In this guide · 7 sections
Short answer
If your office uses a Citrix NetScaler, Palo Alto firewall, Juniper device or Ivanti Connect Secure VPN, ask whoever manages it to confirm in writing that the October 2026 updates are installed. CSA flags the Palo Alto and Ivanti flaws as actively exploited, so treat those as urgent.
The October 2026 CSA alerts for firewalls and VPNs
CSA's SingCERT publishes alerts on its Alerts page. These are the ones from the past fortnight that affect devices at the edge of a network, meaning the box that connects your office to the internet or lets staff connect from home.
| Date | CSA alert | Product | Exploited? |
|---|---|---|---|
| 12 Oct 2026 | Critical Vulnerability in Citrix NetScaler ADC and NetScaler Gateway | Remote-access gateway and load balancer | Not stated |
| 16 Oct 2026 | Active Exploitation of Vulnerability in Palo Alto Networks Products | PAN-OS firewalls (management interface) | Yes, reportedly |
| 19 Oct 2026 | Critical Vulnerabilities in Juniper Devices | Junos OS routers, firewalls and switches | Not stated |
| 20 Oct 2026 | Active Exploitation of Vulnerability in Ivanti Connect Secure | SSL VPN for remote staff | Yes, reportedly |
All four alerts end with the same advice: update to the latest versions immediately. The affected version lists are long, so the practical question for a small business is simpler: do we have one of these, and who updates it?
How to find out which firewall or VPN your office runs
Many small offices have never written down what their network equipment is. You can usually find out in under an hour.
Look at the boxes in your comms cabinet
The brand and model are printed on the front or on a label underneath. Note anything that says Citrix or NetScaler, Palo Alto, Juniper, Ivanti or Pulse Secure (Ivanti's former name), plus any other firewall brand.
Check how staff connect from home
If staff open a VPN app or a web page to reach office files, note its name and the address they use. Ivanti Connect Secure and Citrix Gateway are common in offices that grew from older setups.
Search invoices and contracts
Look for hardware, licence or support renewals from IT vendors. A yearly firewall subscription invoice tells you the brand and who sold it.
Ask your ISP what they supplied
Ask in writing whether the router or firewall they installed is managed by them and whether it is one of the affected products.
Write it down
Record brand, model, who manages it, admin login owner and the support contract end date. This list is part of any basic asset register.
If you find a different brand, such as Fortinet or Sophos, these four alerts do not apply, but the same check is worth doing for that vendor's advisories. Our FortiGate credentials leak guide shows the same process for Fortinet devices.
Who patches it: ISP, vendor or your IT provider?
Responsibility depends on who owns and manages the device. In most small offices it falls into one of these cases:
| Situation | Who usually patches | What to ask for |
|---|---|---|
| Router supplied and managed by your ISP | The ISP | Written confirmation that the model is not affected or is updated |
| Firewall bought through an IT vendor with a support contract | The IT vendor, under the contract | Date the update was installed and the new version number |
| Firewall bought outright, no contract | You (or whoever you hire) | A one-off update, plus a support contract so it keeps getting updates |
| Remote access through a cloud service (Microsoft, Google, Zscaler and similar) | The cloud provider | Usually nothing; check their status page |
Check that the device still has an active support subscription. Vendors usually only let you download updates while support is current, and a firewall without updates is a liability. If your setup is old or nobody owns it, read do you need a business VPN: many small teams can replace an office VPN with cloud file access protected by MFA.
Signs the device was already exploited
Attackers who get into an edge device often stay quiet and use it to reach the rest of the network. After patching, ask whoever manages the device to check for these, using the vendor's own guidance linked from each CSA alert:
Post-patch checks
The Palo Alto flaw sits in the PAN-OS management interface, so restricting that interface to trusted internal addresses also reduces exposure. If anything looks wrong, change VPN and admin passwords, reset MFA for remote users and treat it as an incident. CSA's incident helpline guide explains where to report.
Make edge devices part of monthly checks
These four alerts arrived within eight days. A small office cannot read every advisory, but it can make sure someone is responsible for the few devices that face the internet. Subscribe the IT contact to the vendor's security notices, keep the support contract current and ask for an update report each month.
While you are at it, check the rest of the network setup. Our office network and Wi-Fi guide covers router, guest Wi-Fi and firewall basics for a small office.
Do it yourself or get help?
If you have an IT provider who manages the firewall, send them the four CSA alert links and ask for written confirmation of the installed versions. If nobody manages it, you need someone who can log in, update the device and review its settings.
IT Sorted is a Singapore-based team of developers with over 10 years of experience. A Security Health Check (S$290) gives you a written review of your domain, email and Microsoft 365 or Google Workspace settings with a ranked fix list, and Protect Standard (S$19 per user a month, minimum 3 users) includes help within one business day when you forward us a vendor alert. We do not do penetration testing; that needs a CSA-licensed provider.
Frequently asked questions
Between 12 and 20 October 2026, CSA published alerts for Citrix NetScaler ADC and NetScaler Gateway, Palo Alto Networks PAN-OS, Juniper Junos OS devices and Ivanti Connect Secure. CSA says the Palo Alto and Ivanti flaws are reportedly being actively exploited. Each alert lists the affected versions and links to the vendor fix.
Ask the ISP in writing whether the device they supplied is one of the affected products and whether they have updated it. ISP-managed routers are usually patched by the ISP. If you added your own firewall or VPN box behind the ISP router, that device is your responsibility or your IT provider's.
No. An update closes the hole but does not remove accounts, files or settings an attacker added before you patched. After updating, check for unknown admin accounts, configuration changes and unusual VPN logins, run the vendor's integrity checks, and change admin and VPN passwords if anything looks wrong.
CSA publishes alerts on its website at csa.gov.sg under Alerts and Advisories, and vendors publish security advisories on their own support portals. For a small business, the practical step is to make one person or provider responsible for each internet-facing device and ask for a monthly update report.
Some do, often because the setup was installed years ago by a previous IT vendor or came with a serviced office. Clinics, accounting firms and offices that grew from a larger company's setup are common examples. Checking the label on the device or the VPN app staff use answers the question quickly.