Edge Devices Under Siege: Ivanti, Cisco, and Palo Alto Zero-Days Exploited in the Wild

Ivanti, Cisco, and Palo Alto zero-days exploited in the wild; CISA KEV additions and Microsoft's record 1,413-patch Tuesday. What K-12 and government IT must do

• Three actively exploited zero-days hit edge devices this week: an Ivanti Connect Secure chain (one flaw tracked as CVE-2026-104935), Cisco Secure Email Gateway (CVE-2026-76519, a path traversal), and Palo Alto PAN-OS (CVE-2026-0322).
• CISA added four flaws to its Known Exploited Vulnerabilities catalog, and Microsoft shipped a record 1,413 Patch Tuesday fixes including an exploited Windows Shell bug.
• K-12 and government networks face elevated risk because VPNs, firewalls, and email gateways sit directly on the internet and often bridge to internal identity systems.

What to do now

1. Inventory every edge device now: Ivanti Connect Secure, Cisco Secure Email Gateway, Palo Alto PAN-OS firewalls, and any AhsayCBS instances. Record firmware versions, internet exposure, and whether management interfaces are reachable from outside.
2. Apply vendor patches immediately for CVE-2026-0322, CVE-2026-76519, CVE-2026-105133, and CVE-2026-105134. For the Ivanti chain, patch the two fixed flaws now and treat the third as unpatched — isolate or restrict the appliance at the network edge until Ivanti ships a fix. Track the separately reported Cisco SEG root-level RCE and apply Cisco guidance as it is published.
3. Assume compromise on any Ivanti Connect Secure appliance: capture volatile evidence first, then rotate all credentials, certificates, API keys, and service-account secrets that passed through the VPN, and revoke active sessions.
4. Hunt logs across the estate for signs of root-level access, unexpected outbound connections, new local accounts, and configuration changes. Forward VPN, firewall, and email-gateway logs to a tamper-resistant SIEM so attackers cannot erase them.
5. Enforce MFA and least privilege on all remote-access and administrative accounts, restrict management interfaces to trusted internal IPs, and subscribe to CISA KEV plus vendor advisories for updated deadlines.

Related items

• Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far
• Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug
• Volexity Uncovers Stealthy Ivanti VPN Attack Using Three Zero-Day Vulnerabilities
• CISA Adds Four Known Exploited Vulnerabilities to Catalog
• Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks
• Cisco patches new Secure Email Gateway zero-day exploited in attacks
• Cisco make-me-root email bug exploited as a 0-day by unknown crims
• Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN