RedLegg

10/14/2026

Security Bulletin: PAN-OS Management Interface Remote Code Ex*****on — CVE-2026-0322 is a high-severity vulnerability affecting Palo Alto Networks PA-Series and VM-Series firewalls and Panorama appliances. CVSS 8.6.

An authenticated attacker with high privileges and network access to the management interface can exploit the vulnerability to execute arbitrary code with root privileges.
Palo Alto Networks has confirmed limited exploitation in the wild, and CISA has added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog.

No special configuration is required for affected PAN-OS versions to be vulnerable.
Organizations should identify affected firewalls and Panorama deployments, upgrade to the appropriate fixed release, and restrict management interface access to trusted internal IP addresses.

Security teams should also review available logs for connections associated with reported exploitation attempts, including 66[.]42[.]72[.]14, 208[.]83[.]239[.]114, and 149[.]248[.]47[.]234.

PAN-OS CVE-2026-0322 is an actively exploited code injection vulnerability allowing authenticated root-level code ex*****on. Update affected firewalls and Panorama.

10/14/2026

Security Bulletin: Cisco Secure Email Gateway Arbitrary File Write — CVE-2026-76519 is a critical vulnerability affecting the Advanced Malware Protection feature in Cisco Secure Email Gateway. CVSS 9.8.

An unauthenticated remote attacker can send an email containing a crafted attachment through an affected appliance, potentially writing arbitrary files and executing commands with root privileges.

Active exploitation has been confirmed.

The vulnerability affects appliances with File Reputation enabled in a mail policy and Content Scanner Tools versions earlier than 25.3.0.5525.

Cisco has released a Content Scanner Tools update that addresses the vulnerability without requiring a software upgrade or restart. Cisco also recommends upgrading to AsyncOS 16.5.0-780.

Organizations should verify their Content Scanner Tools version, apply the update, and review affected appliances and cluster members for indicators of compromise.
Because exploitation can provide root access, local logs alone may not be sufficient to rule out compromise. Corroborate findings with external network and firewall logs and follow Cisco's recovery guidance for compromised systems.

Cisco Secure Email Gateway CVE-2026-76519 is an actively exploited critical vulnerability allowing root-level command ex*****on. Apply the Content Scanner Tools update.

10/14/2026

Validation schedules are often calendar-driven because calendars are easy to manage.

The environment rarely changes on that schedule.

A new federation model can alter identity traversal. A segmentation change can close one route and make another reachable. New cloud roles, workloads, or trust relationships can change previously validated paths.

M&A can introduce inherited identities, configurations, and trust boundaries. Major remediation can remove the original weakness while leaving the objective reachable through another route.

Each of those changes can materially alter attacker reachability without waiting for the next annual assessment.

That makes the environment itself a useful input into testing cadence.

Continuous validation becomes more valuable when meaningful architectural and operational changes influence when the next validation cycle starts.

10/05/2026

Security Bulletin: Citrix NetScaler SAML Denial of Service — CVE-2026-88779 is a high-severity memory overflow vulnerability affecting NetScaler ADC and NetScaler Gateway appliances configured as a SAML service provider or SAML identity provider. CVSS 8.7.
An unauthenticated remote attacker can trigger the vulnerability to cause a denial of service. Repeated exploitation may keep the affected service unavailable.

CVE-2026-88779 is actively exploited and has been added to CISA’s Known Exploited Vulnerabilities (KEV) Catalog.

Organizations should upgrade affected NetScaler deployments to the applicable fixed version as soon as possible. Teams should check appliances for samlAction and samlIdPProfile configuration entries and prioritize systems where either is present.
Secure Private Access Hybrid deployments using NetScaler instances should also be identified and upgraded.

Citrix NetScaler vulnerability CVE-2026-88779 allows unauthenticated attackers to cause denial of service in SAML configurations. Actively exploited upgrade affected appliances.

10/02/2026

Security Bulletin: Fortinet FortiMail Arbitrary File Write — CVE-2026-104286 is a critical path traversal vulnerability that may allow an unauthenticated attacker to write arbitrary files to the underlying system through crafted HTTP or HTTPS requests. CVSS 9.8.
Fortinet has confirmed active exploitation, and CISA has added CVE-2026-104286 to its Known Exploited Vulnerabilities (KEV) Catalog.

No patched version is currently available for most affected FortiMail branches. Organizations should immediately disable IBE feature support, which Fortinet identifies as the current workaround, and restrict management interface access to trusted private networks.

Teams should also review encryption logs for BufferException errors involving invalid Base64 encoding in the IBE decryption path and investigate affected appliances for signs of compromise.

Monitor Fortinet's advisory for patched releases and apply them as soon as they become available.

Fortinet FortiMail vulnerability CVE-2026-104286 allows unauthenticated arbitrary file writes via path traversal. Actively exploited—apply Fortinet's IBE workaround immediately.

