Between October 13 and 14, three network edge vendors disclosed zero-days under active exploitation within 48 hours of each other: Palo Alto Networks, Cisco, and Ivanti. That alone would be a notable week. What makes it worth stopping on is the Ivanti case, where Volexity found attackers chaining three separate zero-day flaws in Connect Secure to get unauthenticated root, and Ivanti has only shipped fixes for two of them. Patching the CVE that CISA named in its advisory does not close the chain. The third flaw is still open, and Ivanti’s own guidance to customers, in Volexity’s words, amounts to “act immediately” on an incomplete fix.

That distinction matters more than the raw count of three vendors in one week. Edge-device compromise has been the dominant initial-access story all year, and Monday’s report already flagged Fortinet and Citrix in that pattern. This week confirms it is not slowing down, but it also reveals a defender blind spot that a simple vendor tally obscures: patching the named CVE in an advisory can create false confidence when the actual exploit chain has more moving parts than the advisory discloses.

The three disclosures, read correctly

Start with what each vulnerability actually requires, because the public narrative around all three has been looser than the vendor advisories. Palo Alto’s CVE-2026-0322 is officially an authenticated remote code execution flaw in the PAN-OS management interface, not an unauthenticated one. That is a meaningful qualifier. It means the realistic attack path runs through stolen admin credentials or an already-exposed management interface, not a cold internet-facing exploit. Palo Alto published a handful of attacker IP addresses as indicators of compromise, which itself tells you something: these are addresses seen authenticating, not addresses seen exploiting a pre-auth hole. If your PAN-OS management interface is internet-facing at all, the authentication requirement is cold comfort. If it isn’t, this is a lower-urgency item than the alarm suggests.

Cisco’s CVE-2026-76519 is the opposite profile and the more dangerous one: a relative path traversal in Secure Email Gateway that lets an unauthenticated remote attacker write arbitrary files to the underlying OS, reachable through a crafted email attachment that abuses the Advanced Malware Protection scanner itself. CISA’s remediation deadline is October 17, giving affected organizations roughly three days from disclosure. An appliance whose job is to inspect incoming mail for malware being turned into the delivery mechanism is the kind of inversion that should get more attention than it has so far.

Then there’s Ivanti. CVE-2026-104935, the CVSS 8.6 authentication bypass CISA named, is real and under exploitation since at least October 1 according to CISA’s own timeline. But Volexity’s research describes attackers chaining three distinct zero-days to reach unauthenticated root on Connect Secure, and Ivanti has patched two of the three. The practical effect: an organization that patches CVE-2026-104935 today and considers Connect Secure handled has closed one door in a three-door chain. Volexity reported all three flaws to Ivanti; the fix for the remaining one is still pending. That is the structural failure mode worth naming. Vendor advisories label and number individual CVEs, but attacker chains don’t respect that boundary, and a defender tracking “patched: yes/no” against a single CVE ID can be wrong about actual exposure.

Why this keeps happening on the same class of device

Edge appliances, VPN gateways, email security gateways, firewall management planes, share three properties that make them disproportionately attractive: they sit directly on the perimeter, they require broad system privileges to do their job, and they are frequently excluded from standard EDR coverage because they run closed vendor firmware rather than a monitorable OS. CISA’s BOD 26-04 remediation windows this week ranged three to five days, which is aggressive, but aggressive timelines on single CVEs don’t help if the actual exploit chain is wider than the patch. The Ivanti case is the clearest evidence this year that attackers researching these appliances are finding chains, not single bugs, and vendors are disclosing and patching them one CVE at a time rather than closing the whole chain in one advisory.

What escalated from Monday

Monday’s report forecast an unusually small October Patch Tuesday based on early vendor previews. The actual release reversed that completely: Microsoft shipped more than 1,400 CVEs on October 13, roughly 450 more than September’s own record of 964 to 974, making it the largest patch cycle on record two months running. One of those, CVE-2026-96951, a Windows Shell security feature bypass that defeats Mark-of-the-Web protections, is already under active exploitation. Two consecutive record-breaking months is no longer a one-off anomaly; it is a volume trend that patch management programs built around monthly cadences are not sized for.

Separately, Japan’s government converted what Monday’s report described as a 495-customer IDCF Cloud ransomware outage into a first-ever national cyberspace emergency declaration, now tied to more than 14 million exposed citizens and over 500 logged incidents in the first nine months of 2026, already exceeding all of 2025. That is a scope escalation by roughly four orders of magnitude in reported impact within a single week, driven by the gap between an initial vendor-reported outage and the eventual government-tallied exposure.

What to watch

The open question is whether Ivanti ships the third Connect Secure fix before the chain gets automated into mass scanning, and whether CISA or Volexity publish enough detail on the unpatched flaw to let defenders mitigate without a patch. The second thing to watch is whether the three-to-five-day KEV deadlines across Palo Alto, Cisco, and Ivanti simultaneously get met; three concurrent emergency patch cycles in one week is a real operational load on the same security teams, and a missed deadline on any of the three would be the more telling story by Monday.

Security Unlocked publishes threat intelligence and strategic analysis twice weekly. This mid-week brief covers developments from October 12 through October 15, 2026.