U.S. CISA adds Palo Alto Networks PAN-OS, Ahsay AhsayCBS, and Cisco Secure Email Gateway flaws to its Known Exploited Vulnerabilities catalog

CVE-2026-0322 is a code-injection flaw (CWE-94) in the management interface of Palo Alto Networks PAN-OS that allows remote code execution. An authenticated attacker who can reach the management interface over the network can run arbitrary code with root privileges on the device. It affects PAN-OS on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series); Cloud NGFW and Prisma Access are not affected. Palo Alto notes that risk is reduced when management access is limited to trusted internal addresses, consistent with its deployment guidance. CISA added the issue to the Known Exploited Vulnerabilities catalog on 2026-10-14, and reporting describes active exploitation including as a zero-day; ransomware use is listed as unknown and no public proof-of-concept is known. CVSS 4.0 is 8.6 (high), with high privileges required but low attack complexity and full impact on the vulnerable system.

Do: Restrict PAN-OS and Panorama management interfaces to trusted internal IP addresses only, and apply Palo Alto Networks patches per vendor guidance and CISA BOD 26-04. Because this is in the CISA KEV catalog with reported active exploitation, review management-plane access logs and host integrity for unexpected root-level activity, and follow CISA forensics triage requirements where the interface was reachable.

Ahsay AhsayCBS through version 10.3.2 has an OS command injection flaw in the Replication Receiver component, in the /rps/api/json/UpdateReceivers.do endpoint. A remote attacker can trigger it by manipulating the random argument, with no authentication and no user interaction required. Successful exploitation can execute operating-system commands with the privileges of the backup server, with high impact to confidentiality, integrity, and availability of that host and potentially of connected systems. Organizations running AhsayCBS at or below 10.3.2 are affected; upgrading to 10.3.4 fixes the issue. The advisory states that an exploit has been published and may be used, but the flaw is not in CISA KEV and confirmed in-the-wild exploitation is not reported.

Do: Upgrade AhsayCBS to version 10.3.4. Until that is done, limit network access to the replication receiver API so only trusted hosts can reach /rps/api/json/UpdateReceivers.do, and review logs for unexpected requests to that endpoint.

CVE-2026-76519 is a critical relative path traversal flaw (CWE-23, CVSS 9.8) in the Advanced Malware Protection feature of Cisco Secure Email Gateway. When the file reputation service is enabled, an unauthenticated remote attacker can send an email with a crafted attachment that the gateway mishandles. A successful attack can write arbitrary files on the underlying operating system and execute commands as root. Cisco Secure Email Gateway deployments that use this AMP/file reputation feature are affected; specific version ranges are not listed in the source data. CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2026-10-14, Cisco has urged customers to patch and check for compromise, and a public proof-of-concept reference exists; ransomware use is listed as unknown.

Do: Apply Cisco's fixes or mitigations for CVE-2026-76519 immediately, and follow CISA BOD 26-04 (including forensics triage). Treat appliances with Advanced Malware Protection or file reputation enabled as potentially compromised: review for unexpected files and root-level command execution, and isolate or discontinue use if a vendor fix is unavailable.