10/02/2026

Security Advisory: NetScaler SAML Authentication Vulnerability
Citrix has issued advance guidance regarding a vulnerability affecting NetScaler ADC and NetScaler Gateway deployments configured for SAML authentication. Fixed builds have not yet been released, but organizations are encouraged to assess their exposure immediately.
The issue affects appliances configured as a SAML Service Provider or Identity Provider and may impact internet-facing Gateway and AAA deployments.

Recommended actions:
• Audit NetScaler appliances for SAML authentication configurations
• Identify internet-facing Gateway and AAA virtual servers using SAML
• Evaluate whether SAML can be temporarily disabled where not operationally required
• Restrict management access to trusted networks
• Forward authentication logs to your SIEM and monitor for suspicious activity
• Be prepared to apply Citrix security updates as soon as they are released

Early validation of affected systems can help accelerate remediation once vendor patches become available.

A NetScaler SAML authentication vulnerability affects SAML-enabled ADC and Gateway deployments. Audit configurations now and prepare to apply Citrix fixes upon release.

09/28/2026

Security Bulletin: Multiple vulnerabilities affect Citrix NetScaler ADC and NetScaler Gateway, including two critical zero-days actively exploited in the wild.

CVE-2026-88771 and CVE-2026-88772 are both rated CVSS 9.5 and can allow unauthenticated attackers to execute commands or code on vulnerable NetScaler appliances. CISA added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog.

Citrix Security Bulletin CTX697096 also addresses six additional vulnerabilities, ranging from High to Critical severity. Citrix states that every NetScaler deployment is affected by at least one vulnerability covered by the bulletin.

Organizations should upgrade to the applicable fixed builds immediately and investigate exposed appliances for indicators of compromise.
For CVE-2026-88778, upgrading alone is not sufficient. Administrators must also enable Enhanced ISN Generation as directed by Citrix.

Multiple Citrix NetScaler vulnerabilities include two actively exploited zero-days, CVE-2026-88771 and CVE-2026-88772. Upgrade affected ADC and Gateway appliances immediately.

09/25/2026

There's a pattern showing up in a lot of SOCs right now: teams stand up AI-assisted triage and treat detection tuning as solved. The alert count drops, everyone relaxes, and the tuning backlog stops getting worked.

That backlog was doing more than you think.

An ML layer doesn't evaluate whether a rule is any good. It applies the logic it's given and does it at speed. Point it at broad correlations and thresholds set for last year's environment, and it will collapse duplicates and still hand you the same low-value alerts, because volume was never the real problem. The alerts were firing on activity that's normal for your shop.

Tuning is what encodes that context: what your service accounts do at 2 a.m., which admin behavior is expected, where a threshold should sit for how you actually run. No model infers that on its own. Skip the work, and you get a quieter queue sitting on top of the same coverage gaps, which is arguably worse, because now it looks handled.

None of this is an argument against automation. It's an argument for not mistaking a smaller number for a better one.

If you haven't pressure-tested your detection logic against how your environment behaves today, that's the review worth doing.
RedLegg does it ➡️: https://hubs.li/Q04xCYzy0

09/23/2026

Security Bulletin: F5 BIG-IP APM Remote Code Ex*****on — CVE-2026-94127 is a critical heap-based buffer overflow vulnerability affecting BIG-IP Access Policy Manager when configured to act as an OAuth Authorization Server. CVSS 9.8.

Specific malicious traffic sent to an affected virtual server can trigger the vulnerability and allow an unauthenticated attacker to execute arbitrary code.
F5 has confirmed active exploitation, and CISA has added CVE-2026-94127 to its Known Exploited Vulnerabilities (KEV) Catalog.

Organizations should apply the applicable F5 engineering hotfix immediately. Teams should also review affected systems for F5's published indicators of compromise, including repeated invalid_token authentication failures, unexplained increases in failed OAuth requests, suspicious audit activity, and TMM core files.

If immediate patching is not possible, contact F5 Support for the temporary mitigation iRule.

F5 BIG-IP APM vulnerability (CVE-2026-94127) allows unauthenticated remote code ex*****on via a heap-based buffer overflow. Actively exploited—apply the applicable hotfix immediately.

09/23/2026

A detection can keep firing long after its assumptions stop matching the environment.

Log sources change.
Parsers change.
Administrative behavior shifts.
New service accounts alter baselines.

None of those changes necessarily cause a rule to fail outright.

That's what makes stale detection logic difficult to spot.

The useful question for an MDR provider is how they identify degradation before an incident exposes it.

✔️What triggers a review? What evidence drives tuning?
✔️When does a detection get retired rather than adjusted?

RedLegg's Cyberfusion Team manages detection logic through a defined lifecycle of development, tuning, and retirement aligned to MITRE ATT&CK.

Ask your MDR provider how they know a detection is still worth keeping.