Attackers are actively exploiting vulnerabilities across critical network infrastructure, putting the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances at risk. The latest **Eclypsium InfraTrust Pulse** report, covering September 18 to October 14, tracked 133 new security advisories across 18 vendors, detailing 2,813 vulnerabilities. Of these, 37 were rated critical, five boasted a maximum **CVSS** score of 10.0, and 58 could be exploited remotely without authentication. Sixteen newly published advisories included vulnerabilities already listed in **CISA's Known Exploited Vulnerabilities catalog (KEV)**, indicating active exploitation in the wild. The report also highlights a significant concern: many network appliances embed **PHP** into their management interfaces. Because vendors compile **PHP** into appliance firmware, customers typically cannot install security updates themselves and must await vendor-released firmware updates. **InfraTrust** advises administrators to ensure **PHP**-backed management interfaces are not exposed to the internet while awaiting patches for the **PHP2Shell** flaws. ## Critical Infrastructure Under Attack Some of the most severe vulnerabilities impact systems at the edge of enterprise networks or those used to manage other infrastructure. Threat actors target these devices to gain initial access to corporate environments or as a springboard for further attacks. Among the actively exploited flaws highlighted by **InfraTrust** are: * **Citrix NetScaler ADC and Gateway**: **CVE-2026-88771** and **CVE-2026-88772** were disclosed on September 27 after attacks against unpatched appliances were observed. A separate **NetScaler** flaw, **CVE-2026-88779**, affecting appliances configured for **SAML**, was also added to **CISA's KEV catalog**. * **Ivanti Connect Secure**: **CVE-2026-104935** allows an unauthenticated remote attacker to execute arbitrary commands on vulnerable **VPN** gateways. **Ivanti** confirmed limited customer exploitation, and **CISA** later added it to the **KEV**. * **Check Point Security Management Server**: **CVE-2026-93616** allows an unauthenticated attacker to upload and execute scripts on management and logging systems. **Check Point Research** observed targeted attacks exploiting this flaw on September 12, impacting **Spark** customers. * **Cisco Catalyst SD-WAN Manager**: **CVE-2026-76504** enables an unauthenticated attacker to bypass authentication and gain administrator access to the management **API**. **Cisco** became aware of active exploitation in September. * **Arista VeloCloud Orchestrator**: **CVE-2026-93952** is a maximum-severity flaw impacting the system used to configure **SD-WAN Edge** devices. **Arista** reports active exploitation and later disclosed a second, separate exploited vulnerability (**CVE-2026-114625**) in the same product on October 22. * **FortiMail**: **CVE-2026-104286** is a critical path traversal flaw allowing an unauthenticated attacker to write arbitrary files via the web interface. **Fortinet** confirmed its exploitation in attacks. * **Cisco Secure Email Gateway**: **CVE-2026-76519** can lead to arbitrary file writes and command execution as root on vulnerable systems via a malicious email attachment. **Cisco** became aware of exploitation in October. * **F5 BIG-IP APM**: **CVE-2026-94127** is a critical heap overflow that can allow unauthenticated remote code execution on systems configured as **OAuth** authorization servers. **F5** states the vulnerability has been exploited. * **PAN-OS management interface**: **Palo Alto Networks** reported exploitation of **CVE-2026-0322** in attacks on firewalls, allowing an authenticated administrator with network access to execute code as root. ## PHP2Shell Exposes Another Problem **InfraTrust** also warns that the recently disclosed **PHP2Shell** vulnerabilities (**CVE-2026-109618** and **CVE-2026-109619**) expose a critical weakness in network infrastructure. These two **PHP** flaws, fixed on October 21, allow unauthenticated remote code execution. While the focus on these vulnerabilities has largely been on websites and web applications, **PHP** is also widely used for management interfaces in firewalls, application delivery controllers, **VPN** appliances, and network-attached storage devices. For these impacted devices, administrators typically cannot update **PHP** themselves because it's compiled directly into the appliance firmware. Instead, they must wait for each vendor to rebuild and release updated firmware or software. Shortly after disclosure, **Palo Alto Networks**, **F5**, **NetScaler**, **Check Point**, and **QNAP** confirmed that some of their products were affected and were actively developing fixes. ## Broader Component Vulnerabilities The report also highlights similar issues with other software components bundled into infrastructure products. **CVE-2026-31431**, a **Linux** kernel privilege escalation flaw known as **Copy Fail**, has now appeared in 29 advisories across eight vendors, up from 19 advisories from six vendors last month. **InfraTrust** also identified older, exploited vulnerabilities in bundled components, including an **Android** kernel flaw affecting **HP LaserJet Enterprise** printers and a 2020 **jQuery** vulnerability in **Dell Data Lakehouse** software. ## Recommendations for Administrators **InfraTrust** recommends prioritizing patching **NetScaler** and **Ivanti Connect Secure** due to their role as remote-access gateways into corporate networks. Next, administrators should apply **Fortinet's** October 22 **FortiOS**, **FortiManager**, and **FortiAnalyzer** security updates for internet-facing devices. The report further advises focusing on **Check Point Security Management Server**, **Cisco Catalyst SD-WAN Manager**, **VeloCloud Orchestrator**, **FortiMail**, **Cisco Secure Email Gateway**, affected **BIG-IP APM** systems, and **PAN-OS** management interfaces.