Weekly Threat Bulletin – October 21st, 2026

CL-STA-0954 Deploys PEERSTITCH Malware on FortiGate Firewalls After FortiManager Breach

The threat cluster CL-STA-0954, also tracked as UNC5820, compromised a telecommunications managed service provider by exploiting a critical missing authentication vulnerability (CVE-2024-47575) on a central FortiManager server to exfiltrate configuration files and private keys for over 500 downstream FortiGate firewalls. After cracking reversible password hashes to establish SSL/VPN sessions, the actors exploited a path traversal vulnerability in the auto-script engine (CVE-2025-61624) to gain root access and deploy PEERSTITCH, a memory-resident 64-bit ARM64 process injector. PEERSTITCH targets the logging and IPsec VPN daemons, allocating a 16-kilobyte read-write-execute memory buffer to establish a covert inter-process communication bridge while leaving no persistent files on disk and opening no outbound network ports. To maintain access, the attackers established a fallback outbound SSH reverse shell by abusing the native Apache domain management module and impersonated the FortiManager server to pull additional configurations. Because the attackers exfiltrated cryptographic trust materials, complete remediation requires not only patching CVE-2024-47575 and CVE-2025-61624 but also rotating all credentials, private keys, and certificates across all managed firewalls, alongside inspecting volatile memory for anonymous 16-kilobyte executable buffers.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Immediately apply the security patch for CVE-2024-47575 to all FortiManager appliances.
• Immediately apply the security patch for CVE-2025-61624 to all vulnerable FortiOS devices to prevent path traversal and privilege escalation.
• Immediately rotate all credentials, private keys, and certificates on all FortiGate firewalls that are or were managed by a potentially compromised FortiManager server.
• Perform a memory analysis on FortiGate firewalls, specifically inspecting the memory maps of the logging daemon (logd) and IPsec VPN daemon (ikeds) for any anonymous 16-kilobyte executable buffers indicative of PEERSTITCH malware.
• Audit FortiOS system call logs for evidence of unauthorized cross-process memory write operations, particularly between the logging and VPN daemons.
• Review FortiGate configuration and command-line logs for directory traversal sequences (e.g., '../') within script names, which indicates attempted exploitation of CVE-2025-61624.
• On FortiManager servers, immediately enable the configuration setting to deny registration from unknown devices to prevent unauthorized appliances from connecting.

Compliance Best Practices

• Implement network segmentation to restrict access to FortiManager and FortiGate management interfaces, allowing connections only from trusted administrative subnets.
• Establish and enforce a policy of least privilege for all administrator accounts on network infrastructure, ensuring that read-write permissions are granted only when absolutely necessary.
• Audit and disable the use of reversible password encryption for all local user accounts on FortiGate firewalls to prevent offline password cracking.
• Enhance security monitoring by forwarding detailed system and process logs from FortiGate devices to a SIEM, and develop detection rules for anomalous behavior such as logging services being stopped or unexpected process memory modifications.
• Implement a recurring security audit process for all firewall configurations to identify and remediate insecure settings, unnecessary services, and overly permissive rules.
• Develop and test a specific incident response playbook for handling fileless malware on network appliances, including procedures for live memory acquisition, containment of memory-resident threats, and forensic analysis.

Palo Alto Networks Addresses Active Exploitation of PAN-OS RCE Vulnerability CVE-2026-0322 Affecting PA-Series and VM-Series

Palo Alto Networks has released security updates to address a high-severity remote code execution zero-day vulnerability, tracked as CVE-2026-0322 with a CVSS score of 8.6, which has been actively exploited in limited attacks. The flaw resides in the PAN-OS management interface and allows authenticated attackers with network access to execute arbitrary code as root on PA-Series and VM-Series firewalls, as well as Panorama virtual and M-Series appliances; Cloud NGFW and Prisma Access are not affected. Security patches are available for PAN-OS versions 10.2, 11.1, 11.2, 12.1, and 12.2, with a fix for PAN-OS 11.2.16 scheduled for release on October 15. In the absence of workarounds, immediate mitigation strategies include restricting management interface access to trusted internal IP addresses and deploying Threat Prevention signatures. The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog, requiring federal civilian agencies to apply mitigations by October 17, following the identification of malicious activity originating from IP addresses 66.42.72.14, 208.83.239.114, and 149.248.47.234.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Identify all PA-Series, VM-Series, and Panorama appliances running vulnerable PAN-OS versions (10.2, 11.1, 11.2, 12.1, 12.2) and apply the vendor-supplied patches immediately.
• Block the following attacker IP addresses at the network edge: 66.42.72.14, 208.83.239.114, and 149.248.47.234.
• Audit and enforce firewall rules to ensure the PAN-OS management interface is not accessible from the public internet and is restricted to a limited set of trusted internal IP addresses.
• For Palo Alto Networks firewalls with active Threat Prevention subscriptions, ensure the latest content updates are installed and that threat signatures related to CVE-2026-0322 are enabled and set to block.
• Scan firewall and network logs for any historical or current connections to or from the malicious IP addresses: 66.42.72.14, 208.83.239.114, and 149.248.47.234.

