CISA ADDS FOUR ACTIVELY EXPLOITED PALO ALTO NETWORKS, CISCO, AND AHSAY VULNERABILITIES TO KEV CATALOG

THREAT SUMMARY

Category: Actively Exploited Vulnerabilities
Affected Product(s): Palo Alto Networks PAN-OS, Cisco Secure Email Gateway, Ahsay AhsayCBS
CVE(s): CVE-2026-0322, CVE-2026-76519, CVE-2026-105133, CVE-2026-105134
Primary Risks: Code injection, relative path traversal, improper authentication, command injection, unauthorized access, and potential follow-on compromise
Threat Status: Active exploitation confirmed by CISA
Affected Environment(s): Organizations operating vulnerable PAN-OS, Cisco Secure Email Gateway, or Ahsay AhsayCBS systems
Weakness Type(s): Code injection, relative path traversal, improper authentication, and command injection
CISA Action: Four vulnerabilities added to the Known Exploited Vulnerabilities Catalog on October 14, 2026
Required Response: Federal Civilian Executive Branch agencies must follow BOD 26-04 risk-based remediation requirements. CISA encourages all organizations to prioritize remediation of KEV-listed vulnerabilities.

---

CISA has added four vulnerabilities affecting Palo Alto Networks PAN-OS, Cisco Secure Email Gateway, and Ahsay AhsayCBS to its Known Exploited Vulnerabilities Catalog after determining that each has evidence of active exploitation.

The October 14 additions are CVE-2026-0322, a Palo Alto Networks PAN-OS code injection vulnerability; CVE-2026-76519, a Cisco Secure Email Gateway relative path traversal vulnerability; CVE-2026-105133, an Ahsay AhsayCBS improper authentication vulnerability; and CVE-2026-105134, an Ahsay AhsayCBS command injection vulnerability.

These vulnerabilities affect technologies positioned at important security and operational boundaries. PAN-OS is associated with network security infrastructure, Cisco Secure Email Gateway protects enterprise email environments, and AhsayCBS supports backup and recovery operations. Weaknesses affecting systems in these roles deserve elevated attention because compromise can affect technology that organizations rely on to control access, protect communications, preserve data, or support recovery.

CISA’s addition of all four CVEs to the KEV Catalog confirms that exploitation has moved beyond theoretical possibility. The agency’s alert does not provide affected-version ranges, CVSS scores, named threat actors, detailed exploitation chains, or vulnerability-specific indicators of compromise. Those technical details should remain tied to applicable vendor guidance rather than inferred from the vulnerability names alone.

---

Vulnerability Details

CVE-2026-0322 — Palo Alto Networks PAN-OS Code Injection Vulnerability

CISA identifies CVE-2026-0322 as a code injection vulnerability affecting Palo Alto Networks PAN-OS. Code injection vulnerabilities can allow unintended instructions to reach a vulnerable application or processing component when input is handled improperly. The actual consequences depend on the affected component, the privileges available to that component, and the conditions required for successful exploitation.

The involvement of PAN-OS raises operational concern because network-security platforms can occupy highly trusted positions inside enterprise and government environments. Firewalls and related systems can enforce traffic policy, segmentation, access controls, and communications between different portions of a network. A vulnerability affecting infrastructure performing those functions can require rapid response because the security system itself has become part of the attack surface.

CISA does not specify the affected PAN-OS versions, authentication requirements, vulnerable component, or level of access available after successful exploitation in the October 14 alert. Organizations should use the appropriate Palo Alto Networks remediation information to determine whether particular deployments are affected while treating the confirmed active exploitation as the basis for immediate prioritization.

---

CVE-2026-76519 — Cisco Secure Email Gateway Relative Path Traversal Vulnerability

CISA identifies CVE-2026-76519 as a relative path traversal vulnerability affecting Cisco Secure Email Gateway. Path traversal flaws can occur when an application does not adequately restrict how file or directory paths are processed, potentially allowing access outside an intended location depending on the vulnerable implementation.

Email gateways hold an important place inside organizational security because they process communications before those messages reach users and internal systems. An enterprise may depend on an email-security gateway for filtering, policy enforcement, malicious-content detection, attachment inspection, and other protective functions. A weakness affecting that defensive layer should therefore receive accelerated attention when exploitation has already been confirmed.

CISA’s alert does not identify which files, directories, or resources may be reached through CVE-2026-76519, nor does it specify affected product versions or authentication requirements. Those technical details should be established through Cisco’s applicable security guidance. The immediate concern established by CISA is that the vulnerability is already being exploited.

---

CVE-2026-105133 — Ahsay AhsayCBS Improper Authentication Vulnerability

CISA identifies CVE-2026-105133 as an improper authentication vulnerability affecting Ahsay AhsayCBS. Authentication is one of the primary mechanisms used to establish whether a person, device, service, or process is permitted to access a protected system. A weakness in that process can undermine a fundamental security boundary if an attacker is able to exploit the vulnerable condition.

The involvement of a backup platform deserves particular attention because backup infrastructure can contain extensive organizational data and can become essential during ransomware, destructive malware, or other major incidents. Organizations may depend on these systems to recover applications, databases, configuration information, files, and entire servers after production environments have been damaged or encrypted.

CISA does not describe the exact authentication failure, affected AhsayCBS versions, access prerequisites, or post-exploitation privileges associated with CVE-2026-105133 in its alert. The confirmed active exploitation means organizations using AhsayCBS should determine exposure promptly and avoid treating the vulnerability as a routine future patching item.

---

CVE-2026-105134 — Ahsay AhsayCBS Command Injection Vulnerability

CISA identifies CVE-2026-105134 as a command injection vulnerability affecting Ahsay AhsayCBS. Command injection flaws can allow unintended operating-system commands to be processed when an application passes attacker-controlled input into command-handling functions without sufficient restrictions.

The consequences of successful command injection depend on the affected function, execution context, system privileges, and surrounding security architecture. In a backup environment, unauthorized command execution can be especially concerning because the affected platform may have access to protected data, storage repositories, administrative functions, or systems used during recovery operations.

CVE-2026-105134 appears alongside the separate AhsayCBS improper authentication vulnerability CVE-2026-105133 in CISA’s October 14 additions. CISA does not state that the two vulnerabilities are being chained together, so they should not be presented as a confirmed combined attack path. Organizations should assess both independently because each has now met the requirements for inclusion in the KEV Catalog.

---

Affected Products and Environments

CISA identifies three affected product families in the October 14 alert. The source does not provide affected-version ranges, so organizations must determine applicability through the relevant vendor remediation information before concluding that a specific deployment is vulnerable.

Priority asset review should include:

• Palo Alto Networks PAN-OS systems operating within network-security environments.
• Cisco Secure Email Gateway deployments responsible for enterprise or government email protection.
• Ahsay AhsayCBS systems supporting backup, recovery, or protected data storage.
• Secondary, standby, failover, and disaster-recovery instances of the affected products.
• Test or legacy deployments that may remain connected but fall outside routine patching cycles.
• Systems administered by managed service providers or other third parties.
• Publicly exposed management or service interfaces associated with affected deployments.

Organizations should verify the complete deployment footprint rather than assuming that remediation of the primary production system resolves exposure everywhere. Security appliances and backup systems can operate for long periods, and secondary systems can remain active with limited administrative attention. An overlooked appliance, backup node, or remote deployment can preserve vulnerability exposure after the principal system has already been corrected.

---

Operational Impact

The central operational factor is CISA’s confirmation that all four vulnerabilities are being actively exploited. Organizations commonly maintain vulnerability backlogs spanning endpoints, servers, cloud resources, network appliances, applications, and security infrastructure. KEV inclusion identifies vulnerabilities that have demonstrated value to attackers and therefore deserve priority over flaws that remain theoretical.

The affected technologies also increase the significance of the October 14 additions. PAN-OS can participate directly in network protection and traffic control, Cisco Secure Email Gateway protects organizational communications, and AhsayCBS can be responsible for preserving data and recovery capability. An attacker targeting systems in these positions is not necessarily attacking an ordinary endpoint; the attacker may be targeting infrastructure used to secure or restore other assets.

The source does not establish that exploitation of every vulnerability produces unrestricted administrative control, broad lateral movement, complete data exposure, or destruction of affected systems. Those outcomes depend on technical conditions not detailed in CISA’s alert. The confirmed exploitation status is still enough to require organizations to identify affected assets, remediate vulnerable deployments, and determine whether systems were exposed long enough to justify compromise assessment.

---

Why KEV Status Matters

CISA’s Known Exploited Vulnerabilities Catalog provides defenders with a way to distinguish vulnerabilities that are already being exploited from the far larger number of disclosed weaknesses that organizations may be tracking at any given time. KEV status does not replace technical severity analysis, but it provides direct evidence that a vulnerability has entered real-world offensive use.

For a vulnerability to qualify for potential inclusion in CISA’s KEV Catalog, CISA states that it must have:

• A CVE identifier.
• Evidence of exploitation.
• Clear mitigation guidance.

The October 14 additions have therefore crossed an important threshold. Defenders are no longer deciding whether these four vulnerabilities might attract attackers at some future point. CISA has determined that exploitation evidence already exists.

That status should influence vulnerability-management priorities, particularly when affected assets are publicly exposed or positioned at important security boundaries. Organizations with limited patching resources can use KEV status as one factor for moving demonstrated threats ahead of lower-risk remediation work.

---

Federal Response

The four additions fall under Binding Operational Directive 26-04: Prioritizing Security Updates Based on Risk, which establishes vulnerability-management requirements for Federal Civilian Executive Branch agencies.

BOD 26-04 reinforces the role of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk KEV vulnerabilities, specifically those present on publicly exposed assets where post-exploitation conditions can provide total control of the affected asset. The directive also allows lower-risk vulnerabilities to receive deferred action when they do not meet the same risk threshold.

The directive extends beyond patch installation by establishing basic expectations for determining when agencies must assess whether threat actors compromised a system before remediation occurred. That component is important because repairing a vulnerability prevents future exploitation of the corrected weakness but does not establish whether the system was already accessed while it remained vulnerable.

CISA encourages organizations outside the federal government to adopt the same risk-based vulnerability-management approach and prioritize remediation of vulnerabilities contained in the KEV Catalog.

---

Defensive Guidance

Organizations operating the affected technologies should begin with accurate asset identification and vendor-specific remediation. The objective is not simply to install a patch on the most visible system, but to establish whether every affected deployment has been identified, remediated, validated, and reviewed for possible prior exploitation.

Priority actions should include:

• Identify all PAN-OS, Cisco Secure Email Gateway, and Ahsay AhsayCBS deployments across the organization.
• Record exact versions, builds, deployment roles, network locations, and external exposure.
• Compare deployed systems against the applicable vendor remediation information for each CVE.
• Apply supported security updates or mitigations to affected systems.
• Prioritize vulnerable assets that are publicly exposed or remotely accessible.
• Verify that updates or mitigations were successfully applied rather than relying only on patch-management records.
• Review secondary appliances, failover systems, disaster-recovery nodes, remote sites, and test environments.
• Restrict administrative interfaces to authorized users and trusted network locations wherever practical.
• Preserve relevant logs and evidence when suspicious activity is identified.
• Review privileged accounts, authentication activity, configuration changes, and unexpected system behavior surrounding the exposure period.

Organizations should also consider the role each affected system plays within the larger environment. A firewall may control traffic between security zones, an email gateway may process communications across the organization, and a backup platform may hold recovery data needed during a major incident. Remediation priority should reflect both exploitation status and the operational importance of the affected asset.

---

Compromise Assessment

Active exploitation means organizations should consider whether vulnerable systems may have been accessed before remediation. CISA’s October 14 alert does not provide vulnerability-specific indicators of compromise, so defenders should avoid presenting general suspicious behaviors as confirmed evidence of exploitation for these CVEs.

For potentially affected systems, defenders can review:

• Unexpected or unexplained administrative logins.
• New accounts or unauthorized privilege changes.
• Configuration modifications outside approved maintenance activity.
• Unusual outbound network connections.
• Unexpected processes or command execution.
• Access from unfamiliar or unexplained source addresses.
• Changes to security settings, services, or administrative controls.
• Unexplained file access or modifications.
• Suspicious activity involving backup repositories or protected recovery data.
• Gaps, clearing, or unexplained changes in security and administrative logs.

PAN-OS environments warrant review of administrative activity, configuration changes, authentication events, and abnormal system communications. Cisco Secure Email Gateway deployments warrant examination of administrative changes, unusual file activity, abnormal processes, and behavior inconsistent with expected gateway operation. AhsayCBS environments warrant particular attention to authentication activity, administrator accounts, command execution, configuration changes, and access to backup repositories.

If evidence suggests that exploitation may have occurred, remediation should expand into formal incident response. That can include preservation of forensic evidence, credential rotation, session revocation, investigation of connected systems, review of privileged access, and examination for persistence or lateral movement. Patching should not be treated as proof that an exposed environment was never compromised.

---

Backup Infrastructure and Recovery Risk

The two AhsayCBS vulnerabilities place additional attention on backup infrastructure because recovery systems are an essential component of cyber resilience. Backup platforms may contain copies of production data, archived information, application configurations, databases, and other resources needed to restore an organization after a major incident.

Attackers involved in ransomware or destructive operations may seek to weaken recovery capability before disrupting production systems. Access to backup infrastructure can therefore carry value beyond the data stored inside it because the availability of reliable backups can determine whether an organization can recover without depending on an attacker.

Organizations using AhsayCBS should treat the platform as critical infrastructure within their own environments. Administrative access should be tightly controlled, backup credentials should be protected, management interfaces should be limited to necessary access paths, and recovery copies should be protected from unauthorized modification or deletion. Restoration procedures should also be tested so that the existence of backup data is not confused with proof that recovery will succeed during an actual incident.

---

Email Security Gateway Exposure

Cisco Secure Email Gateway occupies another sensitive position because email remains a central communications channel for businesses, governments, healthcare organizations, educational institutions, and other enterprises.

Email-security gateways are intended to block malicious attachments, detect suspicious messages, enforce communications policies, inspect inbound and outbound traffic, and reduce the volume of phishing and malware reaching users. A vulnerability affecting the gateway itself places attention on infrastructure that organizations ordinarily rely on as part of their defensive layer.

CISA’s alert does not establish what specific files, configurations, or data may be reachable through CVE-2026-76519. Organizations should therefore avoid expanding the technical impact beyond what vendor documentation establishes. The confirmed active exploitation is sufficient to warrant expedited remediation and examination of systems that remained vulnerable before corrective action was completed.

---

Network Security Infrastructure Under Attack

PAN-OS represents a different form of exposure because network-security systems can sit directly between trusted and untrusted parts of an environment. Organizations rely on these platforms to enforce policies, control network access, segment systems, inspect communications, and reduce unauthorized movement.

A code injection vulnerability affecting that layer deserves attention because a security appliance can become valuable to an attacker precisely because of its position within the network. This does not establish that CVE-2026-0322 automatically provides complete control of an affected firewall or unrestricted access to surrounding systems. CISA’s October 14 alert does not make those claims.

The active exploitation status still changes the response priority. Organizations should determine whether affected PAN-OS systems exist, apply the relevant remediation, review exposure of management and service interfaces, examine privileged access, and assess systems that remained vulnerable during the exploitation period.

---

30-Day Outlook

The next 30 days should center on rapid identification of vulnerable systems, completion of remediation, technical validation, and review of environments that remained exposed before corrective action.

Organizations should expect the following areas to remain important:

• Continued efforts to identify overlooked or secondary affected systems.
• Accelerated remediation across internet-facing security infrastructure.
• Greater scrutiny of PAN-OS, Cisco Secure Email Gateway, and AhsayCBS deployments that remained exposed before patching.
• Additional compromise assessments where vulnerable systems held sensitive or privileged roles.
• Further official technical information from affected vendors as remediation and investigation continue.
• Continued use of CISA’s KEV Catalog as a prioritization mechanism for vulnerabilities with confirmed exploitation.
• Increased attention to backup systems, network appliances, and email-security infrastructure as security-critical assets rather than ordinary supporting systems.

The most significant exposure may come from systems that escape the initial remediation effort. A primary appliance can be corrected while a failover unit, disaster-recovery node, remote deployment, or older installation remains vulnerable. Organizations should verify their full asset inventory before declaring remediation complete.

---

TRJ Verdict

CISA’s October 14 addition of CVE-2026-0322, CVE-2026-76519, CVE-2026-105133, and CVE-2026-105134 places four vulnerabilities affecting network security, email security, and backup infrastructure into confirmed active exploitation status.

The vulnerabilities affect different technologies and different security mechanisms. Palo Alto Networks PAN-OS is affected by a code injection vulnerability, Cisco Secure Email Gateway is affected by a relative path traversal vulnerability, and Ahsay AhsayCBS is affected by both improper authentication and command injection weaknesses. CISA has not identified a shared threat actor or stated that these vulnerabilities form a single attack campaign, so each should be treated according to its own affected environment and remediation requirements.

What connects them is the importance of the systems involved. Network-security platforms control access and traffic, email gateways protect organizational communications, and backup platforms preserve data needed for recovery. Compromise of technology in any of those positions can create risk that extends beyond the vulnerable product itself because these systems are trusted components of the larger defensive architecture.

Organizations should identify every affected deployment, apply the appropriate vendor remediation, verify that corrective actions were completed successfully, and assess systems that remained exposed for evidence of compromise. Federal agencies must apply the risk-based requirements established under BOD 26-04, and organizations outside the federal government have the same practical reason to place KEV vulnerabilities near the top of their remediation priorities.

The October 14 alert reinforces a cybersecurity reality that cannot be ignored: defensive infrastructure is also attackable infrastructure. Firewalls, email-security gateways, and backup platforms require the same rigorous inventory, patching, monitoring, access control, and compromise assessment expected for the systems they are intended to protect. Once CISA confirms active exploitation, delay becomes part of the risk.

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---