.

The vulnerability was exploited as a zero-day, meaning attackers had access before a patch was available. That creates a forensics problem: organizations that patched promptly may still have compromised credentials, persistence mechanisms, or lateral movement inside their networks. Patching stops new exploitation but does not undo what happened before the patch.

This is the latest in a series of edge-device compromises involving legacy VPN appliances. It strengthens the case for replacing appliance-centric VPN access with identity-aware, zero-trust network access products from Zscaler, Netskope, Cloudflare, Cisco, and Palo Alto Networks. Enterprises affected by this flaw should budget for incident-response validation, appliance forensics, credential rotation, and potentially accelerated migration timelines.

BeyondTrust Remote Support Flaw Exposes Privileged Administration

CISA reported active exploitation of CVE-2026-102764, a critical authentication-bypass vulnerability affecting self-hosted BeyondTrust Remote Support through version 26.2.3. The flaw has been used for initial access, persistence, privilege escalation, and lateral movement.

BeyondTrust Remote Support, formerly Bomgar, is used by IT and security teams to administer endpoints, troubleshoot systems, and provide third-party vendor access. Compromise at this layer gives attackers the same privileged access that administrators use to manage the environment. That includes credential harvesting, session hijacking, and the ability to move laterally across the network under the guise of legitimate remote-support activity.

Enterprises should inventory self-hosted remote-support servers, restrict administrative access to known IPs or identity-aware proxies, review session logs for anomalous activity, and rotate credentials and API tokens. The incident may accelerate demand for cloud-hosted or zero-trust remote-support architectures, although cloud deployment does not eliminate identity or vendor-access risk. Buyers evaluating remote-support platforms—including TeamViewer, ConnectWise ScreenConnect, AnyDesk, and Splashtop—should demand stronger tenant isolation, just-in-time administration, session recording, and rapid emergency-patch mechanisms.

SafePay Ransomware Group Targets Vulnerable Security Appliances

CISA's October 20 advisory on SafePay ransomware says the group has been highly active since August 2024 against businesses and critical infrastructure across North America, South America, Europe, and Australia. The group obtains access through stolen or guessed passwords, phishing, and exploitation of vulnerabilities in security products, including CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766.

This is notable because the group is not just exploiting unpatched software—it is exploiting security appliances and infrastructure devices. The same systems that enterprises deploy to protect networks are being used as initial-access vectors. That shifts the ransomware-prevention model from endpoint-centric detection to edge-device exposure management.

Buyers should evaluate whether their ransomware programs cover identity compromise and vulnerable appliances, not only endpoint malware. Procurement criteria should include privileged-identity monitoring, immutable backup testing, lateral-movement detection, and evidence that a managed security provider can investigate edge-device compromise. This affects evaluation of Microsoft Defender, CrowdStrike Falcon, SentinelOne, Palo Alto Cortex, Sophos MDR, and managed detection and response providers.

What to Watch

Three patterns matter for enterprise buyers. First, edge-device vulnerabilities are being exploited faster than internal application flaws, and attackers are focusing on devices with privileged access. Second, patching is necessary but not sufficient—forensics, credential rotation, and validation of clean state are now part of the remediation process. Third, the argument for zero-trust architecture, identity-aware access, and out-of-band management is no longer theoretical. These incidents show that perimeter devices are high-value targets, and buyers should evaluate whether their current architecture isolates management planes, enforces least-privilege access, and detects anomalous privileged activity before attackers reach production systems.