(TLP:CLEAR) Weekly Vulnerabilities to Prioritize – October 15, 2026

The below vulnerabilities have been identified by WaterISAC analysts as important for water and wastewater utilities to prioritize in their vulnerability management efforts. WaterISAC shares critical vulnerabilities that affect widely used products and may be under active exploitation. WaterISAC draws additional awareness in alerts and advisories when vulnerabilities are confirmed to be impacting, or have a high likelihood of impacting, water and wastewater utilities. Members are encouraged to regularly review these vulnerabilities, many of which are often included in CISA’s Known Exploited Vulnerabilities (KEV) Catalog.

Ivanti Connect Secure Unauthenticated Root-Level RCE
See WaterISAC’s notification regarding these vulnerabilities

Citrix NetScaler ADC/Gateway Vulnerabilities
See WaterISAC’s notification regarding these vulnerabilities

Cisco Secure Email Gateway Arbitrary File Write Vulnerability
CVSS v3.1: 9.8
CVEs: CVE-2026-76519
Description: A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.
Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp

PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface
CVSS v4.0: 8.6
CVEs: CVE-2026-104286
Description: A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.
Source: https://cwe.mitre.org/data/definitions/94.html

Windows Shell Security Feature Bypass Vulnerability
CVSS v3.1: 8.8
CVEs: CVE-2026-96951
Description: Improper neutralization of special elements used in a command (‘command injection’) in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
Source: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951