Between September 18 and October 14, InfraTrust tracked 133 new security advisories across 18 vendors, covering 2,813 vulnerabilities — a concentrated burst of risk that included 37 critical advisories and five with a maximum CVSS score of 10.0.
Scale and urgency: what InfraTrust measured
Eclypsium’s October InfraTrust Pulse found that of the 2,813 vulnerabilities tracked in that four-week window, 58 could be exploited remotely without authentication and 16 newly published advisories listed vulnerabilities already included in CISA’s Known Exploited Vulnerabilities (KEV) catalog. InfraTrust flagged active exploitation in multiple products and emphasized that these are not theoretical risks: several flaws were observed in the wild before public disclosure.
Actively exploited edge and management appliances — the CVEs named
The report highlights a set of high-impact, actively exploited flaws that affect devices at enterprise perimeters or those used to manage infrastructure. InfraTrust names specific, exploited vulnerabilities including:
- Citrix NetScaler ADC and Gateway — CVE-2026-88771 and CVE-2026-88772 (disclosed September 27 after attacks were observed); a separate NetScaler SAML-related flaw, CVE-2026-88779, was later added to CISA’s KEV catalog after detected exploitation.
- Ivanti Connect Secure — CVE-2026-104935, which allows unauthenticated remote command execution on VPN gateways; Ivanti reported exploitation of a limited number of customers and CISA added it to the KEV.
- Check Point Security Management Server — CVE-2026-93616 permits unauthenticated upload and execution of scripts; Check Point Research reported targeted exploitation on September 12 against Spark customers.
- Cisco Catalyst SD-WAN Manager — CVE-2026-76504 allows unauthenticated authentication bypass to gain administrator access; Cisco reported active exploitation in September.
- Arista VeloCloud Orchestrator — CVE-2026-93952 (maximum severity) and a second exploited vulnerability, CVE-2026-114625 (disclosed October 22), both enabling compromise of SD-WAN management.
- FortiMail — CVE-2026-104286, a critical path traversal enabling unauthenticated arbitrary file writes; Fortinet confirmed exploitation in attacks.
- Cisco Secure Email Gateway — CVE-2026-76519, which can allow a malicious attachment to trigger arbitrary file writes and root command execution; Cisco learned of exploitation in October.
- F5 BIG-IP APM — CVE-2026-94127, a critical heap overflow leading to unauthenticated remote code execution on systems configured as OAuth authorization servers; F5 reported exploitation.
- Palo Alto Networks PAN-OS management interface — CVE-2026-0322, exploited in attacks that allowed an authenticated administrator with network access to execute code as root.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramblePHP2Shell: embedded PHP, vendor firmware, and the update chokepoint
InfraTrust warns that the so-called PHP2Shell flaws — CVE-2026-109618 and CVE-2026-109619 — present a separate, acute problem for network appliances because many vendors embed PHP directly into appliance management interfaces. The PHP project released fixes on October 21, but appliances that compile PHP into firmware generally cannot be patched by customers; instead, each vendor must rebuild and reissue firmware or software that includes the patched PHP.
Soon after disclosure, Palo Alto Networks, F5, NetScaler, Check Point, and QNAP confirmed that some of their products were affected while they developed fixes. InfraTrust therefore recommends that administrators ensure PHP-backed management interfaces are not exposed to the Internet while waiting for vendors’ PHP2Shell patches.
Bundled components, recurring flaws, and the copy-paste danger
InfraTrust also flagged a broader supply-chain pattern: vendors frequently bundle third-party components and ship older, exploitable versions inside appliances. The Linux kernel privilege-escalation flaw known as Copy Fail (CVE-2026-31431) has appeared in 29 advisories across eight vendors, up from 19 advisories across six vendors the prior month. InfraTrust also found older exploited flaws in bundled components, including an Android kernel issue in HP LaserJet Enterprise printers and a 2020 jQuery vulnerability in Dell Data Lakehouse software, underscoring that legacy or embedded components remain a persistent attack surface.
What this means for technologists, procurement leaders, and adversaries
- Technologists and security teams: InfraTrust recommends prioritizing patching of Citrix NetScaler and Ivanti Connect Secure first because these remote-access gateways can provide initial access into corporate networks. Next in priority are Fortinet’s October 22 updates for FortiOS, FortiManager, and FortiAnalyzer for internet-facing devices; afterward, focus on Check Point Security Management Server, Cisco Catalyst SD-WAN Manager, Arista VeloCloud Orchestrator, FortiMail, Cisco Secure Email Gateway, affected BIG-IP APM systems, and PAN-OS management interfaces. Administrators should also ensure PHP-backed management interfaces are not Internet-exposed while waiting for vendor firmware.
- Procurement and affected enterprises: built-in third-party components create a dependency on vendor patch cycles — customers cannot generally swap in updated PHP or kernel components themselves when those are compiled into firmware. Procurement leaders will need to factor vendor responsiveness on firmware rebuilds and update cadence into risk assessments and contracts.
- Adversaries and threat actors: InfraTrust notes why attackers keep targeting edge and management devices — these systems can grant initial access or serve as a springboard for broader compromise. The presence of multiple actively exploited, unauthenticated remote-code-execution flaws provides high-value targets for opportunistic and targeted attackers alike.
InfraTrust’s findings show a confluence of high-severity CVEs, embedded third-party components, and a firmware-update bottleneck that together raise the risk of rapid exploitation. The concrete test ahead is whether vendors can accelerate firmware rebuilds and whether administrators can block exposed management interfaces fast enough to blunt active campaigns.
