Cybersecurity Weekly Briefing, 10-16 October

Palo Alto Networks patches a PAN-OS RCE 0-day exploited via the management interface

Palo Alto Networks has released updates for CVE-2026-0322 (CVSSv4 8.6 according to the vendor), a 0-day vulnerability in the PAN-OS management interface that allows an authenticated attacker with network access to execute code as root. It affects the PA-Series and VM-Series firewalls and Panorama (virtual and M-Series), whilst Cloud NGFW and Prisma Access are not affected.

Palo Alto confirms that exploitation has been very limited, without specifying when it began or who is behind it, and has shared three attacker IP addresses: 66.42.72[.]14, 208.83.239[.]114 and 149.248.47[.]234. CISA has added it to the KEV with a deadline of 17 October. Patches are available for PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2. There is no workaround, and Threat Prevention signatures only offer partial coverage.

As the exploit requires valid credentials, the priority is to restrict the management interface to trusted internal IP addresses, and to update and review recent administrative accesses.

Más info

Sabotage pushes refrigerators at over 150 French supermarkets to 50 °C

In the early hours of 11 to 12 October, several French supermarkets suffered sabotage of their refrigeration systems: attackers extended defrost cycles and changed temperature setpoints to reach 50 °C, forcing tonnes of food to be discarded. Intermarché was the hardest-hit chain, with around 150 stores, and incidents were also reported at Coopérative U and E.Leclerc.

CERT-FR has warned of numerous compromises of Danfoss AK-SM and AK-SC controllers, and the leading technical hypothesis points to the vulnerability chain documented by Claroty Team82 in the Danfoss AK-SM 800A: CVE-2025-41450, an alternative authentication mechanism based on a daily code that grants an administrative session without a password, and CVE-2025-41451, a command injection in the SMTP configuration leading to remote code execution. Team82 identified 2,765 of these controllers exposed online. There is no public confirmation that this chain was used in France.

Updating to version R4.3.1 or later, removing management interfaces from the internet, restricting access to authorised vendors, rotating credentials and, if an intrusion is suspected, preserving evidence and restoring devices to factory settings is recommended.

More info

Danish population register breach traced to a vendor with accounts protected by “123456”

New details on the breach of Denmark’s Central Person Register (CPR) point to Pays ApS, a small IT company in Odense with legitimate access to the register, which used the password “123456” on at least three accounts, including an administrator account, according to Politiken. The attacker claims access was gained with a former employee’s leaked password and that two programs were built to extract the data and store it outside the register. The stolen dataset includes 8,749,975 records with CPR numbers and addresses, covering around 5.5 million living and 3.3 million deceased individuals.

According to the attacker, access began on 10 September and lasted 21 days and 17 hours, while authorities refer to around ten days. The actor says there are no plans to sell or publish the information and there is no indication that MitID was compromised, although the data could be combined with other leaks for phishing or fraud campaigns.

The case reinforces the need to block trivial passwords and audit the credentials of third parties with access to critical systems.

More info

Cisco SEG: an arbitrary file write vulnerability is being exploited, allowing commands to be executed as root via an attachment

Cisco has confirmed that CVE-2026-76519 (CVSSv3.1 9.8 according to Cisco) is being actively exploited. This is a path traversal vulnerability in the Advanced Malware Protection feature of the Cisco Secure Email Gateway: an unauthenticated sender can write arbitrary files and execute commands as root by sending an email with a manipulated attachment. Only gateways with the File Reputation service enabled and Content Scanner Tools versions prior to 25.3.0.5525 are vulnerable. The fix was already included in the 14 September hardening release (AsyncOS 15.5.5-014 and 16.5.0-780) and can be applied by updating only the Content Scanner Tools, without a reboot. The 16.0 branch does not have a patched version.

This is the second Secure Email Gateway vulnerability to be exploited in a month, following the SQL injection disclosed in September, and the third with root-level access since December, when the China-linked actor UAT-9686 abused the spam quarantine feature. Cisco has not disclosed the scope or the perpetrators, although it has already contacted Secure Email Cloud customers who showed indicators of compromise.

It is recommended to check the version using `contentscannerstatus` and run `grep "System Security" system_logs` on all nodes in the cluster.

More info

Microsoft patches 1,413 vulnerabilities, including one exploited in Windows Shell

Microsoft has released its biggest Patch Tuesday to date, with patches for 1,413 vulnerabilities in Windows, Office, SharePoint, SQL Server and development tools, more than 70 of which are critical. The only one marked as exploited is CVE-2026-96951 (CVSSv3 8.8 according to Microsoft), an actively exploited command injection vulnerability in Windows Shell that allows the ‘Mark of the Web’ defences to be bypassed using specially crafted files.

CISA has added it to the KEV catalogue and is requiring US federal agencies to apply the patch by 16 October. Also of note are CVE-2026-108398 (CVSSv3 8.8 according to Microsoft), capable of bypassing WDAC following a local compromise, and CVE-2026-21413 (CVSSv3 9.8 according to Talos), which can execute code when generating a preview of a RAW image.

It is recommended to prioritise Windows Shell and Raw Image Extension, as well as reviewing controls for email, messaging and the downloading of attachments, rather than classifying vulnerabilities solely by CVE volume.

More info

◾ This newsletter is one of the deliverables of our Operational and Strategic Intelligence service. If you are interested in knowing the rest of the Operational and Strategic Intelligence contents included in the service, please contact us →