Attackers exploit a Cisco Secure Email Gateway flaw that can run commands as root

Cisco, Collabora and Palo Alto Networks disclosed flaws that attackers are already exploiting: CVE-2026-76519 lets a crafted email attachment run commands as root on a Secure Email Gateway, CVE-2026-110447 lets an unauthenticated request run commands on Nextcloud servers with the built-in CODE server, and CVE-2026-0322 gives a logged-in attacker root on PAN-OS firewalls. Juniper fixed critical J-Web flaws, and the car dealer platform GeNesys and the town of Eichstätt confirmed that data was taken.

Vulnerabilities

CVE-2026-76519 - Cisco Secure Email Gateway, CVSS 3.1 9.8

What it allows. The gateway mishandles email attachments when its file reputation service is enabled, so an unauthenticated, remote attacker who sends a crafted attachment through it can write arbitrary files and execute commands with root privileges on its operating system, according to Cisco’s advisory of 14 October, which rates it critical. Cisco’s PSIRT became aware of active exploitation in October, CISA added the flaw to its Known Exploited Vulnerabilities catalogue the same day, and Cisco has contacted the Secure Email Cloud customers whose devices showed indicators of possible compromise. It is the second Secure Email Gateway flaw under attack since September, after CVE-2026-76461, which BleepingComputer reported on 15 September.

Affected. Physical and virtual appliances on a vulnerable AsyncOS release where File Reputation, part of Advanced Malware Protection, is enabled and assigned to a mail policy, and Content Scanner Tools is older than 25.3.0.5525, which contentscannerstatus shows. Secure Email and Web Manager and Secure Web Appliance are not affected.

Fix. Content Scanner Tools 25.3.0.5525 and later carry the fix, and installing them, with contentscannerupdate or through automatic updates, needs no software upgrade or restart. The first fixed AsyncOS releases are 15.5.5-014 and 16.5.0-780, and 16.0 has to migrate to a fixed release, as the advisory lists; there is no workaround. Cisco says to run grep "System Security" system_logs on every device, each cluster member included, to contact Cisco TAC on any sign of compromise, and to replace a compromised virtual appliance with a new one on a fixed release, after preserving forensic data, and renew its credentials and keys.

Exposure. product:"Cisco IronPort" matches 2,317 results worldwide; Shodan still fingerprints the gateway’s mail service under its former name, IronPort. The table counts distinct addresses, as Shodan lists a host once for each port it answers on.

No banner carries an AsyncOS version, and Shodan cannot see whether File Reputation is on, so these are exposed instances, not confirmed vulnerable ones. 2,078 of the results answer on port 25 and 8 run at a cloud provider.

CVE-2026-110447 - Collabora Online Built-in CODE Server for Nextcloud, CVSS 4.0 9.2

What it allows. An OS command injection in proxy.php of richdocumentscode, the Nextcloud app that runs Collabora Online’s CODE server inside Nextcloud, lets an unauthenticated request run an operating system command as the web server user, according to Collabora’s advisory of 14 October, which rates it critical. The CVE record published the same day says it was exploited in the wild in September and October 2026. An administrator reported on 11 September successful attacks since the day before, through requests to /apps/richdocumentscode/proxy.php?status that left web shells named shx*.php in the app’s directory, and a Nextcloud forum post of 3 October warned that users had found web shells on their servers. Release 26.4.303 was out by 14 September, when maintainers told the reporter it should fix the attack, but the advisory and the CVE came only on 14 October.

Affected. richdocumentscode before 26.4.303, and the attack only works while the built-in CODE server is not running, for example after a restart, an upgrade or a crash. Standalone Collabora Online servers are not affected, nor, per the forum post, installs that use the richdocuments app without richdocumentscode, or Collabora from Docker images or distribution packages. Collabora says this is a different path from CVE-2025-66208, and the fix for that flaw does not prevent it.

