Cyber Centre Daily Advisory Digest — 2026-09-10 (6 advisories)
Six vendor advisories cover critical patches for PAN-OS, Adobe Commerce, cPanel, Fortra GoAnywhere MFT, Advantech WISE-6610, and HPE ClearPass; CVE-2026-71362 in Adobe Commerce is exploited in the wild. Palo Alto, Fortra, Advantech, Adobe, WebPros, and HPE each published security advisories on 2026-09-10. Adobe Commerce CVE-2026-71362 is actively exploited. PAN-OS CVE-2026-0310 is a buffer overflow via XML processing. cPanel CVE-2026-67401 is a SQL injection in EmailTrack functionality.
Detection / Hunteropenrouter
Immediate Actions
- Patch Adobe Commerce immediately; CVE-2026-71362 is exploited in the wild.
- Update PAN-OS to address CVE-2026-0310 buffer overflow vulnerability.
- Upgrade Fortra GoAnywhere MFT Endpoint to version 7.10.2 or later.
- Update cPanel and WHM to versions 11.110.0.143 or later.
Key Takeaways
- CVE-2026-71362 in Adobe Commerce is exploited in the wild per open-source reporting.
- PAN-OS CVE-2026-0310 is a buffer overflow vulnerability via XML processing.
- Fortra GoAnywhere MET Endpoint path traversal affects versions prior to 7.10.2.
- cPanel CVE-2026-67401 is a SQL injection in EmailTrack; CSF CVE-2026-65638 and CVE-2026-65639 also patched.
- Advantech WISE-6610 industrial gateway has multiple vulnerabilities across versions and models.
Attack Chain
- Initial Access: Exploit CVE-2026-71362 in Adobe Commerce (actively exploited in the wild)
- Exploitation: Buffer overflow via XML processing in PAN-OS CVE-2026-0310
- Exploitation: Path traversal in Fortra GoAnywhere MFT Endpoint prior to 7.10.2
- Exploitation: SQL injection in cPanel EmailTrack CVE-2026-67401
- Persistence: Vulnerabilities in CSF firewall may enable security restriction bypass
Affected Systems
- PAN-OS multiple versions
- Prisma Browser prior to 151.26.5.170
- Fortra GoAnywhere MFT Endpoint prior to 7.10.2
- Advantech WISE-6610 industrial gateway multiple versions
- Adobe Commerce and Magento Open Source multiple versions
- cPanel and WHM prior to 11.110.0.143 through 11.138.1.9
- HPE ClearPass Policy Manager 6.11.14 and 6.12.8
- ConfigServer Security and Firewall versions 14.00 to 16.29
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-0310 | PAN-OS | Buffer overflow vulnerability via XML processing in PAN-OS. | |
| CVE-2026-71362 | Adobe Commerce | Vulnerability in Adobe Commerce exploited in the wild. | |
| CVE-2026-67401 | cPanel & WHM | SQL injection in cPanel's EmailTrack functionality. | |
| CVE-2026-65638 | ConfigServer Security & Firewall (CSF) | Security vulnerability in CSF versions 14.00 to 16.29. | |
| CVE-2026-65639 | ConfigServer Security & Firewall (CSF) | Security vulnerability in CSF versions 2.15 to 16.29. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | Advisories describe vulnerabilities in network appliances and web applications, not endpoint malware. |
| Network Visibility | Medium | Exploitation of PAN-OS XML processing and cPanel SQL injection may generate anomalous HTTP traffic. |
| Detection Difficulty | Hard | Exploitation of application-layer vulnerabilities requires content inspection and product-specific log analysis. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Anomalous XML payloads targeting PAN-OS management interfaces may indicate exploitation of CVE-2026-0310 (T1190). | PAN-OS system and threat logs | Initial Access | Medium — legitimate XML API calls may trigger alerts |
| SQL injection patterns in cPanel EmailTrack requests may indicate exploitation of CVE-2026-67401 (T1190). | cPanel access and error logs | Initial Access | Low — EmailTrack SQLi patterns are distinctive |
Required Log Sources
- Web application firewall logs
- PAN-OS system logs
- cPanel access logs
- GoAnywhere MFT logs
- Network IDS alerts
Key Behavioral Indicators
- Anomalous XML payloads to PAN-OS management or data plane interfaces
- Unexpected path traversal sequences in GoAnywhere MFT requests
- SQL injection patterns in cPanel EmailTrack API calls
- Unusual HTTP requests to Adobe Commerce endpoints matching CVE-2026-71362
Control Gaps
- WAF rules may not cover PAN-OS XML processing buffer overflow payloads
- Network IDS signatures may not detect GoAnywhere MFT path traversal
- cPanel SQL injection in EmailTrack may bypass generic WAF rules
False Positive Assessment
Low — advisories reference specific CVEs and affected product versions with clear patch guidance.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Restrict PAN-OS management interface access to trusted networks only.
- Update ConfigServer Security and Firewall to versions above 16.29.
- Patch HPE ClearPass Policy Manager to versions above 6.12.8.
- Update Advantech WISE-6610 industrial gateway firmware.
User Protection
- Update Prisma Browser to version 151.26.5.170 or later.
- Update Adobe Lightroom Classic to latest version.
- Apply ColdFusion 2023 and 2025 security patches.
MITRE ATT&CK Mapping
Initial Access
Plain-Language Summary
Canada's cyber agency published six security advisories on September 10, 2026, covering products from Palo Alto Networks, Fortra, Advantech, Adobe, WebPros, and HPE. One Adobe Commerce vulnerability is already being exploited by attackers. Administrators should review each advisory and apply available updates to affected products.
- cveCVE-2026-0310Buffer overflow vulnerability via XML processing in PAN-OS.
- cveCVE-2026-65638Security vulnerability in CSF versions 14.00 to 16.29.
- cveCVE-2026-65639Security vulnerability in CSF versions 2.15 to 16.29.
- cveCVE-2026-67401SQL injection in cPanel's EmailTrack functionality.
- cveCVE-2026-71362Vulnerability in Adobe Commerce exploited in the wild.