CISA has confirmed a seven-CVE wave of active, in-the-wild exploitation across a span of just three days (October 13–15, 2026). This batch is heavily weighted toward internet-facing edge and remote access infrastructure — Ivanti Connect Secure, Palo Alto Networks PAN-OS, Cisco Secure Email Gateway, and Atlassian Data Center products — the exact product classes that have served as initial access beachheads for ransomware affiliates and nation-state intrusion sets over the past 24 months.
Every CVE on the CISA KEV catalog is, by definition, confirmed exploited. These are not theoretical risks. Federal civilian agencies carry binding remediation deadlines under BOD 22-01; every other organization should treat these as drop-everything patch priorities.
1. Active Exploitation Intelligence
CVE-2026-21589 — Atlassian Data Center Products (Added 2026-10-15)
- Vulnerability: Vulnerability affecting multiple Atlassian Data Center products: Bitbucket DC, Confluence DC, Jira Service Management DC, and Jira Software DC.
- Exploitation method: Remote exploitation against internet-exposed Data Center instances. Multi-product Atlassian flaws historically enable unauthenticated or low-privilege RCE (cf. CVE-2022-26134, CVE-2023-22515/22518 pattern) — treat as RCE-capable until vendor advisory clarifies otherwise.
- Threat actors: Not yet publicly attributed. Historically, Confluence/Jira exploitation is rapidly weaponized by Chinese state-nexus groups and ransomware initial access brokers within 24–72 hours of disclosure.
- CVSS: Not yet published in the KEV record; assume Critical (9.0+) given multi-product scope and confirmed exploitation.
- PoC: No confirmed public PoC at time of writing — expect rapid development given Atlassian's track record.
- CISA required action: Apply vendor mitigations/patches per the Atlassian security advisory; BOD 22-01 due date typically 3 weeks from listing (~early November 2026). Verify exact due date in the KEV entry.
CVE-2026-105134 — Ahsay AhsayCBS Command Injection (Added 2026-10-14)
- Vulnerability: Command injection in AhsayCBS backup server allowing a remote attacker to execute operating system commands via manipulated input.
- Exploitation method: Remote command execution on the backup server host — the single most sensitive asset in most environments.
- Threat actors: Ransomware status: Unknown, but backup infrastructure compromise is a canonical pre-encryption move — attackers destroy or encrypt backups before detonating payloads. Assume ransomware-adjacent use.
- CVSS: Pending; command injection on backup servers typically scores 9.8.
- PoC: Not confirmed public.
- CISA required action: Patch per Ahsay advisory; disable exposed management interfaces if unpatched.
CVE-2026-105133 — Ahsay AhsayCBS Improper Authentication (Added 2026-10-14)
- Vulnerability: Authentication bypass via manipulated requests in AhsayCBS.
- Exploitation method: Remote auth bypass — likely chained with CVE-2026-105134 for unauthenticated RCE. The dual listing on the same day strongly suggests an observed exploit chain.
- Threat actors: Unknown; treat the pair as a single unauthenticated compromise path.
- CISA required action: Patch both CVEs together; isolate AhsayCBS from direct internet exposure.
CVE-2026-76519 — Cisco Secure Email Gateway Relative Path Traversal (Added 2026-10-14)
- Vulnerability: Relative path traversal allowing an unauthenticated, remote attacker to write arbitrary files.
- Exploitation method: Arbitrary file write → webshell drop or config overwrite → RCE/persistence. Unauthenticated file-write on an email gateway is functionally pre-auth RCE.
- Threat actors: Unknown; email gateways are high-value for espionage actors (mail interception) and for spam/phishing infrastructure hijack.
- CISA required action: Apply Cisco fixed software immediately.
CVE-2026-0322 — Palo Alto Networks PAN-OS Code Injection (Added 2026-10-14)
- Vulnerability: Code injection allowing an authenticated attacker with network access to execute code on PAN-OS devices.
- Exploitation method: Post-auth code execution — typically chained with credential theft or default/weak admin creds on management interfaces. PAN-OS exploitation (cf. CVE-2024-3400, CVE-2025-0108) has been a hallmark of state-nexus campaigns.
- Threat actors: Unknown; PAN-OS bugs historically attract rapid adoption by Chinese espionage clusters and, downstream, ransomware operators.
- CISA required action: Upgrade PAN-OS per advisory; restrict management interface exposure.
