Three of this week's additions to the exploited-vulnerability catalogue sit on the perimeter: an Ivanti VPN gateway worked without any malware, a Cisco mail appliance reachable by sending it an attachment, and a Palo Alto management interface. The item an Indian defender should read first is none of them. CERT-In has documented attackers calling banks' own disbursal APIs from inside infrastructure the banks had whitelisted.
1
CERT-In records fund-transfer API abuse across Indian BFSI entities — CIAD-2026-0046
India exposureThe advisory of 9 October, issued with CSIRT-Fin and rated critical, describes attackers who steal payment aggregator and partner-bank API credentials, then invoke disbursal and fund-transfer APIs from inside the organisation's own whitelisted infrastructure. KYC, sanction, beneficiary verification, balance checks and per-transaction limits are bypassed, because those controls sit in the application layer the attacker stepped around. Named targets are NBFCs, digital lending platforms, fintechs, payment service providers and wallet operators. Press reporting puts about 20 institutions affected, a figure the advisory does not state.
ActionInventory every payment API and decommission unused and deprecated endpoints. Replace long-lived static tokens with per-session authentication and enforce multi-factor authentication on payment platforms. Bind transaction stages cryptographically, so a disbursal cannot be honoured without the steps that precede it. Add maker-checker on fund movement.
SourceCERT-In and CSIRT-Fin advisory CIAD-2026-0046, 9 October 2026; The420.in, 15 October 2026.
2
Ivanti Connect Secure zero-day exploited without malware — CVE-2026-104935
India exposureAn authentication bypass by spoofing, rated 8.6, lets an unauthenticated attacker run commands on the gateway. Ivanti confirmed exploitation at disclosure on 13 October. Volexity tracks the actor as UTA0576, active from at least 1 October, deploying no malware or web shell, re-exploiting the appliance for each command, tampering with logs and evading the Integrity Checker Tool. Connect Secure fronts remote access for Indian IT services firms, banks and public sector undertakings.
ActionUpgrade to 22.8R2.5, 25.1.1.2 or 25.1.3.1. A clean Integrity Checker run is not evidence of a clean appliance here, so rotate gateway credentials, sessions and certificates on anything exposed. Version 22.8 reaches end of life on 31 January 2027.
SourceIvanti advisory and CISA alert, 13 October 2026; Volexity findings reported by BleepingComputer, 13 October 2026.
3
Cisco Secure Email Gateway takes root code execution from an attachment — CVE-2026-76519
India exposureRated 9.8. A relative path traversal in the Advanced Malware Protection path lets an unauthenticated attacker write files and run commands as root by sending one crafted attachment through an unpatched appliance. Cisco became aware of exploitation during October. Exposure requires File Reputation enabled and assigned to a mail policy, with Content Scanner Tools older than 25.3.0.5525. This is the third exploited zero-day in the product in about a year.
ActionInstall Content Scanner Tools 25.3.0.5525 or later, which needs no AsyncOS upgrade and no restart; confirm with contentscannerstatus. Otherwise move to AsyncOS 15.5.5-014 or 16.5.0-780. AsyncOS 16.0 has no fix. There is no workaround, so review quarantine and scanner logs for the period before patching.
SourceCisco advisory and CISA Known Exploited Vulnerabilities catalogue, 14 October 2026, remediation date 17 October; BleepingComputer, 14 October 2026.
4
PAN-OS management interface gives root to a valid account — CVE-2026-0322
India exposureCode injection rated 8.6 on CVSS v4. An attacker who already holds credentials and can reach the management interface executes code as root. Palo Alto Networks found the flaw internally, disclosed it on 14 October and recorded very limited exploitation. PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 are affected on PA-Series and VM-Series firewalls and Panorama appliances. Cloud NGFW and Prisma Access are not.
ActionUpgrade to 12.2.4, 12.1.10-h2, 11.2.13-h3, 11.1.16-h3 or 10.2.18-h12. There is no complete workaround. Because the flaw needs an account, the compensating control is reachability: confine the management interface to a dedicated management network and remove internet-facing access.
SourcePalo Alto Networks advisory and CISA Known Exploited Vulnerabilities catalogue, 14 October 2026, remediation date 17 October; SOC Prime, 15 October 2026.
5
FortiManager breach at a service provider exposed 500 client firewalls — CVE-2024-47575
India exposureUnit 42 reported on 15 October an intrusion at a telecommunications managed service provider that began at its FortiManager appliance, exploited through the FortiJump flaw of 2024. The stolen archive held configurations, credentials and trust material for more than 500 managed FortiGate firewalls, and administrative and VPN passwords recovered from those files were used to open FortiGate VPN sessions. Unit 42 notes this did not by itself confirm that client firewalls were compromised. The PEERSTITCH implant runs inside FortiGate processes, writes nothing to disk and opens no listening port.
ActionAsk your service provider, in writing, when its FortiManager was patched for CVE-2024-47575 and for CVE-2025-61624, the FortiOS path traversal also used here. Treat any configuration held on a shared management appliance as disclosed, and rotate administrative credentials, VPN accounts, pre-shared keys and certificates. Hunt for VPN authentications from unexpected networks rather than for artefacts on disk.
SourcePalo Alto Networks Unit 42 research reported by Cyber Security News, 15 October 2026. Four of these five are patch-and-rotate problems. The CERT-In advisory asks a different question, because nothing in it was unpatched. The attackers used working credentials from inside an address range the institution had whitelisted, and every check that should have stopped a disbursal sat one layer above where the call arrived. A control placed where the traffic does not pass is not a control. — Nirad Threat Research
