If you do one thing this week, check whether your office VPN runs on a Cisco ASA or Firepower (FTD) firewall and get it onto a fixed release. Cisco confirmed attackers are exploiting a new SSL VPN flaw that lets anyone on the internet crash and reload the firewall without logging in, and CISA added it to its Known Exploited Vulnerabilities catalog on October 29. For a small office, a firewall that keeps rebooting means no VPN, no internet, and no remote staff.

Patch now

Cisco ASA and FTD SSL VPN zero-day (CVE-2026-76418)

What it is: A flaw in the Remote Access SSL VPN login that lets an unauthenticated attacker force the device to crash and reload. It is rated CVSS 8.6. The impact is availability only: no code execution or data theft has been reported. Cisco PSIRT confirmed exploitation in the wild, and CISA added it to KEV on October 29 (GBHackers, SOC Prime).

Who is affected: ASA and FTD devices with Remote Access SSL VPN where a tunnel group has secondary authentication configured. Cisco says to check DefaultWEBVPNGroup as well. Cloud-delivered Firewall, Cloud-delivered FMC, Cisco Secure Access, and FMC Software are not affected.

What to do: Cisco says there is no complete workaround, so upgrade:

• ASA: 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, or 9.24.1.27 / 9.24.10.1
• FTD: 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, or 10.1.1

Until you can upgrade, Cisco lists two temporary mitigations: no tunnel-group-list enable if DefaultWEBVPNGroup does not use secondary authentication, or no secondary-authentication-server-group, which Cisco warns weakens authentication. Watch syslog for unexplained reloads.

Update: PHP2Shell on Palo Alto firewalls (CVE-2026-109618, CVE-2026-109619)

What changed: Last week Palo Alto hotfixes were still pending. Now CISA has added both CVEs to KEV (October 26), Palo Alto confirms attackers are exploiting management interfaces exposed to the internet, and Unit 42 reports attackers chaining the PHP flaws with a Linux kernel bug (CVE-2026-46300) to get root. Sophos walked back an earlier exploitation claim to scanning and failed attempts, but Palo Alto’s own confirmation stands (The Register, Cyber Security News).

What to do: Install the hotfix for your branch: 12.2.4-h1, 12.1.10-h3, 11.2.16-h1, 11.1.16-h4, or 10.2.18-h13, or the fix listed for your maintenance release. Allow management only from trusted internal IPs. GlobalProtect, Clientless VPN, and Captive Portal are not affected. If management was ever reachable from the internet, review the device for compromise before you call it done.

Veeam Backup & Replication (CVE-2026-108142)

What it is: An authorization bypass in the CDP Coordinator Service that needs no login, rated CVSS 9.1. Two path traversal bugs (CVE-2026-108140, CVE-2026-108141) are fixed in the same release. No exploitation is reported, but Veeam warns attackers may reverse-engineer the patch. Backup servers are a favorite ransomware target, so treat this as urgent (Veeam KB4948).

What to do: If you run 13.1.1.18 or earlier 13.1 builds, upgrade to 13.1.2 (build 13.1.2.57). If you run 13.0.2.29 or earlier 13.0 builds, upgrade to 13.0.3 (build 13.0.3.63). Version 12.x is not affected. Veeam Agent for Linux has a separate fix, CVE-2026-105477, in build 13.1.2.11.

WatchGuard Fireware OS

What it is: WatchGuard published 18 advisories on October 27, seven of them critical. The highest, CVE-2026-103594 (CVSS 9.5), only affects Fireboxes set up as FireCloud Gateways. Others allow code execution before login through AD authentication, the SIP proxy, Access Portal, and FireCluster. WatchGuard says it is not aware of exploitation (WatchGuard PSIRT, SecurityOnline).

What to do: Upgrade to Fireware 2026.4, 12.12.4, or 12.5.22 depending on your branch, and update the Mobile VPN with SSL Windows client. Restrict management to trusted hosts, and turn off Access Portal and the SIP proxy if you do not use them.

Other items this week

Entra ID: MemberOf rules stop working November 3

What it means: MemberOf was a preview operator for dynamic membership rules, and it retires on November 3, 2026. After that, any dynamic group, dynamic administrative unit, or entitlement auto-assignment policy using it stops updating. Membership freezes, so new hires may not get licenses or Conditional Access coverage, and people who left may keep access (MC1529463).

What to do: Export dynamic groups from the Entra admin center and search the rules for MemberOf. Use Microsoft Graph PowerShell to check administrative units and auto-assignment policies. Rewrite those rules with supported operators, or switch the group to assigned membership, then verify the membership list.

Entra ID: Microsoft SMS and voice sign-in retire February 1, 2027

What it means: Microsoft is retiring its built-in SMS and voice authentication, citing phishing and SIM-swap risk. Users with another registered method keep using it. Users whose only method is SMS or voice get one last sign-in that way and must then register a passkey. That lands on the helpdesk if nobody plans for it (MC1528000).

What to do: Find users who rely on SMS or voice, starting with those who have no other method, and move them to passkeys or another supported method now. If you must keep SMS, Microsoft says to set up your own telecom provider through the Microsoft Security Store first. Our cybersecurity services cover MFA rollouts like this.

This week’s checklist

1. Run show version on every Cisco ASA or FTD and confirm it is on a fixed release from the list above.
2. Confirm every Palo Alto firewall shows the PHP2Shell hotfix and that its management interface is not reachable from the internet.
3. Check the Veeam console version and upgrade to 13.1.2 or 13.0.3 if you are on 13.x. Then test one restore, which is the core of our backup and disaster recovery work.
4. Check Fireware versions on every WatchGuard Firebox and disable Access Portal and the SIP proxy if unused.
5. Search Entra dynamic group rules for MemberOf and fix them before November 3.
6. Pull a list of users whose only MFA method is SMS or voice and schedule their move to passkeys.

Three of this week’s four urgent items are firewalls and VPNs, the box every remote worker depends on. If you want a senior engineer to check your firewall firmware, lock down management access, and plan upgrades before the next zero-day, see our network infrastructure services. For ongoing patch tracking across everything else, see managed IT services.