CVE-2026-104935 — Ivanti Connect Secure Authentication Bypass by Spoofing (Added 2026-10-13)
- Vulnerability: Authentication bypass by spoofing allowing a remote, unauthenticated attacker to execute actions on the appliance.
- Exploitation method: Pre-auth bypass on the VPN concentrator — the highest-risk item in this batch for enterprise perimeter compromise. Ivanti ICS exploitation (CVE-2023-46805/21887, CVE-2025-0282/0283 lineage) has been repeatedly tied to UNC5221-style espionage actors and subsequent ransomware deployment.
- Threat actors: Unknown in the KEV record, but ICS auth bypasses are among the most reliably mass-exploited bugs in the catalog.
- CISA required action: Apply Ivanti patch; run Ivanti's Integrity Checker Tool (ICT); assume compromise and hunt for persistence if the appliance was internet-facing and unpatched.
CVE-2026-96951 — Microsoft Windows Shell Command Injection (Added 2026-10-13)
- Vulnerability: Command injection in Windows Shell allowing an unauthorized attacker to bypass a security feature over a network vector.
- Exploitation method: Security feature bypass + command injection — likely file-handler/shortcut abuse used in phishing-delivered initial access (the .lnk/.url/SearchConnector pattern).
- Threat actors: Unknown; Windows Shell bypasses are staple tooling for ransomware loaders and clickfix-style social engineering campaigns.
- CISA required action: Apply the October 2026 Patch Tuesday (or out-of-band) Microsoft update.
2. Affected Organizations Assessment
Exposed environments:
- Any organization with internet-facing Atlassian Data Center instances — Confluence and Jira DC are routinely self-hosted on-prem by enterprises that assume 'behind the firewall' means safe. Many are not behind the firewall.
- Ivanti Connect Secure VPN concentrators — thousands remain internet-facing globally; patch adoption historically lags weeks after disclosure due to maintenance-window friction.
- PAN-OS firewalls with management interfaces reachable from untrusted networks — still shockingly common despite years of CISA warnings.
- Cisco Secure Email Gateways at the mail perimeter — by definition internet-facing.
- Managed service providers and SMBs running AhsayCBS for backup-as-a-service — Ahsay has a large APAC and MSP footprint; MSP compromise cascades to hundreds of downstream tenants.
- All Windows estates — CVE-2026-96951 affects the universal attack surface; exploitation likely arrives via phishing, so email security posture determines real exposure.
Exposure scale estimates: Multi-product Atlassian DC flaws historically leave 30–50% of self-hosted instances unpatched one week after disclosure. Ivanti ICS patch adoption typically reaches ~60% within two weeks, leaving a long tail of compromised appliances. AhsayCBS exposure is smaller in raw count but concentrated in MSPs, giving each compromised server outsized blast radius.
Fastest-exploited sectors historically: Healthcare, government, education, and legal/financial services see the quickest operational impact from VPN/email gateway exploitation. Technology and telecom sectors are priority targets for PAN-OS and Atlassian exploitation by espionage actors. Backup software exploitation is a near-perfect predictor of imminent ransomware deployment in the victim environment.
3. Detection Engineering
The following Sigma rules target observable exploitation behaviors: Atlassian Java processes spawning shells (post-RCE), AhsayCBS/web server processes executing command interpreters (command injection), and suspicious unauthenticated requests against Ivanti/PAN-OS management endpoints.
---
title: Atlassian Data Center Java Process Spawning Shell - CVE-2026-21589 Exploitation
id: 8f3a2b1c-4e5d-4a6b-9c7d-1e2f3a4b5c6d
status: experimental
description: Detects Atlassian Confluence/Jira/Bitbucket Java processes spawning command interpreters or scripting engines, consistent with post-exploitation after RCE in Atlassian Data Center products (CVE-2026-21589).
author: Security Arsenal Threat Intel
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
date: 2026/10/15
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- '\java.exe'
- '\tomcat9.exe'
- '\confluence.exe'
- '\jira.exe'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\mshta.exe'
- '\certutil.exe'
- '\bitsadmin.exe'
- '\curl.exe'
- '\wget.exe'
condition: selection_parent and selection_child
falsepositives:
- Legitimate Atlassian plugins executing system commands (rare)
- Backup/monitoring agents triggered by Atlassian services
level: high
tags:
- attack.execution
- attack.t1059
- cve.2026.21589
---
title: AhsayCBS or Web Server Process Command Injection - CVE-2026-105134
id: 2c7d9e4f-6a1b-4c8d-9e0f-3b5a7c9d1e2f
status: experimental
description: Detects AhsayCBS backup server or web server processes spawning operating system command interpreters, indicating command injection exploitation (CVE-2026-105134) or post-auth-bypass activity (CVE-2026-105133).
