Firewalls, email and backup: flaws exploited in October

The US cybersecurity agency added several vulnerabilities in firewalls, email gateways and backup servers to its list of exploited flaws. Which devices are at risk and what to do.

The US Cybersecurity and Infrastructure Security Agency (CISA) maintains a catalog of vulnerabilities that are already being used in real attacks. In October it added several exploited flaws that affect equipment found in many companies: firewalls, email gateways and backup servers. Although the catalog is American, it is one of the best references for deciding what to patch first in any country.

October 14: firewalls, email and backup

Palo Alto Networks PAN-OS (CVE-2026-0322): code injection in the firewalls' management interface. It requires an authenticated attacker, and Palo Alto reports very limited exploitation.
Cisco Secure Email Gateway (CVE-2026-76519): a critical arbitrary file write flaw (9.8 out of 10) that Cisco confirmed is being exploited. The fixed versions are AsyncOS 15.5.5-014 and 16.5.0-780; customers on the 16.0 branch should migrate.
AhsayCBS (CVE-2026-105133 and CVE-2026-105134): a backup server where attackers chain an authentication flaw with command injection to install web shells; Huntress also found cryptocurrency miners. The fixed versions are 10.3.4.45 and 9.15.2.70.

CISA gave federal agencies just three days, until October 17, to fix them.

October 20: Plex2Shell

CISA also added four Plex Media Server flaws that are chained together under the name Plex2Shell (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656). The proof of concept was published on October 16 and attacks began the next day: the attackers install cryptocurrency miners and proxy software. The fixed version is 1.43.3.10861, but updating does not clean a server that has already been infected: Plex asks users to rebuild it from a clean installation if they suspect it was compromised.

What they have in common

They are all devices exposed to the internet that, once compromised, give access to the company's network or information. Backup servers are a special target: whoever controls them can delete the copies before launching ransomware.

How to patch in time

Take an inventory of the devices exposed to the internet: firewalls, VPNs, email, backup and media servers.
Install the fixed versions and subscribe to each vendor's security advisories.
Do not publish management interfaces on the internet: reach them through a VPN and with two-factor authentication.
If a device was exposed and unpatched, check it for new users, tasks and files before considering it clean.
Keep at least one offline or immutable backup, as the 3-2-1 backup rule recommends.

October 31 update: vendor advisories

We checked this article against the Palo Alto, Cisco, Ahsay and Plex advisories, and Huntress's analysis. We removed the figure of about 49,000 vulnerable Plex servers, which we could not find in a primary source, and clarified that the PAN-OS flaw requires authenticated access.

How we help you

With our IT infrastructure management service we keep an inventory of your devices, apply critical patches and review what is exposed to the internet. And with verified copies in Pronetsys Backup Service you keep your information outside the office.