Fix. Update to 26.4.303 or later, or remove the app: Collabora says disabling it is not enough, and that servers on Nextcloud 29 or older, which are end of life, should upgrade Nextcloud or remove the app. A maintainer advised also removing any leftover shx*.php files.

Exposure. http.html:"/apps/richdocumentscode/" matches 15,898 results worldwide, Nextcloud pages whose HTML references the app’s path.

No banner carries the app’s version, and Shodan cannot see whether the CODE server is running, so these are exposed instances, not confirmed vulnerable ones. 12,034 of the results answer on port 443 and 664 run at a cloud provider.

CVE-2026-0322 - Palo Alto Networks PAN-OS, CVSS 4.0 8.6

What it allows. A code injection flaw in the PAN-OS management interface lets an authenticated attacker with network access execute arbitrary code with root privileges on the firewall, according to Palo Alto Networks’ advisory of 14 October, which says “very limited exploitation has been observed targeting the Palo Alto Networks management interface”. CISA added it to the Known Exploited Vulnerabilities catalogue the same day. The advisory’s CVSS vector rates the privileges the attacker needs as high, and the company, which found the flaw itself, gives it its highest urgency.

Affected. PAN-OS on PA-Series and VM-Series firewalls and on Panorama, virtual and M-Series, in the 10.2, 11.1, 11.2, 12.1 and 12.2 branches before the fixed releases, and older, unsupported releases, which have to move to a supported fixed release. No special configuration is needed, and the risk is highest where the management interface can be reached from the internet. Cloud NGFW and Prisma Access are not affected.

Fix. Fixed in 12.2.4, 12.1.10-h2, 11.2.16, 11.1.16-h3 and 10.2.18-h12, with hotfixes for older maintenance releases listed in the advisory; 11.2.16 is due on 15 October. There is no workaround. Palo Alto Networks advises restricting the management interface to trusted internal addresses, and its Threat Prevention IDs 510046 and 510047 give limited coverage, only where the management traffic is decrypted.

CVE-2026-97229 - GitLab CE/EE, CVSS 3.1 10.0

What it allows. What has changed since the 13 October issue is a public proof of concept, which CERT-Bund added to its advisory on 14 October, dating it 13 October. Its README describes what this one exploit chain needs: an attacker who can push a branch to a public project on the instance supplies a crafted CI regular expression and a specially named path, and from then on a request to the public CI lint API, carrying no credentials, executes a command as the GitLab git account. It does not say these are the only conditions under which the flaw can be reached, and says analysis of affected configurations and other reachable paths is ongoing. It has been tested only against the official 19.4.1 CE image, and other builds need adjusted offsets. No source reports exploitation.

Affected. Unchanged: self-managed GitLab CE and EE 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2.

Fix. Upgrade to 19.4.2, 19.3.5 or 19.2.8, as GitLab’s patch release lists. GitLab gives no workaround.

Exposure. product:"GitLab Self-Managed" matches 45,014 results worldwide.

Counted by address, Ukraine has 103 hosts rather than the 1,744 the 13 October issue gave, because one address answers on 1,653 ports. No banner carries a GitLab version, so these are exposed instances, not confirmed vulnerable ones. 29,668 of the results answer on port 443 and 13,201 run at a cloud provider.

CVE-2026-101986 - Juniper Junos OS and Junos OS Evolved, CVSS 3.1 9.8

What it allows. A flaw in J-Web, the web management interface, lets an unauthenticated attacker bypass its authentication and execute CGI content with elevated privileges through a crafted HTTP request, according to Juniper’s JSA112187 of 14 October. The same bulletins fix three more J-Web flaws scored 9.8: CVE-2026-101954 gives an unauthenticated attacker root-level configuration access and takeover of the device, CVE-2026-101956, in JSA112188, lets one execute Junos commands as root, and CVE-2026-101983, a stack overflow in httpd, allows remote code execution where a J-Web virtual domain with mutual TLS is configured. Juniper is not aware of malicious exploitation of any of them.