author: Security Arsenal Threat Intel
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
date: 2026/10/15
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains:
- 'AhsayCBS'
- 'cbs'
- '\httpd.exe'
- '\nginx.exe'
- '\tomcat'
- '\w3wp.exe'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\net.exe'
- '\net1.exe'
- '\whoami.exe'
- '\vssadmin.exe'
- '\wbadmin.exe'
- '\bcdedit.exe'
condition: selection_parent and selection_child
falsepositives:
- AhsayCBS pre/post backup scripts legitimately invoking cmd.exe (baseline and exclude known script paths)
level: critical
tags:
- attack.execution
- attack.t1059
- attack.t1490
- cve.2026.105134
- cve.2026.105133
---
title: Suspicious Unauthenticated Requests to VPN/Firewall Management Endpoints - Ivanti ICS and PAN-OS
id: 5b1e8c3a-7d2f-4b9a-8c1e-6f4d2a0b3e5c
status: experimental
description: Detects web requests matching known exploitation-adjacent URI patterns for Ivanti Connect Secure (CVE-2026-104935) and Palo Alto PAN-OS (CVE-2026-0322), including path traversal, API abuse, and anomalous requests to admin interfaces from external sources.
author: Security Arsenal Threat Intel
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
date: 2026/10/15
logsource:
category: webserver
detection:
selection_uri:
cs-uri-stem|contains:
- '/api/v1/totp/user-backup-code'
- '/api/v1/configuration'
- '/dana-na/'
- '/dana/html5acc/'
- '/rest/'
- '/global-protect/'
- '/php/login.php'
- '/.git/'
selection_traversal:
cs-uri-stem|contains:
- '../'
- '..%2f'
- '%2e%2e'
- '..\\'
condition: selection_uri or selection_traversal
falsepositives:
- Legitimate admin API calls (filter by known admin source IPs)
- Scanner/vulnerability assessment traffic (still worth investigating)
level: high
tags:
- attack.initial_access
- attack.t1190
- attack.t1078
- cve.2026.104935
- cve.2026.0322
// Security Arsenal - KEV Wave 2026-10-13/15 Hunt
// Targets: CVE-2026-21589 (Atlassian), CVE-2026-105133/105134 (AhsayCBS),
// CVE-2026-104935 (Ivanti ICS), CVE-2026-0322 (PAN-OS),
// CVE-2026-76519 (Cisco SEG), CVE-2026-96951 (Windows Shell)
let Lookback = 14d;
// --- Part 1: Web server / edge process spawning shells (post-exploitation) ---
let SuspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","net.exe","net1.exe","whoami.exe","vssadmin.exe","wbadmin.exe","certutil.exe","bitsadmin.exe","curl.exe","wget.exe","mshta.exe","sh","bash","nc","ncat","python","perl"]);
let SuspiciousParents = dynamic(["java.exe","tomcat","confluence","jira","httpd.exe","nginx.exe","w3wp.exe","cbs","AhsayCBS","php","node"]);
let ProcEvents =
DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where FileName in~ (SuspiciousChildren)
| where InitiatingProcessFileName has_any (SuspiciousParents)
or InitiatingProcessFolderPath has_any ("atlassian","confluence","jira","bitbucket","ahsay","tomcat")
| project ProcessTime=TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, ReportId;
// --- Part 2: Network requests to known-targeted edge endpoints ---
let NetEvents =
DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where RemoteUrl has_any (
"dana-na","dana/html5acc","api/v1/totp","api/v1/configuration", // Ivanti ICS
"global-protect","php/login.php", // PAN-OS
"rest/api","rest/auth","plugins/servlet", // Atlassian
"obs","ahsay","cbs" // AhsayCBS
)
| project NetTime=TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, ActionType;
// --- Part 3: Webshell/file-write artifacts from path traversal (Cisco SEG / Atlassian) ---
let FileEvents =
DeviceFileEvents
| where TimeGenerated > ago(Lookback)
| where FolderPath has_any ("confluence","jira","atlassian","tomcat","wwwroot","htdocs","ahsay")
| where FileName has_any (".jsp",".jspx",".asp",".aspx",".php",".war",".class")
| where InitiatingProcessFileName has_any ("java.exe","tomcat","httpd.exe","nginx.exe","w3wp.exe","cbs")
| project FileTime=TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessFileName, SHA256;
// --- Part 4: Windows Shell abuse - suspicious .lnk/.url handler execution (CVE-2026-96951) ---
let ShellEvents =
DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where FileName =~ "rundll32.exe" or FileName =~ "explorer.exe"
| where ProcessCommandLine has_any ("shell32",".lnk",".url",".searchConnector-ms","file://","\\\\")
| project ShellTime=TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName;
union ProcEvents, NetEvents, FileEvents, ShellEvents
| sort by TimeGenerated desc
<#
.SYNOPSIS
Security Arsenal - KEV Wave 2026-10-13/15 Exposure Inventory & Patch Verification
Checks: Atlassian DC products (CVE-2026-21589), AhsayCBS (CVE-2026-105133/105134),
Windows Shell patch status (CVE-2026-96951). Outputs CSV report.
