Tech Blog

everyWAN Blog

Technology, cybersecurity and IT trends that matter

Deep Analysis
Cybersecurity
IT Trends
Filter by:
Armario de distribución de fibra abierto, con bandejas, latiguillos y módulos a la vista
9 min read

Two 10.0s in Arista EOS and no hotfix: your config decides, not your version

Two 10.0-out-of-10 flaws in data centre switches, both without a hotfix, published in September and with remarkably little noise around them. The reason for that silence is also the interesting part: nobody knows how many devices are affected, because exposure is not decided by the installed version but by two configuration lines almost nobody inventories. What the Arista advisories actually say, why they are 10.0 and not 9.8, the twenty-second check per device, and the three fields missing from any network inventory.

Networking Vulnerabilities Inventory
Read more →
Mesas de una oficina vacía con una silla, archivadores y un monitor apagado
8 min read

The workaround was to turn off Global Secure Access: the advice your own policy blocks

On 13 October, after almost eleven hours of degradation, the workaround on offer was to turn off Global Secure Access. It arrived eleven minutes before the incident was declared over, and in tenants configured the way the documentation recommends that step does not work: turning off the client and being locked out is, literally, the proof that the compliant network check is correctly in place. The right procedure does exist and Microsoft published it in March, with two scripts; what neither of them tells you is how long each step takes to be felt.

Zero Trust Microsoft 365 Identity
Read more →
Parte trasera de un armario de servidores con los latiguillos de red saliendo de cada nodo hacia los de al lado
10 min read

The switchless Ceph mesh has four variants. Two of them break on one cable

Three nodes wired directly to each other at 25 GbE, with no switch to buy, is one of the best decisions you can make on a small budget. Proxmox documents four ways to wire it and only two survive a single link going down: in the other two, its own wiki says, "the nodes now have a different view" and Ceph reports services as down that are perfectly alive. Since Proxmox VE 9 that mesh is configured from the web interface, with four fabric protocols. And the official documentation still labels that layer tech preview.

Proxmox Ceph Networking
Read more →
Repartidor de fibra óptica con conectores verdes y latiguillos amarillos, y la mano de un técnico alcanzando un puerto
9 min read

The circuit was fine and the video call dropped anyway

Your carrier closes the ticket as "within contracted parameters" and your SD-WAN has the graph of the drop. Both figures are correct: what differs is the measurement point, the window and the traffic class, and all three sit in the standards underneath the contract. ITU-T Recommendation Y.1541 asks that any minute observed should meet the objectives; an availability contract averages the whole month, and 129 twenty-second drops fit inside a monthly 99.9% without breaching it. The seven lines of annex to write before you sign.

Networking SD-WAN Monitoring
Read more →
Armario de comunicaciones real con switch, regletas de conexión y latiguillos de fibra sobre pared de contrachapado
8 min read

Thirteen of ClearPass's twenty-eight flaws are in the agent, not the server

On 6 October 2026 HPE published advisory HPESBNW05158 with 28 ClearPass Policy Manager vulnerabilities: 10 critical, 11 high and 7 medium. The interim mitigation the advisory itself recommends names the CLI and the web-based management interface, both of them on the server. We classified all 28 by the component HPE names in each title: thirteen live in the OnGuard agent or the client software, which is to say on the laptops. Two of those thirteen are 9.8 criticals needing no prior authentication. Inside: the table of the thirteen, the end-of-maintenance note that decides whether yours is a patch or a branch jump, and the question worth answering before the change window.

Networks Zero Trust Vulnerabilities
Read more →
Armario de cableado de red con latiguillos de pares trenzados y paneles de parcheo
8 min read

The Azure outage: four doors and the place your plan B lived

On 30 September 2026, a five-hour-forty-five-minute incident on Azure. Of the five services Microsoft lists as impacted, four are the road to your infrastructure and the fifth is Azure VMware Solution. Inside: what the official 7Q30-010 record does and does not say, the real detection clock, why the region figure going round is not in the source, and what happens to your contingency procedure when the thing that fails is the console.

Cloud Infrastructure High availability
Read more →
Pasillo entre racks de equipos de red en una sala técnica
9 min read

CVE-2026-76504: the rule compared strings, not resources

Cisco published the Catalyst SD-WAN Manager advisory yesterday: CVSS 9.8, exploited before the advisory was published, and CISA allowing three days to fix it. Authentication did not fail. What failed was the list deciding which requests have to go through it: the list said /j_security_check and the request said /%6a_security_check, the same path with the j written in hex. Two different strings to the list, the same resource to the server behind it, and an administrator fits in that one-character gap. What decides how you read the rest is why that path HAD to be exempt from the session check: it is where the session is obtained, and if you protected it nobody could ever log in. So the flaw is not having the exception, it is how you check whether a request falls inside it. And that is not Cisco's: it happens anywhere the layer protecting a path by name is not the one resolving it. Inside: the table of branches and first fixed releases, the thirty-second test for your own proxy, the two greps that answer whether anyone got in before the patch, and the awkward question of whether those logs ever leave the box.