Affected. Devices with J-Web enabled, under system services web-management. CVE-2026-101986 affects every Junos OS and Junos OS Evolved release before 23.2R2-S7.7, the later trains up to 26.2 before their fixed releases, and the 23.4X100, 25.2X100 and 25.4X300 Evolved releases. CVE-2026-101954 affects the 25.2, 25.4 and 26.2 trains and the same Evolved X releases, and CVE-2026-101956 Junos OS 25.2, 25.4 and 26.2.

Fix. Junos OS 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2 and 26.4R1 fix them, and the matching Junos OS Evolved releases, among them 25.2X100-D35-EVO and 25.4X300-D40-EVO, are listed in JSA112187. Juniper’s records list no fixed release for 23.4X100, and Juniper says there are no known workarounds.

Exposure. product:"Juniper Junos" http.title:"Log In - Juniper Web Device Manager" matches 11,685 results worldwide, but they come from 1,551 addresses: 12 of them answer on 50 or more ports each and produce 9,796 of the results between them, a pattern more typical of honeypots than of routers.

One Czech and one Polish address account for more than 1,000 results each and are counted once. No banner carries a Junos version, so these are exposed instances, not confirmed vulnerable ones. 920 of the results answer on port 443, 584 on port 80, and 98 run at a cloud provider.

Regional

• Customer data from car sales at dealers across Germany was taken from a dealer software provider, which told dpa on 14 October that order and invoice numbers, delivery dates and purchase, payment and financing amounts were taken, though payment data can be ruled out for now; Borns IT- und Windows-Blog identifies it as the GeNesys platform of Achter Autohaus Software GmbH in Bavaria, and a dealer’s notice it quotes dates the access to September and adds names, addresses, vehicle identification numbers, email addresses and phone numbers. Police say the attackers got in through third-party software that had a serious vulnerability at the time, and VW confirmed that its own Volkswagen Group Retail Deutschland, with about 120 dealerships, uses the software. No fraud attempts are known yet, but the vendor warns that fake payment requests carrying real purchase details could look genuine: check any change of bank details with the dealer on a number from a trusted source, and call the bank at once if money has already gone to a suspicious account.
• The attackers behind the weekend attack on the town administration of Eichstätt in Bavaria copied a large part of its data, the town now confirms in a notice of 14 October, though which data is affected and whether it could be misused is still under investigation by the state criminal police office, and no ransom demand has reached the town. All town hall servers stay off, partly to preserve evidence, the first urgent services are running again, and direct debits from residents’ accounts are paused. Residents should check any invoice from the town hall carefully before paying it, against the account the notice gives, and call the emergency hotline on (08421) 93770 if in doubt.
• The electronics retailer notebooksbilliger.de told customers by email on 14 October of an attack on its IT systems, naming email addresses as affected and saying names, addresses and bank details could be too, where customers used them to pay, ComputerBase reports; the company does not confirm that data was actually taken, passwords are not affected as far as it knows, and it does not store credit card data. It has not said which systems were hit, when, or how many customers are affected, and it has brought in outside specialists, informed the data protection authority and filed a criminal complaint. Customers should check their bank statements over the coming months, where a SEPA direct debit can be returned without a reason within eight weeks, and treat any message asking for passwords, PINs or TANs as phishing, as the company never asks for them that way.
• Slovakia’s government approved a national plan for responding to large-scale cyber security incidents and cyber crises on 14 October, TASR reports. It defines several levels of incident and assigns tasks to state bodies by level, and at the third and highest level crisis management starts automatically, with a tactical crisis team of cyber security experts and a steering crisis committee, under unified management by the National Security Authority, NBÚ. Communication during a crisis is to rest on a single state position.

This digest is created with the help of AI-enabled tools and may contain inaccuracies. If you find one, let me know.