CVEasy AI · Exposure Chart

Four perimeter vendors, six flaws, and every one already exploited

Between September 30 and October 14, 2026, six supply-chain flaws were severe enough and specific enough to chart, and all six live in products that sit on the network perimeter. They come from four vendors: Fortinet, Cisco, Citrix, and Palo Alto. Every bar carries a rust dot, which means every one was reported under active exploitation.

The chart ranks each flaw by CVSS base score, and the range is tight. Fortinet FortiMail (CVE-2026-104286) and Cisco Catalyst SD-WAN Manager (CVE-2026-76504) both score 9.8. Citrix NetScaler supplies three entries: CVE-2026-88771 and CVE-2026-88772 at 9.5, and the SAML denial-of-service flaw CVE-2026-88779 at 8.7. Palo Alto GlobalProtect (CVE-2026-0257) closes the set at 7.8, exploited by the Qilin and Settra ransomware groups. The story is not the severity. It is that every device on this list guards the edge, inspecting traffic and holding credentials for the estate behind it.

What should change your triage is the timing. For several of these flaws the exploitation arrived before the fix. Fortinet published the FortiMail advisory with no patch available, and CISA still set a federal remediation deadline just days out. Citrix saw live exploit attempts within minutes of a public proof of concept from watchTowr Labs, weeks before the September fix existed. When a vendor advisory for an internet-facing box says exploitation is already happening, the clock you are racing belongs to the attacker, not to your maintenance window. Treat that advisory as an incident and apply the mitigation the same day.