# Eclypsium InfraTrust Pulse (Oct 2026): Actively Exploited Flaws Across Network Infrastructure Appliances (NetScaler CVE-2026-88771, Ivanti CVE-2026-104935, Check Point CVE-2026-93616, Cisco, Arista VeloCloud, FortiMail, F5 BIG-IP APM, PAN-OS, PHP2Shell, Linux Copy Fail)

> Eclypsium's October 2026 InfraTrust Pulse (Sept 18 - Oct 14, 2026) tracked 133 advisories across 18 vendors and 2,813 vulnerabilities, 16 of them in CISA KEV and 58 remotely exploitable without authentication. It highlights actively exploited flaws in Citrix NetScaler, Ivanti Connect Secure, Check Point, Cisco, Arista VeloCloud, FortiMail, F5 BIG-IP APM, PAN-OS, PHP (PHP2Shell) and the Linux kernel (Copy Fail), and warns that PHP embedded in appliance management interfaces delays patching.

- **Published:** 2026-10-28T14:37:58Z
- **Last reviewed:** 2026-10-28T14:37:58Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4647
- **ID:** TL-2026-4647
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-88771, CVE-2026-88772, CVE-2026-88779, CVE-2026-104935, CVE-2026-93616, CVE-2026-76504, CVE-2026-93952, CVE-2026-114625, CVE-2026-104286, CVE-2026-76519, CVE-2026-94127, CVE-2026-0322, CVE-2026-109618, CVE-2026-109619, CVE-2026-31431

## Description

Eclypsium's October 2026 InfraTrust Pulse, covered by BleepingComputer on 2026-10-28, aggregates 133 advisories from 18 vendors covering 2,813 vulnerabilities (37 critical, 5 at CVSS 10.0, 58 remotely exploitable without authentication, 16 in the CISA Known Exploited Vulnerabilities catalog) for the period September 18 - October 14, 2026. This record documents the exploited edge-infrastructure flaws the report prioritises; it is an aggregate/campaign-level record and the sources attribute the exploitation to no single actor.

Remote-access gateways and network management planes. Citrix NetScaler ADC/Gateway CVE-2026-88771 (improper input validation leading to unauthenticated command injection in default configuration, CVSS 9.5, CWE-20) and CVE-2026-88772 (memory overflow, DTLS-dependent, CVSS 9.5, CWE-119) were disclosed 2026-09-27 (CTX697096) but were already exploited; Rapid7 observed the earliest exploitation on 2026-09-20 and documented an observed command-injection payload that tars /flash/nsconfig (ns.conf admin password hashes, SSL private keys, LDAP/RADIUS/TACACS bind credentials) into the publicly served /var/netscaler/gui/vpn/ directory, plus a webshell at /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver; two organizations were confirmed compromised. CVE-2026-88779 (SAML-related memory overflow, CVSS 8.7) was exploited after disclosure. Ivanti Connect Secure CVE-2026-104935 (CWE-290 authentication bypass by spoofing enabling unauthenticated command execution; affects 25.1.1.1 and prior, 25.1.2.2 and prior, 22.8R2.4 and prior) was disclosed 2026-10-13 and added to CISA KEV the same day; Volexity reported it was chained with an unpatched privilege-escalation flaw. Check Point Security Management Server CVE-2026-93616 (path traversal / arbitrary file upload, CVSS 9.8, unauthenticated script upload and execution; TCP/19009) was exploited as a zero-day from at least 2026-07-23 against a handful of customers; the report also ties exploitation to Spark customers (a separate Check Point flaw, CVE-2026-85102, KEV 2026-09-23). Cisco Catalyst SD-WAN Manager CVE-2026-76504 (improper URI encoding handling bypassing API authentication, CVSS 9.8) grants unauthenticated admin API access and was exploited as a zero-day. Arista VeloCloud Orchestrator CVE-2026-93952 (CVSS 10.0, CWE-20, only when certificate-based Edge authentication is used; added to KEV 2026-09-22) and a second exploited flaw CVE-2026-114625 are also reported.

Email and application delivery. FortiMail CVE-2026-104286 (path traversal with NULL-byte neutralization flaw, CWE-22/CWE-158, CVSS 9.8, in the Identity-Based Encryption GUI component) allows unauthenticated arbitrary file writes and was exploited as a zero-day (KEV 2026-10-01). Cisco Secure Email Gateway CVE-2026-76519 allows root command execution via a malicious email attachment when the file reputation service is enabled. F5 BIG-IP APM CVE-2026-94127 is a heap overflow in the OAuth UserInfo handler (CVSS 9.8) requiring an APM access policy plus OAuth profile, with a demonstrated chain of callback-pointer corruption, ROP and modification of a service lifecycle script to defeat SELinux. PAN-OS CVE-2026-0322 is a CWE-94 code injection in the management interface giving root code execution to an authenticated admin (KEV 2026-10-14).