SD-WAN Cybersecurity Networking
Read more →
Armario de comunicaciones con cortafuegos y panel de parcheo en una sala técnica
10 min read

The certificate ACME doesn't renew is the one that kills your VPN

Do the arithmetic: 15 March 2026, the day the 200-day ceiling for public TLS certificates came into force, plus 200 days. That lands on 1 October. Today. The first certificates issued under the new rule start expiring this week, and this stops being a 2029 problem. The CA/Browser Forum schedule (ballot SC-081v3, 25 issuers in favour and none against) drops to 100 days on 15 March 2027 and to 47 in 2029, with domain validation down to 10 days: about 37 validations a year per name. The 47 is neither arbitrary nor round: it is 31 + 15 + 1, sized so a monthly renewal fits with room for one retry. But the web server has renewed itself for years; the problem is the firewall portal, the VPN gateway and the RADIUS box doing EAP-TLS. And here is the uncomfortable conclusion: ACME validates from the outside, and those devices are not published on the Internet precisely because you segmented properly. The better your network, the worse your position. What path is left, what new risk comes from giving a script write access to your DNS, why half the list should not be in the public chain at all, and the four columns that decide by themselves what to do with each row.

TLS Networking Cybersecurity
Read more →
Armario de comunicaciones de pared en una sede pequeña, con router, módem y switch conectados con cables de red
9 min read

Your site-to-site tunnel doesn't ask for MFA because there's nobody to ask

CVE-2026-85102 entered the CISA catalog on September 22 with a three-day deadline, and almost all the coverage stopped at "patch your remote access VPN". The official description says "Site to Site VPN or Remote Access VPN": the tunnel between your own offices too, where there is no user to ask for a second factor, the trust was configured once and never expires, and the flaw happens during certificate negotiation — before your MFA and conditional access ever get to run. With the caveat almost nobody mentions (that path only applies if the tunnel authenticates with certificates, not a pre-shared key), the cross-reading of both advisories — the branch that saves you from one is the one listed in the scope of the other — and the four things we would check this week.

Zero Trust VPN Networking
Read more →
Vista aérea de un enlace de autopista en trébol, con varias rutas posibles entre los mismos dos puntos
8 min read

Your SD-WAN orchestrator is the key to every one of your sites

On 22 September CISA added CVE-2026-93952 to the known exploited vulnerabilities catalogue: a 10.0 out of 10 in VeloCloud Orchestrator, the system that configures every site in an SD-WAN network. The second exploited 10.0 in that same orchestrator in eight weeks. And the exploitation condition the vendor itself publishes is an uncomfortable line: it requires access to the PUBLIC portion of the certificate the branch device authenticates with. Why that points at the trust model and not just at an input validation bug, what to do if your version train has no patch yet, the three traces to look for in the filesystem today, and the question we ask before centralising a control plane.

SD-WAN Networking Cybersecurity
Read more →
Rack de comunicaciones con paneles de parcheo, latiguillos de red y una bandeja de fibra en la parte baja
5 min read

The DDoS that takes you down is not in the headlines

In the first half of 2026, 96.62% of the network-layer attacks Cloudflare mitigated stayed under 500 Mbps and 90.60% ended in under ten minutes. The attack that makes the press is measured in tens of terabits; the one that will take a mid-sized company offline fits inside an ordinary fibre link and is over before anyone picks up the phone. Why the metric that matters is time to activation and not terabits of capacity, what changes now that DNS floods have gone from 25.7% to 40% in a single quarter, and the five questions we ask before buying any mitigation.

Networking DDoS Cybersecurity
Read more →
Armario de comunicaciones con paneles de parcheo y una maraña de cables de red azules
5 min read

The patch for your switch had been out for 97 days

On 21 September CISA added a single CVE to its catalogue of exploited vulnerabilities: a stack-based buffer overflow in the CGI program of Zyxel GS1900 switch firmware, unauthenticated and with command execution. Zyxel published the advisory and the ten fixed firmware builds on 16 June: 97 days earlier. We counted the 30 entries the catalogue has taken in so far this month and the median is 5 days, so the list mixes two different populations. Why "LAN-based" is not a mitigating factor but the attack's requirement, what the small print does not say about models out of support, and why the entry asks for forensic triage before you reflash.

Networking Patching Maintenance
Read more →
Cerro con torres de comunicaciones, antenas parabólicas y radioenlaces contra el cielo
9 min read

MikroTik shipped that port closed: the flaw is theirs, the exception is yours

On 5 September CERT Polska published six RouterOS vulnerabilities; two of them chained give full control of a MikroTik with no authentication, and Shadowserver counted 122,500 devices with SSH reachable from the internet. The vendor's own advisory says its default configuration blocks that port. So the thing to look at is not the CVE: it is who opened the exception, when, and why nobody gave it an expiry date.

