EN PT-BR
← Voltar ao feed
critical telecommunications government

F5 weekly bulletin: actively exploited zero-days in PAN-OS, Cisco Secure Email Gateway, Ivanti Connect Secure and Windows Shell, plus PEERSTITCH on FortiGate

1 fonte(s) · 1 atualização(ões) · publicado 21/10/2026 16:34 · coletado há 1 hora

F5 Labs' weekly threat bulletin of 21 October 2026 gathers five edge-infrastructure stories, four of them involving vulnerabilities exploited in the wild. The threat cluster CL-STA-0954 (also tracked as UNC5820) breached a telecommunications managed service provider through CVE-2024-47575 on a central FortiManager server, stole configurations and private keys for more than 500 downstream FortiGate firewalls, then used CVE-2025-61624 in the FortiOS auto-script engine to obtain root and deploy the memory-resident PEERSTITCH implant. Palo Alto Networks patched CVE-2026-0322 (CVSS 8.6), an authenticated root RCE in the PAN-OS management interface exploited in limited attacks and added to CISA KEV; Cisco patched CVE-2026-76519, an unauthenticated path-traversal to root file write in the Secure Email Gateway AMP feature, exploited as a zero-day. Ivanti Connect Secure appliances were hit by the CVE-2026-104935 chain used by UTA0576 for unauthenticated root code execution on fully patched devices, combined with a still-unpatched privilege escalation flaw, and Microsoft fixed the actively exploited Windows Shell Mark-of-the-Web bypass CVE-2026-96951 (CVSS 8.8). Taken together, the bulletin describes four distinct actively exploited edge-device flaws, several of them granting root on perimeter appliances, which places the operational urgency at the top of the scale.

Entenda a falha

A vulnerabilidade

Six CVEs, all exploited in the wild. CVE-2026-76519 (Cisco Secure Email Gateway, AMP feature): relative path traversal that lets an unauthenticated remote attacker write files and run commands as root; affects instances with File Reputation enabled and Content Scanner Tools earlier than 25.3.0.5525. CVE-2026-104935 (Ivanti Connect Secure): authentication bypass plus RCE giving unauthenticated root, even on fully patched devices, chained with a still-unpatched privilege escalation; fixed in 22.8R2.5, 25.1.1.2, 25.1.3.0 or 25.1.3.1. CVE-2024-47575 (FortiManager): missing authentication. CVE-2026-96951 (Windows Shell, CVSS 8.8): Mark-of-the-Web bypass needing user interaction. CVE-2026-0322 (PAN-OS, CVSS 8.6): authenticated root RCE in the management interface. CVE-2025-61624 (FortiOS auto-script engine): path traversal to root.

Como funciona

In the Cisco case, an email attachment reaches the AMP feature, which handles its path improperly, so a crafted relative path lets the file be written outside its intended location and commands run as root. In the Fortinet chain, the actor first used the FortiManager flaw to pull configurations and keys, then opened SSL VPN sessions with cracked passwords and fed the FortiOS auto-script engine a script name containing traversal sequences to get root. For PAN-OS, a request to the management interface from an authenticated user ends in code running as root. For Ivanti, a request to the web component skips authentication and reaches code execution. For Windows Shell, a crafted file or site opened by the user is not flagged with the Mark of the Web.

Por que é vulnerável

The articles give root causes only in broad terms. Cisco's flaw is improper handling of email attachments leading to relative path traversal. CVE-2025-61624 is a path traversal in script names, and CVE-2024-47575 is a missing authentication check on FortiManager. Ivanti's chain combines an authentication bypass with an RCE. The Windows Shell flaw is a bypass of the Mark-of-the-Web protection. The articles do not explain why any of these went unnoticed or what each fix changes in the code.

Onde está

The articles name only components, not files or functions: the Cisco SEG AMP feature (File Reputation and Content Scanner Tools), the FortiOS auto-script engine, the PAN-OS management interface and Windows Shell.

Como foi descoberta

The articles describe exploitation in the wild rather than who found each flaw. Cisco's flaw was exploited as a zero-day, and Cisco mitigated cloud instances and notified customers it believed compromised. Palo Alto Networks patched CVE-2026-0322 after limited attacks, and CISA added it to KEV. UTA0576 was undocumented before an incident investigation that began on 3 October 2026 uncovered the Ivanti chain. CL-STA-0954 (UNC5820) used the Fortinet flaws against a telecom managed service provider. CISA added CVE-2026-96951 to KEV on 13 October 2026.

Explicação gerada por IA a partir da matéria e dos artigos, em 08/11/2026 11:17.