Cross-cutting components. PHP2Shell (CVE-2026-109618, a use-after-free in the session upload-progress unserializer on partially initialized request memory; CVE-2026-109619, a stale-state flaw where PHP globals retain references to freed request memory; both CVSS v4.0 9.2) was fixed on 2026-10-21 in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Amazon reported first exploitation attempts on 2026-10-17, four days before patches, from anonymization-network IPs. Eclypsium names Palo Alto Networks, F5, NetScaler, Check Point and QNAP as vendors shipping affected embedded PHP, and notes customers cannot update PHP themselves and must wait for vendor firmware. Copy Fail (CVE-2026-31431) is a Linux kernel local privilege escalation in the algif_aead / AF_ALG crypto interface (in-place optimization introduced in 2017; kernels 4.14 through 6.19.12) abused with splice() to corrupt the page cache of setuid binaries such as /usr/bin/su; it was added to CISA KEV on 2026-05-01 and now appears in 29 advisories across 8 vendors (up from 19 across 6).

Defender priorities per Eclypsium: (1) NetScaler and Ivanti Connect Secure; (2) Fortinet FortiOS/FortiManager/FortiAnalyzer October 22 updates; (3) Check Point Management Server, Cisco SD-WAN Manager, VeloCloud Orchestrator, FortiMail, Cisco Secure Email Gateway, BIG-IP APM and PAN-OS management interfaces. Restrict PHP-backed management interfaces from internet exposure while awaiting vendor firmware.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059.004 Unix Shell
- T1505.003 Web Shell
- T1552.001 Credentials In Files
- T1560.001 Archive via Utility
- T1005 Data from Local System

## Sources

- [InfraTrust report warns of exploited flaws in critical network infrastructure (BleepingComputer)](https://www.bleepingcomputer.com/news/security/infratrust-report-warns-of-exploited-flaws-in-critical-network-infrastructure/)
- [Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772 (Rapid7)](https://rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772)
- [Citrix Security Advisory CTX697096](https://support.citrix.com/external/article/CTX697096)
- [Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935) (Rapid7)](https://www.rapid7.com/blog/post/etr-ivanti-connect-secure-zero-day-exploited-in-the-wild-cve-2026-104935/)
- [Check Point patches exploited Management Server zero-day (SecurityWeek)](https://www.securityweek.com/check-point-patches-exploited-management-server-zero-day/)
- [Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (Rapid7)](https://rapid7.com/blog/post/etr-critical-cisco-catalyst-sd-wan-manager-api-authentication-bypass-exploited-in-the-wild-cve-2026-76504)
- [New CVSS 10.0 VeloCloud Orchestrator flaw (The Hacker News)](https://thehackernews.com/2026/09/new-cvss-100-velocloud-orchestrator.html)
- [Critical FortiMail zero-day exploited in the wild (CVE-2026-104286) (Help Net Security)](https://www.helpnetsecurity.com/2026/10/02/fortinet-fortimail-vulnerability-cve-2026-104286/)
- [Cisco patches actively exploited Secure Email Gateway zero-day (BleepingComputer)](https://bleepingcomputer.com/news/security/cisco-patches-actively-exploited-secure-email-gateway-zero-day)
- [CVE-2026-94127: Critical Unauthenticated RCE in F5 BIG-IP APM (Rapid7)](https://www.rapid7.com/blog/post/etr-cve-2026-94127-critical-unauthenticated-rce-in-f5-big-ip-apm/)
- [Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks (BleepingComputer)](https://bleepingcomputer.com/news/security/palo-alto-networks-warns-of-pan-os-rce-flaw-exploited-in-attacks)
- [PHP2Shell Exploitation: Two Critical PHP Flaws Explained (Recorded Future)](https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation)
- [Amazon says PHP2Shell exploitation began 4 days before patches (BleepingComputer)](https://bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches)
- [CVE-2026-31431 Copy Fail (Unit 42)](https://unit42.paloaltonetworks.com/cve-2026-31431-copy-fail/)
- [CISA warns Copy Fail Linux flaw is already actively exploited (CyberInsider)](https://cyberinsider.com/cisa-warns-copy-fail-linux-flaw-is-already-actively-exploited/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4647