Compliance Best Practices

• Implement a dedicated, out-of-band management network for all critical infrastructure devices, including firewalls, to segregate administrative traffic from production and user network traffic.
• Enforce multi-factor authentication (MFA) for all administrative access to network infrastructure. For systems that do not support MFA, enforce strict password complexity, uniqueness, and rotation policies.
• Establish a formal vulnerability management program that includes asset inventory, regular scanning of critical infrastructure, risk-based prioritization, and defined service-level agreements (SLAs) for patching.

Cisco Patches Zero-Day Vulnerability CVE-2026-76519 in Secure Email Gateway AMP Feature

Cisco has patched an actively exploited zero-day vulnerability, tracked as CVE-2026-76519, affecting its Secure Email Gateway (SEG). This security flaw stems from a relative path traversal weakness within the SEG's Advanced Malware Protection (AMP) feature due to improper handling of email attachments, allowing remote, unauthenticated attackers to write arbitrary files and execute commands with root privileges on the underlying operating system. The vulnerability impacts SEG instances where the File Reputation service is enabled and the Content Scanner Tools version is earlier than 25.3.0.5525. Administrators can determine vulnerability status using the `contentscannerstatus` CLI command and should inspect system logs for compromise indicators, such as "System Security: Suspected compromise indicator was found." Cisco has deployed mitigations on cloud instances, contacted potentially compromised device owners to recommend credential and cryptographic material renewals, and warned of attackers attempting to clear evidence of exploitation after gaining root access.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Use the `contentscannerstatus` CLI command on all Cisco Secure Email Gateway (SEG) appliances to check if the Content Scanner Tools version is earlier than 25.3.0.5525.
• In the web management interface for each Cisco Secure Email Gateway (SEG), verify if the "Enable File Reputation" checkbox is selected under "Mail Policies > Incoming Mail Policies > Advanced Malware Protection" or "Mail Policies > Outgoing Mail Policies > Advanced Malware Protection".
• Immediately apply the software update from Cisco to upgrade all vulnerable Secure Email Gateway (SEG) appliances to a fixed version.
• Search system logs on all Cisco Secure Email Gateway (SEG) appliances for the exact messages: "System Security: Suspected compromise indicator was found" and "System Security: Security scan did not complete."
• Review firewall and network traffic logs for unusual or suspicious downloads and uploads to or from your Cisco Secure Email Gateway (SEG) appliances.
• If any indicators of compromise are found on a Cisco Secure Email Gateway (SEG), immediately isolate the appliance from the network and contact the Cisco Technical Assistance Center (TAC) for forensic support.

Compliance Best Practices

• Establish a formal patch management policy that requires security patches for critical, internet-facing appliances to be evaluated and deployed within a 72-hour service level agreement (SLA).
• Implement strict access control lists (ACLs) on your firewalls and routers to ensure the management interfaces (SSH, HTTPS) of Cisco Secure Email Gateway appliances are only accessible from a dedicated and secured management network.
• Implement a process to regularly rotate all credentials, including administrative passwords and API keys, on critical network infrastructure like the Cisco Secure Email Gateway.
• Configure your Security Information and Event Management (SIEM) platform to ingest system logs from Cisco Secure Email Gateway appliances and create automated alerts for known indicators of compromise, such as the log message "System Security: Suspected compromise indicator was found."
• Review and enhance network segmentation to ensure that internet-facing appliances like the Secure Email Gateway are located in a Demilitarized Zone (DMZ) with strict firewall rules limiting communication to and from the internal corporate network.

