Topic: network
-
Cisco Secure Email Gateway and SD-WAN Manager: verify fixes and preserve compromise evidence
Use separate remediation records for the email scanner and SD-WAN Manager. Verify actual installed fixes, preserve evidence before disruptive recovery, and follow the product-specific investigation path.
-
After patching an exploited edge device: evidence, recovery and return-to-service checks
A proposed operator procedure for investigating an edge device that was exposed to an exploited vulnerability. Preserve evidence, document whether vendor-directed rebuilding is necessary, replace exposed trust material and verify recovery separately from patch installation.
-
FortiMail and FortiSIEM: match the October fixes to the exposed service
FortiMail CVE-2026-104286 and FortiSIEM CVE-2026-106173 require different fixes and network restrictions. Fortinet confirms exploitation of the mail flaw; its FortiSIEM advisory does not report known exploitation.
-
Ivanti Connect Secure: patching CVE-2026-104935 and investigating earlier compromise
Separate the authentication-bypass fix from compromise recovery: choose a compatible fixed release, preserve forensic evidence, and use integrity checks alongside network and memory analysis.
-
PAN-OS CVE-2026-0322: verify maintenance-line fixes and recover the management plane
An authenticated management-interface flaw affects PAN-OS firewalls and Panorama. Match the full maintenance release, restrict management access, and use the vendor's hardware or virtual-appliance recovery procedure when compromise is suspected.
-
NetScaler ADC and Gateway: distinguish the September and October fixes before recovery
CVE-2026-88771 and CVE-2026-88772 have different minimum fixed builds from the SAML denial-of-service flaw CVE-2026-88779. Match each bulletin, investigate compromise and handle session termination deliberately.
Machine-readable: JSON