New Exploits Target Cisco and Ivanti Gateways
Researchers uncovered active code execution and system compromise vulnerabilities in major network appliances.
Updated on Oct. 16, 2026 in Cybersecurity
Live Poll
Do you trust major technology companies to secure enterprise software against zero-day exploits?
Security researchers have identified active exploits targeting critical vulnerabilities in Cisco, Palo Alto, and Ivanti network hardware. Vendors have issued patches for most of these flaws, though certain privilege escalation risks in Ivanti Connect Secure remain unaddressed.
Why it matters
These vulnerabilities allow attackers to bypass standard defenses to gain administrative or root-level access to sensitive network infrastructure. Identifying these gaps is essential for organizations to secure their gateways against persistent threats.
The vulnerabilities include CVE-2026-76519, which permits directory traversal in Cisco Secure Email Gateways, and CVE-2026-0322, an authenticated remote code execution flaw in Palo Alto PAN-OS. Ivanti systems currently face a chain of three distinct vulnerabilities that can lead to full system compromise.
The players
Cisco
A global provider of networking hardware, security gateways, and enterprise software.
Palo Alto Networks
A cybersecurity firm specializing in enterprise firewalls and network security platforms.
Ivanti
A software company focused on IT asset management and secure network access solutions.
The details
Attackers leverage these vulnerabilities to execute unauthorized code or save files by manipulating system paths, a process known as directory traversal. The Panchan crypto-mining worm, written in Golang, further complicates this landscape by stealing SSH keys to move laterally across Unix systems. Once access is established, the worm installs a rootkit—a set of tools designed to hide malicious processes and ensure persistent unauthorized access to the host.
Timeline
October 16, 2026: Researchers disclosed the active exploits during a podcast recording in Amsterdam.
The Tech Race
These exploits highlight a shift where attackers utilize multi-stage chains to compromise enterprise gateways. This discovery places Ivanti Connect Secure at the center of an ongoing race between security researchers and actors deploying worms like Panchan.
IT administrators should prioritize immediate deployment of vendor-provided patches for Cisco and Palo Alto systems to close identified RCE pathways. Organizations using Ivanti Connect Secure must implement heightened monitoring for unauthorized system access until the privilege escalation vulnerability is patched.
The takeaway
The rapid emergence of these exploits underscores the critical need for constant patching of edge-facing network appliances. Watch for future security bulletins from Ivanti regarding the resolution of the remaining privilege escalation flaw.
Further reading
For broader trends in enterprise defense, visit our Cybersecurity section.
Source note: This article includes information reported by SANS Internet Storm Center.
Live Poll
Do you trust major technology companies to secure enterprise software against zero-day exploits?