Networking Cybersecurity Vulnerabilities
Read more →
Armario de red de pared en una sede pequeña: switch de 16 puertos, router, ONT y cableado desordenado
5 min read

In the branch you did not buy a firewall: you bought an SD-WAN checkbox

Arista is retiring VeloCloud Security VNFs: the Fortinet, Palo Alto or Check Point firewall running inside the Edge loses support on 28 February 2027, and 5.2.x is the last release that carries it. What expires is not a licence, it is the idea that the branch firewall was ever yours: the day branch security became a checkbox inside the transport product, its calendar stopped being yours.

SD-WAN Networking Cybersecurity
Read more →
Interior de un armario de comunicaciones de planta con switch, panel de conexiones y cableado de cobre y fibra
12 min read

Cisco ISE, a perfect 10 with no workaround: your network already decided what to do without it

On 16 September Cisco published a CVSS 10.0 in Identity Services Engine: an authentication bypass in an API, no workaround available, active exploitation and command execution as root. Before arguing about the maintenance window there are two things to look at: ISE's own access.log, because the advisory ships indicators and the recommendation to re-image the node if anything shows up, and the show run on a floor switch, because that is where what your network will do when the policy engine stops answering is already written. The default value of radius-server deadtime is 0.

Cybersecurity Networking Zero Trust
Read more →
Panel de parcheo a oscuras con cuatro conectores RJ45 desconectados
10 min read

Cisco FMC: patching closes the door, but nobody gives you back your network blueprint

On 9 September, Cisco Talos confirmed active exploitation of two flaws in Secure Firewall Management Center, and counted three separate attacker clusters inside the same box. One of them dropped two scripts to harvest the configurations of the managed firewalls. That is the part almost nobody is discussing: credentials rotate, a domain gets restored, and your perimeter configuration does not rotate. It is a description of your network, and it stays valid after the patch.

Cybersecurity Vulnerabilities Networking
Read more →
Armario de comunicaciones de pared con switch y cables de red
10 min read

Windows DNS, an unauthenticated 9.8: what turns a bug into a worm is not the bug, it's your network

On 8 September Microsoft shipped the largest batch of patches in its history. Dustin Childs, of the Zero Day Initiative, counts twenty that could be classified as wormable, spread across thirteen components. Those thirteen are not one list: they are two. Seven of those CVEs sit in services your domain requires every machine to reach — DNS, Netlogon, Active Directory, DHCP — and eleven sit in roles Windows does not install on its own. The first half is managed with patching order; the second, by uninstalling. And hardly anyone knows which of the two they have switched on.

Cybersecurity Networking Windows
Read more →
Armario de red mural abierto en el pasillo de una oficina, con anillas pasahilos y cables recogidos, y un extintor apoyado en la pared al fondo
7 min read

July's patch is September's vulnerable build

SonicWall closed the SMA 1000 zero-day pair in build 12.4.3-03453 on 14 July. The 1 September advisory lists 12.4.3-03453 and earlier as affected: anyone who met the three-day KEV deadline landed on exactly the build that is back in the catalog 49 days later, with the same shape of flaw. When an appliance repeats the shape of the flaw, the question stops being whether it is patched and becomes how far that box reaches.

SD-WAN Networking Vulnerabilities
Read more →
Cuarto de interconexión con paneles de parcheo, latiguillos de fibra naranja y amarilla recogidos en peines horizontales y una bobina de fibra colgada en la pared
5 min read

The route hijack RPKI called valid: the ROA allowed all the way down to /24

Between 28 and 30 August 2026, a BGP hijack diverted traffic for 162.55.80.0/24 across some 22 active hours and served a malicious update from behind a valid TLS certificate. We went and checked the ROA on RIPEstat: until 1 September it carried maxLength 24, so while the hijack lasted the route was RPKI valid. What origin validation checks and what it does not, why that same maxLength was also the cure, and the six verifications you can run today.

Networking BGP Cybersecurity
Read more →
Diez CVE en el proceso iked de un cortafuegos: leer el campo de impacto antes que el titular
5 min read

Ten CVEs in one process: the headline is not enough to decide

On 27 August, ten security advisories landed in iked, the process that negotiates a firewall's IPsec tunnels. We read them one by one, and in several of them the headline and the body do not say the same thing: one titled "unauthenticated" needs a VPN user with valid credentials; another the vendor could not reproduce; and one of the lowest-scoring is the only one that mentions reading key material. How to read a bulletin like that in forty minutes.

Networking Cybersecurity VPN
Read more →
  • 1
  • 2

Subscribe to our newsletter

To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list

Minorisa de Sistemas Informaticos y Gestión S.L. © 2026
Legal Notice - Privacy policy - Cookie policy - Cookie settings - Terms of use - Whistleblower Channel
everyWAN
LOGIN REGISTER
everyWAN