Actively Exploited Edge Device Flaws Threaten School Networks; Microsoft Releases Record Patch Tuesday

Actively exploited PAN-OS, Cisco, Ahsay, and Ivanti flaws threaten school networks; Microsoft patches 1,413 flaws. Immediate remediation steps.

• CISA added four actively exploited vulnerabilities to its KEV catalog, including a high-severity PAN-OS RCE (CVE-2026-0322, CVSS 8.6) in Palo Alto firewalls, a Cisco Secure Email Gateway path traversal (CVE-2026-76519), and two AhsayCBS flaws (CVE-2026-105133, CVE-2026-105134).
• Volexity disclosed an investigation into a stealthy attack using three Ivanti VPN zero-days, allowing root access and credential theft.
• Microsoft patched a record 1,413 flaws, including an exploited Windows Shell bug, affecting Windows, Office, SharePoint, and SQL Server.

What to do now

1. Immediately inventory all Palo Alto PAN-OS firewalls, Cisco Secure Email Gateways, AhsayCBS instances, and Ivanti Connect Secure VPNs. Identify versions and internet exposure.
2. Apply vendor patches for CVE-2026-0322, CVE-2026-76519, CVE-2026-105133, CVE-2026-105134, and the Ivanti zero-days without delay. If patching is not possible, isolate or disable affected services.
3. Restrict management interfaces to trusted internal networks only; enforce MFA and least privilege for all administrative access.
4. Review logs for exploitation indicators (unusual command execution, path traversal, new admin accounts, outbound connections) and hunt for IoCs provided by vendors.
5. Prioritize Microsoft Windows and Windows Shell updates on endpoints and servers, then schedule Office, SharePoint, and SQL Server patches after testing.

Related items

• CISA flags exploited flaws in Palo Alto, Cisco and Ahsay products
• Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug
• Volexity Uncovers Stealthy Ivanti VPN Attack Using Three Zero-Day Vulnerabilities
• U.S. CISA adds Palo Alto Networks PAN-OS, Ahsay AhsayCBS, and Cisco Secure Email Gateway flaws to its Known Exploited Vulnerabilities catalog
• Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation
• Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution
• CISA Adds Four Known Exploited Vulnerabilities to Catalog
• Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks