AI Agents Are Getting Their Own Accounts: A Governance Checklist
Google's Gemini agent and Copilot Studio agent accounts give AI agents mailboxes and directory identities. What changed and how to govern them.
October 2026 has been a hard month for anyone who runs internet-facing infrastructure. In the space of about two weeks, CISA flagged an exploited zero-day in Ivanti Connect Secure, added exploited flaws in Palo Alto Networks PAN-OS and Cisco Secure Email Gateway to its Known Exploited Vulnerabilities (KEV) catalog, and Palo Alto Networks confirmed active attacks on firewall management interfaces through a pair of critical PHP vulnerabilities. Almost all of it hit the same place: the VPN gateways, firewalls and email appliances that sit at the edge of the network.
It is also one of the first big tests of the model CISA introduced in June, when it replaced its earlier patching directives with Binding Operational Directive (BOD) 26-04, "Prioritizing Security Updates Based on Risk." It binds only federal civilian agencies, but its risk model works for any organization trying to decide what to patch first. Here is what happened, how the new model sorts it, and what to do this week.
What happened in October
Ivanti Connect Secure zero-day
On October 13, CISA urged organizations to patch CVE-2026-104935, a zero-day authentication bypass in Ivanti Connect Secure that allows unauthenticated remote execution of arbitrary commands. CISA says attackers are using it for credential theft and data exfiltration. Affected versions include 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. The vulnerability was added to the KEV catalog the same day.
One detail matters for incident response: CISA warns that Ivanti's Integrity Checker Tool may miss this exploitation because the commands run in memory. For suspected compromise, CISA points to network and memory forensics and to Ivanti's recovery procedure: back up the configuration, factory reset and upgrade (or rebuild virtual instances), restore the configuration, then reset all account passwords, revoke and reissue certificates, and reset stored API keys and license server credentials. CISA also notes that Ivanti Connect Secure 22.8 reaches end of life on January 31, 2027, so teams still on that branch have a migration to plan as well.
Four more KEV additions on October 14
The next day CISA added four actively exploited vulnerabilities to the KEV catalog: a code injection flaw in Palo Alto Networks PAN-OS (CVE-2026-0322), a relative path traversal flaw in Cisco Secure Email Gateway (CVE-2026-76519), and two flaws in Ahsay AhsayCBS backup software, one improper authentication (CVE-2026-105133) and one command injection (CVE-2026-105134).
PHP2Shell reaches firewall management interfaces
On October 21, Palo Alto Networks published an advisory on two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated CVSS 4.0 9.2 with the highest suggested urgency. In PAN-OS the impact is limited to the management web interface, meaning the HTTPS web UI and XML API. A dataplane interface is affected only if a management profile is attached to it, and GlobalProtect, Clientless VPN and Captive Portal are not affected. By its October 29 update, the advisory stated that "active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet."
Palo Alto's guidance is to upgrade to the fixed release for each PAN-OS branch, and to restrict management access to trusted internal IP addresses or a single jump box and never expose it to the internet. For versions without a fix yet, the advisory lists interim hardening: route management traffic through a dataplane port, replace the inbound management certificate, decrypt inbound management traffic, and enable threat prevention on inbound management services.
The common thread: almost every one of these issues is reachable from the internet with no credentials, on a device that controls access to everything behind it. That combination is exactly what BOD 26-04 tells agencies to fix first.
How BOD 26-04 changes the patching question
CISA issued BOD 26-04 on June 10, 2026. It revokes BOD 19-02 and BOD 22-01 and consolidates federal vulnerability remediation guidance into one directive, which bases each remediation timeline on four factors:
- Asset exposure: whether the asset is publicly exposed, using CISA's exposure guidance.
- KEV status: whether the CVE is in the Known Exploited Vulnerabilities catalog.
- Automatability: whether an adversary can automate every step of exploitation.
- Technical impact: whether exploitation gives partial or total control of the asset.
The most urgent combinations carry an "& forensic triage" requirement: agencies must remediate or mitigate within three days and perform forensic triage to determine whether the system was already compromised. At the other end, lower-risk findings can be scheduled as "fix on system upgrade," handled at the next major upgrade or rebuild. The clock starts when CISA adds a vulnerability to the KEV catalog or when the agency finds it on an asset, whichever comes first. The timeline can also change: the directive notes, for example, that taking an asset off the internet can extend it.
Run October's issues through those four factors and the result is clear. An unauthenticated command-execution bug on an internet-facing VPN or firewall management interface, already in KEV, is the case the shortest timeline and the forensic-triage requirement were written for. The PAN-OS advisory also shows how exposure changes the answer: Palo Alto says the risk is highest when the management interface is reachable from the internet, and moving it behind a trusted network is both a vendor mitigation and, under BOD 26-04's logic, a way to lower the asset's priority.
Why "patch it" is no longer the whole answer
The forensic-triage requirement reflects something defenders have learned repeatedly from edge-device campaigns: by the time a patch is applied, the device may already be compromised. The Ivanti guidance makes the point directly. A tool that checks file integrity can come back clean when the attacker's commands ran only in memory. Patching closes the door but does not remove anyone already inside, and it does nothing about credentials, certificates and API keys the attacker may have taken.
That is why the recovery steps in these advisories go well beyond upgrading. Resetting passwords, reissuing certificates and rotating stored secrets are part of the fix, not optional extras, whenever there is reason to think a device was exposed while vulnerable.
What it means for contractors and cloud providers
BOD 26-04 does not directly apply to contractors unless their contract requires it, but agencies must review their contracts with the contracting officer to decide what modifications are needed. For non-FedRAMP cloud offerings, agencies must work directly with the provider to make sure its infrastructure meets the same requirements, with any deviations documented. FedRAMP offerings are handled through the FedRAMP PMO. Agencies have 180 days from issuance, which falls in early December 2026, to start remediating within the directive's timelines and to continuously tag internet-reachable assets by organization, environment, exposure and asset type. Companies that support federal systems should expect these requirements to show up in contracts and questionnaires.
Checklist: what to do this week
- Inventory your edge. List every VPN gateway, firewall, email security appliance and backup server reachable from the internet, with its exact software version. Check it against the affected versions in the vendor advisories and the KEV entries above.
- Take management interfaces off the internet. Restrict firewall and appliance admin interfaces to trusted internal addresses or a jump box. This is the single fastest risk reduction for the PAN-OS issue.
- Patch the exposed, exploited items first. Use the four BOD 26-04 factors (exposure, KEV status, automatability, impact) to order the queue, not CVSS alone.
- Assume compromise where exposure overlapped exploitation. If a device was internet-facing and unpatched while attacks were active, run forensic triage. For Ivanti specifically, don't rely on the Integrity Checker alone.
- Rotate what the device knew. Reset admin and service account passwords, revoke and reissue certificates, and rotate stored API keys on any appliance you can't rule out.
- Plan end-of-life migrations now. If you run Ivanti Connect Secure 22.8, schedule the move before its January 31, 2027 end of life.
- Write the policy down. Update your vulnerability management policy to reflect a risk-based model, and if you support federal customers, be ready to show how you meet BOD 26-04 timelines.
The bottom line
October's advisories are a reminder that the network edge is where attackers get in, and that a risk model built on exposure and active exploitation sorts the patch queue far better than severity scores alone. BOD 26-04 puts that model in writing for federal agencies, and any organization can adopt it. Baygramm's cybersecurity team helps organizations inventory their internet-facing assets, build risk-based remediation programs and run compromise assessments on edge devices, and our federal cloud practice helps agencies and their contractors line up with directives like BOD 26-04. If your edge inventory is out of date, talk to us.