Defender DailyThe daily security brief for enterprise defenders
Daily Brief
No additions to the catalog in this edition’s window.
Source: CISA’s Known Exploited Vulnerabilities catalog, version 2026.10.21
Arista Networks VeloCloud Orchestrator
Even a read-only tenant account is enough, Arista says, and it lists fixed builds for three release trains and two attacker addresses to block.
Palo Alto rates the risk to PAN-OS’s management interface 8.7, affecting only availability, with hotfixes due Oct 26 to 30, and Cisco lists Expressway as vulnerable.
Further readingPalo Alto Networks advisory, further reading on Exploited PHP flaws reach Palo Alto and Cisco products, with no fixes yet Cisco advisory, further reading on Exploited PHP flaws reach Palo Alto and Cisco products, with no fixes yet Check Point research, further reading on Exploited PHP flaws reach Palo Alto and Cisco products, with no fixes yet
Fortinet FortiAnalyzer, FortiManager and FortiOS
FortiOS, FortiManager and FortiAnalyzer releases for four branches came out Oct 22, and Fortinet still hasn’t named the flaws they fix.
Further readingFortinet release notes for FortiOS 7.6.8, further reading on Fortinet’s urgent FortiOS fixes are out, with their details due Nov 10 Fortinet release notes for FortiManager 7.6.8, further reading on Fortinet’s urgent FortiOS fixes are out, with their details due Nov 10 Fortinet notice, further reading on Fortinet’s urgent FortiOS fixes are out, with their details due Nov 10
Microsoft Entra ID and Microsoft 365
Huntress says the attacker replayed tokens from one block of addresses, then registered rogue devices, swapped MFA methods and hid mail with inbox rules.
Wiz says the activity overlaps with Microsoft’s Storm-0940 report, and it lists two new addresses and new user agents to hunt for.
Huntress
Huntress says about one in six incidents its identity team investigated involved a rogue registered device, and that most Microsoft tenants don’t need device-code sign-in.
Read: Huntress on three phishing kits built to steal Microsoft 365 sessionsUnit 42
Tokens from device-code and consent phishing bypass MFA and survive password resets, Unit 42 says, and short-lived tokens limit the damage.
Read: Unit 42 on how attackers steal OAuth tokens that get around MFAVulnCheck
VulnCheck says the median time from CVE publication to KEV addition fell from 120 days in 2025 to 80 in the first half of 2026.
Read: VulnCheck on how AI is speeding up flaw discovery and exploitation