Patch Sonar: Firewalls, VPNs & network gear https://patchsonar.com/tech/network Exploited vulnerabilities in firewalls, vpns & network gear, in plain English. en-us Ivanti Connect Secure: An Ivanti VPN flaw lets attackers in without a password https://patchsonar.com/cve/CVE-2026-104935 https://patchsonar.com/cve/CVE-2026-104935 Tue, 13 Oct 2026 12:00:00 GMT Firewalls, VPNs & network gear Yes. Ivanti says a limited number of customers were hit before the fix came out. What to do: Upgrade Connect Secure to the fixed version. Cisco Secure Firewall Management Center: Ransomware groups are exploiting a perfect-10 Cisco firewall flaw https://patchsonar.com/cve/CVE-2026-20079 https://patchsonar.com/cve/CVE-2026-20079 Wed, 09 Sep 2026 12:00:00 GMT Firewalls, VPNs & network gear Yes. Cisco Talos tied attacks to three groups, including Qilin ransomware activity. What to do: Upgrade to Cisco's fixed build for your release, and keep the management screen off the public internet. Citrix NetScaler: A Citrix NetScaler login bypass has no workaround https://patchsonar.com/cve/CVE-2026-19490 https://patchsonar.com/cve/CVE-2026-19490 Wed, 09 Sep 2026 12:00:00 GMT Firewalls, VPNs & network gear Yes, starting soon after exploit research went public. What to do: Upgrade; Citrix says there's no workaround. If you can't upgrade right away, limit access to known IP addresses and require multi-factor sign-in. Fortinet FortiGate: Attackers are hijacking unpatched FortiGate firewalls at scale https://patchsonar.com/cve/CVE-2025-25249 https://patchsonar.com/cve/CVE-2025-25249 Wed, 09 Sep 2026 12:00:00 GMT Firewalls, VPNs & network gear Yes, widely. Researchers counted more than 30,000 targeted devices and 178 confirmed infections. What to do: Update FortiOS and confirm the new version is running. Block UDP ports 5246 to 5249 from untrusted networks, and check for the signs of compromise in Fortinet's advisory. Arista VeloCloud Orchestrator: Arista VeloCloud Orchestrator SQL Injection Vulnerability https://patchsonar.com/cve/CVE-2026-114625 https://patchsonar.com/cve/CVE-2026-114625 Fri, 23 Oct 2026 12:00:00 GMT Firewalls, VPNs & network gear Yes. CISA added this to its catalog of actively exploited vulnerabilities on Oct 23, 2026. What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. Fortinet Multiple Products: Fortinet Multiple Products Path Traversal Vulnerability https://patchsonar.com/cve/CVE-2025-61624 https://patchsonar.com/cve/CVE-2025-61624 Fri, 16 Oct 2026 12:00:00 GMT Firewalls, VPNs & network gear Yes. CISA added this to its catalog of actively exploited vulnerabilities on Oct 16, 2026. What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. Cisco Secure Email Gateway: Cisco Secure Email Gateway Relative Path Traversal Vulnerability https://patchsonar.com/cve/CVE-2026-76519 https://patchsonar.com/cve/CVE-2026-76519 Wed, 14 Oct 2026 12:00:00 GMT Firewalls, VPNs & network gear Yes. CISA added this to its catalog of actively exploited vulnerabilities on Oct 14, 2026. What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Code Injection Vulnerability https://patchsonar.com/cve/CVE-2026-0322 https://patchsonar.com/cve/CVE-2026-0322 Wed, 14 Oct 2026 12:00:00 GMT Firewalls, VPNs & network gear Yes. CISA added this to its catalog of actively exploited vulnerabilities on Oct 14, 2026. What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. Citrix NetScaler: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability https://patchsonar.com/cve/CVE-2026-88779 https://patchsonar.com/cve/CVE-2026-88779 Sun, 04 Oct 2026 12:00:00 GMT Firewalls, VPNs & network gear Yes. CISA added this to its catalog of actively exploited vulnerabilities on Oct 4, 2026. What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. Fortinet FortiMail: Fortinet FortiMail Path Traversal Vulnerability https://patchsonar.com/cve/CVE-2026-104286 https://patchsonar.com/cve/CVE-2026-104286 Thu, 01 Oct 2026 12:00:00 GMT Firewalls, VPNs & network gear Yes. CISA added this to its catalog of actively exploited vulnerabilities on Oct 1, 2026. What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability https://patchsonar.com/cve/CVE-2026-76504 https://patchsonar.com/cve/CVE-2026-76504 Wed, 30 Sep 2026 12:00:00 GMT Firewalls, VPNs & network gear Yes. CISA added this to its catalog of actively exploited vulnerabilities on Sep 30, 2026. What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. Citrix NetScaler: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability https://patchsonar.com/cve/CVE-2026-88772 https://patchsonar.com/cve/CVE-2026-88772 Sun, 27 Sep 2026 12:00:00 GMT Firewalls, VPNs & network gear Yes. CISA added this to its catalog of actively exploited vulnerabilities on Sep 27, 2026. What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. Citrix NetScaler: Citrix NetScaler Improper Input Validation Vulnerability https://patchsonar.com/cve/CVE-2026-88771 https://patchsonar.com/cve/CVE-2026-88771 Sun, 27 Sep 2026 12:00:00 GMT Firewalls, VPNs & network gear Yes. CISA added this to its catalog of actively exploited vulnerabilities on Sep 27, 2026. What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. MikroTik RouterOS: Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability https://patchsonar.com/cve/CVE-2026-67279 https://patchsonar.com/cve/CVE-2026-67279 Fri, 25 Sep 2026 12:00:00 GMT Firewalls, VPNs & network gear Yes. CISA added this to its catalog of actively exploited