Affected Systems

Critical network infrastructure including Citrix NetScaler ADC/Gateway, Ivanti Connect Secure VPN, Check Point Security Management Server, Cisco Catalyst SD-WAN Manager, Arista VeloCloud Orchestrator, FortiMail, Cisco Secure Email Gateway, F5 BIG-IP APM, and Palo Alto PAN-OS. Additionally, any network appliances (firewalls, VPNs, ADCs, NAS) with PHP-based web management interfaces are vulnerable to PHP2Shell (CVE-2026-109618, CVE-2026-109619) until vendors release patched firmware.

Exploitation Status

Active exploitation confirmed for all listed CVEs: CVE-2026-88771, CVE-2026-88772, CVE-2026-88779 (Citrix NetScaler), CVE-2026-104935 (Ivanti), CVE-2026-93616 (Check Point), CVE-2026-76504 (Cisco SD-WAN), CVE-2026-93952 and CVE-2026-114625 (Arista), CVE-2026-104286 (FortiMail), CVE-2026-76519 (Cisco Email Gateway), CVE-2026-94127 (F5 BIG-IP), and CVE-2026-0322 (PAN-OS). All added to CISA KEV catalog. PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) patched by PHP project October 21, 2026; exploitation status for appliances unclear but risk is high.

Business Impact

Attackers are targeting edge infrastructure devices that provide initial access to corporate networks. Successful exploitation enables unauthenticated remote code execution, authentication bypass, and root-level command execution on firewalls, VPN gateways, and management systems. PHP2Shell compounds the problem: administrators cannot patch PHP directly in appliance firmware and must wait for vendor updates. Management interfaces exposed to the Internet face immediate risk. InfraTrust tracked 133 advisories covering 2,813 vulnerabilities in one month (Sept 18–Oct 14), with 37 critical, five scoring CVSS 10.0, and 58 remotely exploitable without authentication.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately isolate PHP-based management interfaces of firewalls, VPNs, ADCs, and NAS devices from Internet exposure; restrict access to trusted management networks only.
  • Prioritize patching Citrix NetScaler (CVE-2026-88771, CVE-2026-88772, CVE-2026-88779) and Ivanti Connect Secure (CVE-2026-104935) as remote-access gateways provide direct entry to corporate networks.
  • Apply vendor firmware updates for Check Point Security Management Server (CVE-2026-93616), Cisco Catalyst SD-WAN Manager (CVE-2026-76504), Arista VeloCloud Orchestrator (CVE-2026-93952, CVE-2026-114625), FortiMail (CVE-2026-104286), Cisco Secure Email Gateway (CVE-2026-76519), F5 BIG-IP APM (CVE-2026-94127), and Palo Alto PAN-OS (CVE-2026-0322).
  • Monitor vendor advisories from Palo Alto Networks, F5, NetScaler, Check Point, and QNAP for PHP2Shell (CVE-2026-109618, CVE-2026-109619) firmware patches and apply immediately upon release.
  • Review firewall and IDS logs for anomalous access to management interfaces, unauthorized authentication attempts, and unexpected command execution on affected appliances; correlate with CISA KEV indicators.