Two more edge boxes under fire: Cisco Secure Email Gateway and Ivanti Connect Secure

Call: Patch now on both. Both are being exploited, and both were added to KEV in the same week.

Cisco SEG, CVE-2026-76519. A crafted attachment lets an attacker write files and run commands as root. It affects gateways that have File Reputation enabled and run Content Scanner Tools earlier than 25.3.0.5525. Cisco is aware of active exploitation, and Shadowserver tracks nearly 300 exposed instances.

• Check contentscannerstatus and update.
• Review the System Security logs.
• If you find signs of compromise, rotate credentials and crypto material.
• Confirm the fixed AsyncOS build in the advisory itself. The build numbers I have come from summaries. (Cisco, BleepingComputer)

Ivanti Connect Secure, CVE-2026-104935. An authentication bypass that leads to unauthenticated command execution, exploited as a zero-day. CISA added it to KEV on Oct 13 with a three-day deadline.

• Fixed in 22.8R2.5, 25.1.1.2 and 25.1.3.x.
• Run Ivanti’s integrity checks. You know the drill by now; Ivanti certainly does.
• Versions come from summaries of the CISA and NCSC-NL alerts, so confirm them against Ivanti’s advisory. (CISA, BleepingComputer)

Sources

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp
• https://www.bleepingcomputer.com/news/security/cisco-patches-actively-exploited-secure-email-gateway-zero-day/
• https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure
• https://www.bleepingcomputer.com/news/security/cisa-warns-admins-to-immediately-fix-ivanti-flaw-exploited-as-zero-day/