Two more edge device zero-days: Cisco's email gateway and Ivanti's VPN are both under attack

Two products that sit on the edge of a company network were in the news on 14 October, both because attackers got there before the fixes did. Neither is a household name for a small office, but both are widely used by IT providers and mid-sized firms, so the practical question for most readers is whether anything you rely on runs one.

Cisco Secure Email Gateway

The Register reports that Cisco and the US government issued separate advisories on 14 October for CVE-2026-76519, rated 9.8 out of 10. A remote attacker who has not logged in can write files and run commands as root by sending a malicious email, through a flaw in how the Advanced Malware Protection feature handles attachments. Cisco says it is aware of active exploitation but has not said how many appliances were hit. Exposure requires that File Reputation is enabled and assigned to a mail policy, and that Content Scanner Tools is earlier than 25.3.0.5525. There is no workaround. The fix is to upgrade AsyncOS, and customers on releases earlier than 16.5 are told to move to 16.5.0-780. The Register adds that this is the second zero-day of this kind in the product in about a month, and that the US cyber agency CISA has added the flaw to its list of known exploited vulnerabilities.

Ivanti Connect Secure

Also on 14 October, The Register reported that Ivanti had patched CVE-2026-104935, an authentication bypass rated 8.6 that lets a remote attacker who has not logged in run arbitrary commands. Affected versions are Connect Secure 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. Ivanti says it was already being used against a limited number of customers. The security firm Volexity, which found it, describes a chain of three vulnerabilities and has published some indicators of compromise. A separate privilege escalation flaw in that chain is not covered by this fix, and Ivanti says a fix will come in the coming weeks. Its advice is to update, check for compromise, and run its Integrity Checker Tool regularly.

Why this matters to a small firm

A flaw in an email gateway or VPN is worth more to an attacker than a flaw in a laptop, because these devices are always on, face the internet and sit in front of everything else. If one is compromised, a patch afterwards does not remove whatever was left behind, which is why both vendors tell customers to check for compromise as well as update.