vulnerabilities on Sep 25, 2026. What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. F5 BIG-IP APM: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability https://patchsonar.com/cve/CVE-2026-94127 https://patchsonar.com/cve/CVE-2026-94127 Tue, 22 Sep 2026 12:00:00 GMT Firewalls, VPNs & network gear Yes. CISA added this to its catalog of actively exploited vulnerabilities on Sep 22, 2026. What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. Arista VeloCloud Orchestrator: Arista VeloCloud Orchestrator Improper Input Validation Vulnerability https://patchsonar.com/cve/CVE-2026-93952 https://patchsonar.com/cve/CVE-2026-93952 Tue, 22 Sep 2026 12:00:00 GMT Firewalls, VPNs & network gear Yes. CISA added this to its catalog of actively exploited vulnerabilities on Sep 22, 2026. What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. Check Point Multiple Products: Check Point Multiple Products Path Traversal Vulnerability https://patchsonar.com/cve/CVE-2026-93616 https://patchsonar.com/cve/CVE-2026-93616 Tue, 22 Sep 2026 12:00:00 GMT Firewalls, VPNs & network gear Yes. CISA added this to its catalog of actively exploited vulnerabilities on Sep 22, 2026. What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. Check Point Multiple Products: Check Point Multiple Products Improper Certificate Validation Vulnerability https://patchsonar.com/cve/CVE-2026-85102 https://patchsonar.com/cve/CVE-2026-85102 Tue, 22 Sep 2026 12:00:00 GMT Firewalls, VPNs & network gear Yes. CISA added this to its catalog of actively exploited vulnerabilities on Sep 22, 2026. What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. Zyxel GS1900 Series Switches: Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability https://patchsonar.com/cve/CVE-2026-7273 https://patchsonar.com/cve/CVE-2026-7273 Mon, 21 Sep 2026 12:00:00 GMT Firewalls, VPNs & network gear Yes. CISA added this to its catalog of actively exploited vulnerabilities on Sep 21, 2026. What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. Cisco Identity Services Engine: Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability https://patchsonar.com/cve/CVE-2026-76460 https://patchsonar.com/cve/CVE-2026-76460 Wed, 16 Sep 2026 12:00:00 GMT Firewalls, VPNs & network gear Yes. CISA added this to its catalog of actively exploited vulnerabilities on Sep 16, 2026. What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. Cisco Secure Email Gateway: Cisco Secure Email Gateway SQL Injection Vulnerability https://patchsonar.com/cve/CVE-2026-76461 https://patchsonar.com/cve/CVE-2026-76461 Mon, 14 Sep 2026 12:00:00 GMT Firewalls, VPNs & network gear Yes. CISA added this to its catalog of actively exploited vulnerabilities on Sep 14, 2026. What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. MikroTik RouterOS: MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability https://patchsonar.com/cve/CVE-2026-86060 https://patchsonar.com/cve/CVE-2026-86060 Thu, 10 Sep 2026 12:00:00 GMT Firewalls, VPNs & network gear Yes. CISA added this to its catalog of actively exploited vulnerabilities on Sep 10, 2026. What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. MikroTik RouterOS: MikroTik RouterOS Missing Authentication for Critical Function Vulnerability https://patchsonar.com/cve/CVE-2026-67277 https://patchsonar.com/cve/CVE-2026-67277 Thu, 10 Sep 2026 12:00:00 GMT Firewalls, VPNs & network gear Yes. CISA added this to its catalog of actively exploited vulnerabilities on Sep 10, 2026. What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. SonicWall SMA1000 Appliances: SonicWall SMA1000 Appliances OS Command Injection Vulnerability https://patchsonar.com/cve/CVE-2026-83549 https://patchsonar.com/cve/CVE-2026-83549 Wed, 02 Sep 2026 12:00:00 GMT Firewalls, VPNs & network gear Yes. CISA added this to its catalog of actively exploited vulnerabilities on Sep 2, 2026. What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. SonicWall SMA1000 Appliances: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability https://patchsonar.com/cve/CVE-2026-83548 https://patchsonar.com/cve/CVE-2026-83548 Wed, 02 Sep 2026 12:00:00 GMT Firewalls, VPNs & network gear Yes. CISA added this to its catalog of actively exploited vulnerabilities on Sep 2, 2026. What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. Citrix NetScaler ADC and NetScaler Gateway: Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability https://patchsonar.com/cve/CVE-2026-8452 https://patchsonar.com/cve/CVE-2026-8452 Wed, 26 Aug 2026 12:00:00 GMT Firewalls, VPNs & network gear Yes. CISA added this to its catalog of actively exploited vulnerabilities on Aug 26, 2026. What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) : Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability https://patchsonar.com/cve/CVE-2026-20349 https://patchsonar.com/cve/CVE-2026-20349 Tue, 11 Aug 2026 12:00:00 GMT Firewalls, VPNs & network gear Yes. CISA added this to its catalog of actively exploited vulnerabilities on Aug 11, 2026. What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. Progress LoadMaster: Progress LoadMaster Command Injection Vulnerability https://patchsonar.com/cve/CVE-2026-8037 https://patchsonar.com/cve/CVE-2026-8037 Fri, 07 Aug 2026 12:00:00 GMT Firewalls, VPNs & network gear Yes. CISA added this to its catalog of actively exploited vulnerabilities on Aug 7, 2026. What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.