Practical analysis of exploited vulnerabilities in security products: firewalls, VPNs, proxies, mail gateways, EDR and SSE.https://patchtonight.com/enhttps://patchtonight.com/cve/CVE-2024-0012/https://patchtonight.com/cve/CVE-2024-0012/Sending X-PAN-AUTHCHECK set to off gave attackers admin access to exposed management interfaces. Chained with CVE-2024-9474 for root, it compromised about 2,000 firewalls within days of disclosure.Sat, 10 Oct 2026 00:00:00 GMTPalo Alto NetworksPAN-OS management web interfacehttps://patchtonight.com/cve/CVE-2024-3400/https://patchtonight.com/cve/CVE-2024-3400/An unauthenticated command injection in GlobalProtect gave root on PAN-OS firewalls (CVSS 10). A likely state-backed group exploited it for weeks before disclosure, then mass exploitation followed the public exploit.Sat, 10 Oct 2026 00:00:00 GMTPalo Alto NetworksPAN-OS GlobalProtect portal and gatewayhttps://patchtonight.com/cve/CVE-2024-9474/https://patchtonight.com/cve/CVE-2024-9474/A PAN-OS administrator can run commands as root through the management interface. Alone it needs admin rights; chained with CVE-2024-0012 or CVE-2025-0108, it gave attackers root on exposed firewalls.Sat, 10 Oct 2026 00:00:00 GMTPalo Alto NetworksPAN-OS management web interfacehttps://patchtonight.com/cve/CVE-2025-0108/https://patchtonight.com/cve/CVE-2025-0108/A path confusion between Nginx and Apache lets anyone who can reach the PAN-OS management interface skip login. Exploited within a day of disclosure, and chained with CVE-2024-9474 to get root.Sat, 10 Oct 2026 00:00:00 GMTPalo Alto NetworksPAN-OS management web interfacehttps://patchtonight.com/cve/CVE-2025-25249/https://patchtonight.com/cve/CVE-2025-25249/A heap overflow in FortiOS's CAPWAP daemon (cw_acd) gives unauthenticated code execution on interfaces with Fabric access enabled. Fixed in 2025, disclosed in January 2026, exploited from July 2026 with 178 confirmed infections.Sat, 10 Oct 2026 00:00:00 GMTFortinetFortiOS Security Fabric (CAPWAP)https://patchtonight.com/cve/CVE-2025-64446/https://patchtonight.com/cve/CVE-2025-64446/A path traversal plus a trusted request header lets an unauthenticated attacker act as any FortiWeb user, including admin. Exploited since at least early October 2025, with a public proof of concept, and fixed from 8.0.2.Sat, 10 Oct 2026 00:00:00 GMTFortinetFortiWeb management GUIhttps://patchtonight.com/cve/CVE-2026-0300/https://patchtonight.com/cve/CVE-2026-0300/An unauthenticated buffer overflow in the Authentication Portal (Captive Portal) gives root on PA-Series and VM-Series firewalls. A likely state-sponsored group exploited it for about four weeks before disclosure.Sat, 10 Oct 2026 00:00:00 GMTPalo Alto NetworksPAN-OS User-ID Authentication Portalhttps://patchtonight.com/cve/CVE-2026-104286/https://patchtonight.com/cve/CVE-2026-104286/A path traversal in FortiMail's Identity-Based Encryption (IBE) web service lets unauthenticated attackers write arbitrary files (CVSS 9.8). Exploited before disclosure; attackers set up mail archiving to their own server.Sat, 10 Oct 2026 00:00:00 GMTFortinetFortiMailhttps://patchtonight.com/cve/CVE-2026-24858/https://patchtonight.com/cve/CVE-2026-24858/With FortiCloud SSO login enabled, an attacker with their own FortiCloud account could log in as admin to devices belonging to other customers. Exploited on fully patched FortiGates in January 2026 to create admin accounts and steal configurations.Sat, 10 Oct 2026 00:00:00 GMTFortinetFortiCloud SSO (FortiOS, FortiManager, FortiAnalyzer, FortiProxy)https://patchtonight.com/cve/CVE-2026-40050/https://patchtonight.com/cve/CVE-2026-40050/A cluster API endpoint in self-hosted LogScale lets anyone who can reach it read files from the server without logging in (CVSS 9.8). SaaS and Next-Gen SIEM are already protected; self-hosted clusters need an upgrade.Sat, 10 Oct 2026 00:00:00 GMTCrowdStrikeLogScale Self-Hostedhttps://patchtonight.com/cve/CVE-2026-40058/https://patchtonight.com/cve/CVE-2026-40058/A race condition in Falcon's Office macro removal feature lets a local low-privileged user write files to protected locations and reach SYSTEM. A public proof of concept (FalconFlank) exists; CrowdStrike sees no exploitation in the wild.Sat, 10 Oct 2026 00:00:00 GMTCrowdStrikeFalcon sensor for Windows (Office macro removal)https://patchtonight.com/cve/CVE-2026-50751/https://patchtonight.com/cve/CVE-2026-50751/A logic flaw in IKEv1 certificate validation lets an unauthenticated attacker open a Remote Access VPN session without a valid password (CVSS 9.3). Exploited since May 7, 2026 against a few dozen organizations, including a Qilin ransomware affiliate case.Sat, 10 Oct 2026 00:00:00 GMTCheck PointCheck Point Remote Access VPN and Mobile Access (IKEv1)https://patchtonight.com/cve/CVE-2026-85102/https://patchtonight.com/cve/CVE-2026-85102/Improper certificate validation during VPN negotiation lets an unauthenticated attacker run code on Check Point gateways (CVSS 9.8). Check Point saw exploitation from September 12, 2026, and CISA added it to KEV.Sat, 10 Oct 2026 00:00:00 GMTCheck PointQuantum Security Gateway VPNhttps://patchtonight.com/cve/CVE-2026-93616/https://patchtonight.com/cve/CVE-2026-93616/A pre-authentication path traversal in the Check Point management web service lets attackers run scripts on the management server (CVSS 9.8). Check Point saw targeted exploitation from July 23, 2026, and CISA added it to KEV.Sat, 10 Oct 2026 00:00:00 GMTCheck PointQuantum Security Managementhttps://patchtonight.com/cve/CVE-2026-0257/https://patchtonight.com/cve/CVE-2026-0257/Attackers forge GlobalProtect authentication override cookies and open VPN sessions without credentials. Exploited since May 17, 2026, and used by Qilin ransomware affiliates for initial access.Fri, 09 Oct 2026 00:00:00 GMTPalo Alto NetworksPAN-OS GlobalProtect portal and gateway