Detalhes técnicos

  • Fortinet / PEERSTITCH: after cracking reversible password hashes to open SSL VPN sessions, the actor exploited path traversal in the auto-script engine (CVE-2025-61624) for root. PEERSTITCH is a 64-bit ARM64 process injector targeting the logging daemon (logd) and IPsec VPN daemon (ikeds), allocating a 16 KB RWX buffer for a covert IPC bridge, writing no files to disk and opening no outbound ports. Persistence relied on an outbound SSH reverse shell abusing the native Apache domain management module, and the actor impersonated the FortiManager server to pull further configurations.
  • PAN-OS: CVE-2026-0322 allows an authenticated attacker with network access to the management interface to execute code as root on PA-Series and VM-Series firewalls and on Panorama virtual and M-Series appliances; Cloud NGFW and Prisma Access are not affected. CISA set a 17 October mitigation deadline. Observed attacker IPs: 66.42.72.14, 208.83.239.114, 149.248.47.234.
  • Cisco SEG: relative path traversal in improper handling of email attachments lets remote unauthenticated attackers write arbitrary files and run commands as root; only instances with File Reputation enabled and Content Scanner Tools earlier than 25.3.0.5525 are affected. Cisco mitigated cloud instances, notified likely compromised customers and warned that attackers cleared evidence after gaining root. Log strings "System Security: Suspected compromise indicator was found" and "System Security: Security scan did not complete." are indicators.
  • Ivanti: UTA0576, undocumented before an incident investigation that began 3 October 2026, chained the authentication bypass and RCE of CVE-2026-104935 with an unpatched privilege escalation flaw, focusing on domain credentials, Active Directory metadata, LAPS passwords and BitLocker recovery keys, with log tampering; lateral movement was disrupted. Host indicators: a /data/.icscap/ directory, unknown Python scripts in /tmp/, a process named dsstatmond, requests to /dana-na/auth/url_default/welcome.cgi with a mismatched X-DSCGI-PATH header, and IP 108.165.147.64.
  • Windows Shell: CVE-2026-96951 bypasses Mark of the Web but requires user interaction (opening a crafted file or visiting a malicious site). It affects Windows 10, Windows 11 and Windows Server 2012 R2 through 2025, plus Outlook.com before its service-side fix; CISA added it to KEV on 13 October 2026 with a 16 October due date.

Remediação

  • Patch CVE-2024-47575 on all FortiManager appliances and CVE-2025-61624 on FortiOS; rotate every credential, private key and certificate on firewalls managed by a potentially compromised FortiManager, inspect logd and ikeds memory maps for anonymous 16 KB executable buffers, hunt for ../ sequences in script names, and deny registration of unknown devices on FortiManager.
  • Apply PAN-OS fixes for 10.2, 11.1, 11.2, 12.1 and 12.2 (a 11.2.16 fix was scheduled for 15 October), restrict the management interface to trusted internal addresses and enable Threat Prevention signatures; block and hunt for the three attacker IPs.
  • Check SEG appliances with contentscannerstatus, upgrade to a fixed Content Scanner Tools version, search for the compromise log strings and isolate and engage Cisco TAC on any hit.
  • Upgrade Ivanti Connect Secure to 22.8R2.5, 25.1.1.2, 25.1.3.0 or 25.1.3.1 or later, noting the privilege escalation flaw remains unfixed with a patch expected in the following weeks, and hunt the listed host and network indicators.
  • Deploy the October 2026 Microsoft updates (Windows 11 23H2 build 22631.7652, 24H2 26100.9711, 25H2 26200.9711, Windows Server 2025 26100.33650) and alert on Explorer or Office spawning script interpreters and on execution from Downloads, %TEMP% or %APPDATA%.

Linha do tempo

  1. f5.com ↗ · pub. 21/10/2026 16:34 · coletado 08/11 11:00 primeiro registro

    F5 weekly bulletin: actively exploited zero-days in PAN-OS, Cisco Secure Email Gateway, Ivanti Connect Secure and Windows Shell, plus PEERSTITCH on FortiGate

