This week was dominated by one theme that should be familiar by now: the management plane and the edge are where attackers spend their effort. A Palo Alto Networks zero-day, a very large Microsoft Patch Tuesday with a cluster of network-service RCEs, and critical fixes from F5 and Juniper all landed within a few days of each other. Below are the items I think matter most for people running networks and infrastructure, and what to actually do about them.
1. PAN-OS management interface zero-day exploited in the wild
Palo Alto Networks released fixes for CVE-2026-0322, a PAN-OS remote code execution flaw in the management interface that has seen limited exploitation. According to BleepingComputer, it affects PA-Series and VM-Series firewalls as well as Panorama virtual and M-Series appliances, carries a severity score of 8.6, and lets an authenticated attacker with network access to the management interface execute code as root. Cloud NGFW and Prisma Access are not affected. Fixes are out across the 10.2, 11.1, 11.2, 12.1 and 12.2 trains, and CISA added the bug to the KEV catalog. SecurityWeek notes that IoCs have been published.
Why it matters operationally: the precondition is credentials plus reachability of the management interface. That is not a high bar if management is exposed to broad internal ranges or, worse, the internet, and if admin credentials have ever been phished or reused. Vendor guidance is the same as every previous PAN-OS management-plane incident: restrict management access to trusted internal addresses only. There is no workaround, and Threat Prevention signatures provide only partial coverage.
What I would do this week:
- Confirm management is only reachable from a dedicated management network or jump hosts.
- Patch, starting with internet-adjacent and Panorama appliances.
- Rotate firewall admin credentials and review admin login history for unexpected source IPs.
A quick check from a host outside your management network should fail to connect:
# Run from a NON-management segment; every target should time out or be refused
for fw in fw-edge-01 fw-edge-02 panorama-01; do
timeout 5 bash -c "echo > /dev/tcp/$fw/443" 2>/dev/null \
&& echo "$fw: mgmt 443 REACHABLE - fix your ACLs" \
|| echo "$fw: not reachable (good)"
done
If any of those print “REACHABLE”, treat that as the actual finding, not the patch level.
2. October Patch Tuesday: DHCP Server, QUIC and identity
Microsoft’s October release is very large. CrowdStrike’s analysis counts 1,413 CVEs, including one exploited zero-day, two publicly disclosed ones and 75 rated Critical; the SANS ISC diary has the full table if you want to sort by product.
The parts relevant to infrastructure teams:
- Windows DHCP Server: several Critical RCEs (CVE-2026-88117, -88119, -88120, -88171 among them). DHCP servers sit on internal networks and accept traffic from any client asking for a lease, so these are a natural lateral-movement target once an attacker has a foothold on a user VLAN.
- Microsoft QUIC: CVE-2026-100219 and CVE-2026-105016 are Critical, network-reachable flaws in the QUIC stack. Anything using Windows QUIC transport is in scope, which increasingly includes services you might not think of as “web”.
- AD DS and AD FS: an RCE against domain controllers (CVE-2026-70229) and two AD FS spoofing issues (CVE-2026-108131, CVE-2026-96222) that could undermine federated authentication.
- NDES: CVE-2026-69802 is a Critical RCE in Network Device Enrollment Service. If you use NDES/SCEP to enroll network devices or MDM-managed endpoints, that server deserves priority.
Prioritisation for an infra team: domain controllers, DHCP servers, NDES and AD FS first, ahead of the general fleet. Those are the hosts where one compromise turns into control of the environment. Also note that BleepingComputer reports recent Windows updates may cause Remote Desktop failures, so stage the rollout and check that your RDP-based admin paths still work before going wide.
3. F5 and Juniper critical fixes
SecurityWeek reports that F5 and Juniper Networks both shipped patches for critical vulnerabilities this week, some of which could lead to remote code execution and full device takeover. I have not gone through the individual advisories yet, so I will not repeat identifiers here. Check the vendor advisory portals directly against your inventory.
The operational point is the same as with PAN-OS. Load balancers and routers are long-lived, rarely rebooted, and often run images that fall behind the patch train because maintenance windows are hard to get. If you do not have an up-to-date software version inventory for BIG-IP and Junos devices, this is a good week to build one. A simple scheduled job that collects show version / tmsh show sys version output into a file and diffs it against the latest advisories is usually enough.
4. The pattern: edge and management planes
Looking at the related coverage this week, including Citrix NetScaler, F5 BIG-IP APM and SonicWall SMA1000 zero-days, the trend continues. Perimeter appliances and their management interfaces remain the most reliable entry point for serious attackers. A few controls hold up regardless of vendor:
- Management interfaces only on an out-of-band or dedicated management VRF, never on data-plane interfaces facing users or the internet.
- MFA and short-lived credentials for device admin access, ideally through a PAM or jump host so access is logged centrally.
- Device logs (admin logins, config commits) sent to the SIEM, with alerts on logins from unexpected sources.
- A documented emergency patch path for edge devices that does not depend on the next quarterly window.
None of this is new, but every week like this one shows that the gap between vendor disclosure and exploitation is measured in days. Patching speed for edge devices is an organisational capability, not a one-off task, and it is worth measuring as such.