Run elevated. For Ivanti ICS / PAN-OS / Cisco SEG use vendor APIs + ICT tools (appliance-side).
#>
$ErrorActionPreference = 'SilentlyContinue'
$report = @()
$timestamp = Get-Date -Format 'yyyyMMdd-HHmmss'
$outFile = "KEV-Wave-20261015-Inventory-$timestamp.csv"
# --- Define minimum patched baselines (UPDATE from vendor advisories) ---
$baselines = @{
'Confluence Data Center' = [version]'9.2.8' # verify against Atlassian advisory
'Jira Software' = [version]'10.3.5' # verify against Atlassian advisory
'Bitbucket' = [version]'8.19.9' # verify against Atlassian advisory
'AhsayCBS' = [version]'9.13.0.0' # verify against Ahsay advisory
}
Write-Host "[*] Enumerating installed software..." -ForegroundColor Cyan
$installed = Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*,
HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* |
Select-Object DisplayName, DisplayVersion, InstallLocation, Publisher
foreach ($product in $baselines.Keys) {
$match = $installed | Where-Object { $_.DisplayName -like "*$product*" }
if ($match) {
foreach ($m in $match) {
$ver = $null
[version]::TryParse(($m.DisplayVersion -replace '[^0-9\.]',''), [ref]$ver) | Out-Null
$status = if ($ver -and $ver -lt $baselines[$product]) { 'VULNERABLE - PATCH REQUIRED' }
elseif ($ver) { 'PATCHED (verify advisory)' } else { 'UNKNOWN - MANUAL CHECK' }
$report += [PSCustomObject]@{
Product = $product; InstalledVersion = $m.DisplayVersion
MinPatchedVersion = $baselines[$product].ToString()
CVE = switch ($product) { 'AhsayCBS' {'CVE-2026-105133/105134'} default {'CVE-2026-21589'} }
Status = $status; Host = $env:COMPUTERNAME; Path = $m.InstallLocation
}
}
} else {
$report += [PSCustomObject]@{
Product = $product; InstalledVersion = 'NOT INSTALLED'
MinPatchedVersion = $baselines[$product].ToString()
CVE = ''; Status = 'NOT EXPOSED'; Host = $env:COMPUTERNAME; Path = ''
}
}
}
# --- Windows Shell CVE-2026-96951: check installed hotfixes against October 2026 rollup ---
Write-Host "[*] Checking Windows patch level for CVE-2026-96951..." -ForegroundColor Cyan
$hotfixes = (Get-HotFix).HotFixID
$requiredKBs = @('KB5069999') # REPLACE with actual October 2026 KB per Microsoft advisory
$kbFound = $false
foreach ($kb in $requiredKBs) { if ($hotfixes -contains $kb) { $kbFound = $true } }
$report += [PSCustomObject]@{
Product = 'Microsoft Windows Shell'
InstalledVersion = (Get-CimInstance Win32_OperatingSystem).Version
MinPatchedVersion = ($requiredKBs -join ', ')
CVE = 'CVE-2026-96951'
Status = if ($kbFound) { 'PATCHED' } else { 'VULNERABLE - APPLY OCTOBER 2026 UPDATE' }
Host = $env:COMPUTERNAME; Path = ''
}
# --- Network exposure check: is this host listening on common edge/mgmt ports? ---
Write-Host "[*] Checking exposed listening services..." -ForegroundColor Cyan
$listeners = Get-NetTCPConnection -State Listen |
Where-Object { $_.LocalPort -in 443,8443,8090,8091,7990,8444,4433 } |
Select-Object -Unique LocalPort, LocalAddress
foreach ($l in $listeners) {
$report += [PSCustomObject]@{
Product = 'Network Exposure'; InstalledVersion = "Port $($l.LocalPort) listening on $($l.LocalAddress)"
MinPatchedVersion = 'N/A'; CVE = 'N/A'
Status = 'REVIEW - Confirm this service must be reachable from untrusted networks'
Host = $env:COMPUTERNAME; Path = ''
}
}
$report | Format-Table -AutoSize
$report | Export-Csv -Path $outFile -NoTypeInformation