Ivanti Connect Secure VPN Zero-Day Chain CVE-2026-104935 Grants Root Access on Patched Appliances

A newly discovered zero-day vulnerability chain in Ivanti Connect Secure (ICS) VPN appliances, tracked as CVE-2026-104935, has been actively exploited in the wild to grant attackers unauthenticated root-level code execution on fully patched devices. Discovered during an incident investigation starting on October 3, 2026, the activity is attributed to a previously undocumented threat actor designated as UTA0576. The actor chained the high-severity authentication bypass and remote code execution flaws of CVE-2026-104935 with a third, currently unpatched privilege escalation vulnerability to bypass security controls. UTA0576 focused primarily on credential theft—targeting domain credentials, Active Directory metadata, LAPS passwords, and BitLocker recovery keys—alongside network reconnaissance and log tampering, though the intrusion was disrupted before lateral movement could be achieved. While Ivanti has released patches for CVE-2026-104935 in ICS versions 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1, the privilege escalation vulnerability remains unresolved, with a fix expected in the coming weeks.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Immediately patch all Ivanti Connect Secure (ICS) VPN appliances to a secure version (22.8R2.5, 25.1.1.2, 25.1.3.0, or 25.1.3.1 or later).
• Inspect all Ivanti Connect Secure appliances for host-based indicators of compromise, including the presence of a '/data/.icscap/' directory, unknown Python scripts in the '/tmp/' directory, and any running process named 'dsstatmond'.
• Analyze web server and network logs for requests to Ivanti Connect Secure appliances targeting the path '/dana-na/auth/url_default/welcome.cgi' that also contain a mismatched 'X-DSCGI-PATH' HTTP header.
• Add the IP address 108.165.147.64 to your network firewall blocklist to prevent inbound and outbound communication.

Compliance Best Practices

• Implement network segmentation to create a DMZ for the Ivanti VPN appliance, strictly limiting its communication to only necessary internal resources and ports.
• Establish and enforce a policy that prohibits storing service accounts or domain credentials directly on network edge appliances like VPNs. Use alternative authentication methods where possible.
• Deploy Microsoft's Local Administrator Password Solution (LAPS) to randomize local administrator passwords across all domain-joined Windows endpoints and servers.
• Review and tighten Active Directory access control lists (ACLs) for objects containing BitLocker recovery keys to ensure only a minimal set of authorized administrators can access them.
• Forward authentication and system logs from Ivanti appliances and Active Directory domain controllers to a centralized SIEM. Create and tune detection rules for password spraying, anomalous Kerberos activity, and internal network scans originating from the VPN subnet.

CVE-2026-96951: Actively Exploited Windows Shell Zero-Day Bypasses Mark of the Web

Microsoft has patched CVE-2026-96951, a high-severity Windows Shell command injection vulnerability with a CVSS score of 8.8 that allows unauthenticated remote attackers to bypass Mark of the Web (MOTW) security protections. This zero-day vulnerability, which is actively exploited in the wild, requires user interaction to succeed, typically occurring when a victim is persuaded to open a specially crafted file or visit a malicious website. The flaw affects a broad range of environments, including Windows 10, Windows 11, and Windows Server editions from 2012 R2 through 2025, as well as Outlook.com prior to its service-side fix. Microsoft addressed the issue in its October 13, 2026 security updates, with patched build thresholds including Windows 11 23H2 build 22631.7652, Windows 11 24H2 build 26100.9711, Windows 11 25H2 build 26200.9711, and Windows Server 2025 build 26100.33650. Following confirmation of active exploitation, the Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities catalog on October 13, 2026, mandating remediation by October 16, 2026. To detect potential exploitation, defenders should monitor for behavioral anomalies, such as unexpected child processes spawned by Windows Explorer or document-processing applications, script interpreters launched from downloaded content, and abnormal execution from temporary or user-writable directories.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Prioritize and deploy the October 2026 Microsoft security updates for all affected Windows 10, Windows 11, and Windows Server systems to patch CVE-2026-96951.
• Conduct a retrospective threat hunt in SIEM and EDR logs for files downloaded from the internet that executed without generating a security warning, focusing on the time period before the patch was applied.
• Create a detection rule to alert when a Microsoft Office application or Windows Explorer (explorer.exe) spawns a command line interpreter (cmd.exe) or scripting engine (powershell.exe, wscript.exe, cscript.exe).
• Create a detection rule to alert on any process execution originating from common user download or temporary directories (e.g., C:\Users\*\Downloads, %APPDATA%, %TEMP%).

Compliance Best Practices

• Implement an application control policy, such as Windows Defender Application Control (WDAC) or AppLocker, to allow only approved applications to execute, preventing unauthorized code from running even if MOTW is bypassed.
• Enable and audit Windows Attack Surface Reduction (ASR) rules, specifically focusing on rules that block Office applications from creating child processes and block execution of scripts from downloaded content.
• Enhance email security gateway policies to block or sandbox a broader range of potentially malicious file types delivered as attachments, including container files like ISOs and VHDs.
• Develop and implement a continuous security awareness training program that uses simulations to train users to identify and report phishing attempts that rely on suspicious attachments and social engineering pressure.