Cisco patches actively exploited SSL VPN denial-of-service flaw in ASA and FTD

Why it matters.Perimeter firewalls protect corporate internal networks. When alternate login paths bypass multi-factor authentication, stolen directory credentials grant perimeter access. Network engineering teams must install SonicOS 7.3.4 or 8.2.3 immediately.

• Vulnerability mechanics: Tracked as CVE-2026-19868 with a 7.5 CVSS score, an authentication enforcement defect allows users with valid alternate credentials to bypass SAML controls.
• Exploitation impact: Attackers with directory or local credentials bypass SAML-enforced multi-factor authentication, reducing access to single-factor authentication.
• Deployment scope: The defect affects firewalls with SSLVPN and SAML active on Gen 7 (SonicOS <= 7.3.3-7015) and Gen 8 (SonicOS <= 8.2.2-8015) appliances.
• Active exploitation: SonicWall and CISA confirmed active exploitation, adding the vulnerability to the Known Exploited Vulnerabilities catalog.
• Remediation releases: SonicWall released firmware updates, urging upgrades to SonicOS 7.3.4 for Gen 7 and SonicOS 8.2.3 for Gen 8.

Why it matters.FreeSWITCH powers core voice-over-IP networks and carrier session border controllers. When SIP headers invoke administrative execution pathways without authentication, network intruders gain root shell execution and tap call audio. Infrastructure engineers must deploy FreeSWITCH 1.11.3 immediately. Operators without maintenance windows should disable inbound SIP chat handling across active Sofia profiles.

• Vulnerability mechanics: Tracked as CVE-2026-116779 with a 9.8 CVSS score, the defect lets unauthenticated callers execute arbitrary commands.
• Parsing flaw: The flaw resides in sofia_presence_handle_sip_i_message, where SIP headers split on a plus symbol treat the prefix as a chat protocol selector.
• Execution pathway: Selecting the api protocol handler routes message payloads into switch_api_execute, invoking system command sinks with daemon privileges.
• Remediation directive: CISA issued an emergency three-day remediation deadline under BOD 26-04, requiring federal agencies to patch by November 12, 2026.
• Software release: SignalWire released FreeSWITCH 1.11.3, adding a per-profile parameter that disables the vulnerable chat API handler by default.

Why it matters.Babelfish allows legacy SQL Server workloads to migrate to cloud PostgreSQL databases without rewrite. When default TDS ports accept packets that corrupt heap memory, attackers gain system execution on database hosts. Teams running Aurora PostgreSQL with Babelfish should apply minor engine updates. Cloud architects should restrict access to port 1433 using private security groups.

• Vulnerability mechanics: Tracked as CVE-2026-119923 with a 9.8 CVSS score, a heap-based buffer overflow in the TDS prelogin parser enables unauthenticated remote code execution.
• Adjacent disclosure: Tracked as CVE-2026-119924 with an 8.1 CVSS score, an out-of-bounds read flaw in the TDS RPC parser allows memory leakage.
• Protocol exposure: The flaws exist in the Tabular Data Stream protocol on port 1433, which emulates Microsoft SQL Server on PostgreSQL clusters.
• Affected versions: The vulnerabilities impact Babelfish extension releases across versions 1.0 through 5.4 in self-managed and cloud database stacks.
• Remediation releases: AWS deployed patched Aurora PostgreSQL engine updates and released open-source Babelfish versions 4.10, 5.6, and 6.1.

Why it matters.Application delivery controllers direct internet traffic across corporate microservices and internal applications. When management interfaces suffer unauthenticated code execution, adversaries establish persistent footholds on edge appliances. Infrastructure teams managing NetScaler must apply firmware version 14.1-73.49 or 13.1-64.32. System administrators should isolate management interfaces behind strict internal subnets.

• Vulnerability mechanics: Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws stem from improper memory management during out-of-memory error recovery in PHP.
• Attack vector: Unauthenticated remote actors can submit crafted HTTP requests to the HTTPS management interface and XML API to achieve arbitrary code execution.
• Affected appliances: The defects impact customer-managed on-premises NetScaler ADC and NetScaler Gateway deployments on release tracks 13.1 and 14.1.
• Cloud boundary: Cloud-hosted NetScaler services managed by Citrix are unaffected, with exposure limited to customer-managed hardware and virtual appliances.
• Remediation releases: Citrix released NetScaler versions 14.1-73.49 and 13.1-64.32 alongside updated FIPS firmware builds, advising immediate installation.

Why it matters.Systems Manager documents automate operations across fleet instances with elevated instance profile permissions. When sample documents unsafely concatenate parameter strings, authenticated operators execute arbitrary shell commands that bypass Cedar authorization policies. Security operations engineers should audit account inventories for custom Rex SSM documents. DevOps leads should replace concatenated parameter scripts with strictly typed SSM parameter schemas.

• Vulnerability mechanics: Tracked as CVE-2026-122193, an input handling flaw in sample SSM documents permitted authenticated users to inject arbitrary OS commands.
• Sandbox breakout: Attackers invoking the Rex-RO and Rex-RW example documents could pass crafted script arguments that escaped the intended Cedar policy sandbox.
• Target environment: The setup guide enabled customers to configure confidential execution pipelines and policy-governed administration across EC2 instances.
• Documentation removal: AWS updated the Trusted Remote Execution setup documentation, stripping out the insecure script parameter parsing patterns.
• Customer remediation: AWS advised administrators who deployed custom SSM documents using the setup guide examples to delete Rex-RO and Rex-RW templates immediately.

Why it matters.Automated machine learning pipelines ingest training datasets from public repositories. When extraction libraries permit directory traversal, unvetted dataset archives overwrite local shell scripts and python binaries to achieve remote execution. Machine learning platform engineers should upgrade GluonTS packages to version 0.17.0 across training pipelines. Infrastructure teams should adopt Python 3.14 to enforce native extraction filtering.

• Vulnerability mechanics: Tracked as CVE-2026-119083, the defect involves a TarSlip directory traversal flaw during automated dataset archive unpacking.
• Exploit mechanics: Crafted tar archives containing malicious links write files outside the designated extraction directory with process privileges.
• Ecosystem impact: The flaw impacts GluonTS versions prior to 0.17.0 across Python pipelines running probabilistic time-series forecasting.
• Remediation release: AWS released GluonTS version 0.17.0 with secure archive extraction filters that restrict writes to target directories.
• Runtime defense: AWS noted that running data pipelines under Python 3.14 or later applies default TarFile extraction filters that neutralize symlink traversals.

Why it matters.Modern enterprise software architectures depend on third-party SaaS platforms, cloud infrastructure, and appliance firmware for encryption. When external vendors fail to migrate away from public-key algorithms, harvest-now-decrypt-later attacks threaten long-term corporate confidentiality. Chief information security officers should integrate the 31 questions into vendor procurement evaluations. Procurement leads should reject supplier contracts that classify post-quantum algorithms as premium add-ons.

• Agency collaboration: CISA, the National Security Agency, and Australia's Cyber Security Centre co-authored the joint guidance for enterprise leadership.
• Framework structure: The guidance organizes 31 practical questions across five operational stages: Locate, Assess, Triage, Implement, and Communicate.
• Cryptographic visibility: Organizations must require third-party suppliers to maintain a Cryptographic Bill of Materials identifying all embedded algorithms.
• Hardware constraints: The checklist asks vendors whether cryptographic implementations are hardcoded in ways that prevent firmware algorithm upgrades.
• Licensing scrutiny: Procurement teams are instructed to verify that vendors include post-quantum security updates in baseline licenses without extra fees.