$vulnCount = ($report | Where-Object { $_.Status -like 'VULNERABLE*' }).Count
Write-Host "`n[*] Report written to $outFile" -ForegroundColor Green
if ($vulnCount -gt 0) {
Write-Host "[!] $vulnCount VULNERABLE finding(s). Escalate to emergency change control NOW." -ForegroundColor Red
exit 2
} else {
Write-Host "[+] No confirmed vulnerable instances on this host. Validate appliances (Ivanti/PAN-OS/Cisco) separately." -ForegroundColor Green
exit 0
}
4. Patch & Remediation Priorities
Priority 1 — Ivanti Connect Secure (CVE-2026-104935): Pre-auth bypass on the VPN perimeter. Patch immediately per the Ivanti security advisory (ivanti.com/support/security-advisories), then run the external Integrity Checker Tool and assume compromise for any appliance that was internet-facing before patching — rotate all credentials and certificates stored on the device.
Priority 2 — Atlassian Data Center suite (CVE-2026-21589): Multi-product impact across Confluence, Jira Software, Jira Service Management, and Bitbucket DC. Apply fixed versions per the Atlassian security advisory (confluence.atlassian.com/security). If patching is delayed, restrict instances to internal-only access and place behind a WAF with virtual patching.
Priority 3 — Ahsay AhsayCBS (CVE-2026-105133 + CVE-2026-105134): Patch both together — the auth bypass + command injection pair forms a complete unauthenticated RCE chain on backup infrastructure. Take AhsayCBS management interfaces off the internet immediately, patched or not. Verify backup integrity before trusting any restore point.
Priority 4 — Cisco Secure Email Gateway (CVE-2026-76519): Unauthenticated arbitrary file write. Upgrade to fixed software per Cisco's advisory (sec.cloudapps.cisco.com/security/center). Hunt for webshells on the appliance file system.
Priority 5 — Palo Alto PAN-OS (CVE-2026-0322): Authenticated code injection — lower severity in isolation but routinely chained. Upgrade PAN-OS, restrict the management interface to a dedicated management VRF, and audit admin accounts for rogue additions.
Priority 6 — Microsoft Windows Shell (CVE-2026-96951): Deploy the October 2026 Windows update estate-wide. Server and workstation fleets both — this is a phishing-delivery initial access vector, so user endpoints are the primary target.
Workarounds where patching is blocked: Isolate affected services from the internet; enforce WAF rules blocking traversal sequences and known exploit URIs (see Sigma rule #3 patterns); for Ivanti, factory reset is the only trustworthy path if compromise indicators are found.
CISA compliance deadlines: BOD 22-01 due dates are assigned per KEV entry — historically ~3 weeks from listing, placing federal remediation deadlines in early November 2026. Confirm exact due dates against the live KEV catalog entries. Private organizations should adopt the same deadlines as internal SLAs.
Assume-breach posture: For Ivanti ICS, Cisco SEG, and AhsayCBS specifically, patching stops future exploitation but does nothing about access already gained. Run the hunt queries above across a minimum 14-day lookback, review authentication logs for anomalous admin sessions, and rotate credentials on any appliance that was exposed and unpatched.
Related Resources
Security Arsenal Penetration Testing Managed SOC & MDR AlertMonitor Platform From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.