    ler a análise desta fonte

    F5 Labs' weekly threat bulletin of 21 October 2026 gathers five edge-infrastructure stories, four of them involving vulnerabilities exploited in the wild. The threat cluster CL-STA-0954 (also tracked as UNC5820) breached a telecommunications managed service provider through CVE-2024-47575 on a central FortiManager server, stole configurations and private keys for more than 500 downstream FortiGate firewalls, then used CVE-2025-61624 in the FortiOS auto-script engine to obtain root and deploy the memory-resident PEERSTITCH implant. Palo Alto Networks patched CVE-2026-0322 (CVSS 8.6), an authenticated root RCE in the PAN-OS management interface exploited in limited attacks and added to CISA KEV; Cisco patched CVE-2026-76519, an unauthenticated path-traversal to root file write in the Secure Email Gateway AMP feature, exploited as a zero-day. Ivanti Connect Secure appliances were hit by the CVE-2026-104935 chain used by UTA0576 for unauthenticated root code execution on fully patched devices, combined with a still-unpatched privilege escalation flaw, and Microsoft fixed the actively exploited Windows Shell Mark-of-the-Web bypass CVE-2026-96951 (CVSS 8.8). Taken together, the bulletin describes four distinct actively exploited edge-device flaws, several of them granting root on perimeter appliances, which places the operational urgency at the top of the scale.

    Technical Details

    • Fortinet / PEERSTITCH: after cracking reversible password hashes to open SSL VPN sessions, the actor exploited path traversal in the auto-script engine (CVE-2025-61624) for root. PEERSTITCH is a 64-bit ARM64 process injector targeting the logging daemon (logd) and IPsec VPN daemon (ikeds), allocating a 16 KB RWX buffer for a covert IPC bridge, writing no files to disk and opening no outbound ports. Persistence relied on an outbound SSH reverse shell abusing the native Apache domain management module, and the actor impersonated the FortiManager server to pull further configurations.
    • PAN-OS: CVE-2026-0322 allows an authenticated attacker with network access to the management interface to execute code as root on PA-Series and VM-Series firewalls and on Panorama virtual and M-Series appliances; Cloud NGFW and Prisma Access are not affected. CISA set a 17 October mitigation deadline. Observed attacker IPs: 66.42.72.14, 208.83.239.114, 149.248.47.234.
    • Cisco SEG: relative path traversal in improper handling of email attachments lets remote unauthenticated attackers write arbitrary files and run commands as root; only instances with File Reputation enabled and Content Scanner Tools earlier than 25.3.0.5525 are affected. Cisco mitigated cloud instances, notified likely compromised customers and warned that attackers cleared evidence after gaining root. Log strings "System Security: Suspected compromise indicator was found" and "System Security: Security scan did not complete." are indicators.
    • Ivanti: UTA0576, undocumented before an incident investigation that began 3 October 2026, chained the authentication bypass and RCE of CVE-2026-104935 with an unpatched privilege escalation flaw, focusing on domain credentials, Active Directory metadata, LAPS passwords and BitLocker recovery keys, with log tampering; lateral movement was disrupted. Host indicators: a /data/.icscap/ directory, unknown Python scripts in /tmp/, a process named dsstatmond, requests to /dana-na/auth/url_default/welcome.cgi with a mismatched X-DSCGI-PATH header, and IP 108.165.147.64.
    • Windows Shell: CVE-2026-96951 bypasses Mark of the Web but requires user interaction (opening a crafted file or visiting a malicious site). It affects Windows 10, Windows 11 and Windows Server 2012 R2 through 2025, plus Outlook.com before its service-side fix; CISA added it to KEV on 13 October 2026 with a 16 October due date.

    Remediation

    • Patch CVE-2024-47575 on all FortiManager appliances and CVE-2025-61624 on FortiOS; rotate every credential, private key and certificate on firewalls managed by a potentially compromised FortiManager, inspect logd and ikeds memory maps for anonymous 16 KB executable buffers, hunt for ../ sequences in script names, and deny registration of unknown devices on FortiManager.
    • Apply PAN-OS fixes for 10.2, 11.1, 11.2, 12.1 and 12.2 (a 11.2.16 fix was scheduled for 15 October), restrict the management interface to trusted internal addresses and enable Threat Prevention signatures; block and hunt for the three attacker IPs.
    • Check SEG appliances with contentscannerstatus, upgrade to a fixed Content Scanner Tools version, search for the compromise log strings and isolate and engage Cisco TAC on any hit.
    • Upgrade Ivanti Connect Secure to 22.8R2.5, 25.1.1.2, 25.1.3.0 or 25.1.3.1 or later, noting the privilege escalation flaw remains unfixed with a patch expected in the following weeks, and hunt the listed host and network indicators.
    • Deploy the October 2026 Microsoft updates (Windows 11 23H2 build 22631.7652, 24H2 26100.9711, 25H2 26200.9711, Windows Server 2025 26100.33650) and alert on Explorer or Office spawning script interpreters and on execution from Downloads, %TEMP% or %APPDATA%.