Daily brief 2026-10-25: Palo Alto Networks PAN-OS and what businesses should patch

CVE-2024-3400 (Palo Alto Networks PAN-OS): Palo Alto Networks PAN-OS Command Injection Vulnerability. Severity CRITICAL, CVSS 10, EPSS 100.0%, listed in CISA KEV (exploited in the wild), linked to ransomware campaigns.

CVE-2021-44228 (Apache Log4j2): Apache Log4j2 Remote Code Execution Vulnerability. Severity CRITICAL, CVSS 10, EPSS 100.0%, listed in CISA KEV (exploited in the wild), linked to ransomware campaigns.

CVE-2019-11510 (Ivanti Pulse Connect Secure): Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability. Severity CRITICAL, CVSS 10, EPSS 100.0%, listed in CISA KEV (exploited in the wild), linked to ransomware campaigns.

CVE-2024-1709 (ConnectWise ScreenConnect): ConnectWise ScreenConnect Authentication Bypass Vulnerability. Severity CRITICAL, CVSS 10, EPSS 100.0%, listed in CISA KEV (exploited in the wild), linked to ransomware campaigns.

CVE-2025-55182 (Meta React Server Components): Meta React Server Components Remote Code Execution Vulnerability. Severity CRITICAL, CVSS 10, EPSS 99.8%, listed in CISA KEV (exploited in the wild), linked to ransomware campaigns.

CVE-2025-53770 (Microsoft SharePoint): Microsoft SharePoint Deserialization of Untrusted Data Vulnerability. Severity CRITICAL, CVSS 9.8, EPSS 100.0%, listed in CISA KEV (exploited in the wild), linked to ransomware campaigns.

Microsoft 365, Exchange & SharePoint: CVE-2025-53770. See the Business Apps page for what to ask your provider.

Fortinet, SonicWall, Palo Alto & VPNs: CVE-2024-3400, CVE-2019-11510. See the Business Apps page for what to ask your provider.

QuickBooks, Sage & accounting tools: CVE-2024-1709. See the Business Apps page for what to ask your provider.

WordPress & websites: CVE-2021-44228. See the Business Apps page for what to ask your provider.

Prioritize anything in CISA KEV and anything internet-facing (VPNs, firewalls, web servers, remote-support tools). Confirm patch status across every client tenant, and kill active sessions after patching gateway appliances.

CVE-2024-3400: Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.

CVE-2021-44228: For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.

CVE-2019-11510: Apply updates per vendor instructions.

CVE-2021-44228 affects Apache Log4j2. Patch the server or plugin, put a web application firewall in front, and review logs for exploitation.

CVE-2025-55182 affects Meta React Server Components. Patch the server or plugin, put a web application firewall in front, and review logs for exploitation.

Ask your IT provider which of these products you run, and get written confirmation they are patched or mitigated.

Enforce MFA, keep tested offline backups, and make sure remote access is not exposed without protection.