CISA flags exploited flaws in Palo Alto, Cisco and Ahsay products

The US Cybersecurity and Infrastructure Security Agency (CISA) has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

• CVE-2026-0322, a high-severity remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS
• CVE-2026-76519, a critical relative path traversal vulnerability in Cisco Secure Email Gateway (SEG)
• CVE-2026-105133, a medium-severity improper authentication vulnerability, and CVE-2026-105134, a critical command injection vulnerability, in Ahsay AhsayCBS

The agency added them based on evidence of active exploitation and has given US federal civilian agencies three days, until October 17, 2026, to address the vulnerabilities.

“These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise,” CISA warned.

About CVE-2026-0322

CVE-2026-0322 is a flaw in the management interface of Palo Alto Networks PAN-OS that allows an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.

It affects PA-Series and VM-Series firewalls and Panorama. Cloud NGFW and Prisma Access are not affected.

The flaw has a CVSS score of 8.6, and Palo Alto Networks has marked its urgency as highest. “Very limited exploitation has been observed targeting the Palo Alto Networks management interface,” the company says. Its advisory lists three IP addresses tied to the exploit attempts.

Fixed releases are available for PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2, and PAN-OS 11.2.16 is expected on October 15. Customers on older, unsupported versions need to upgrade to a supported fixed version.

“No known workarounds exist for this issue,” the company noted, but customers can minimize the risk by restricting management interface access to trusted internal IP addresses.

“Limited coverage in Threat Prevention means that while known attack patterns can be identified using the current Threat ID, variations may exist that cannot currently be detected. If this CVE and Required Configuration for Exposure impact your environment, we recommend upgrading to an unaffected version,” reads the advisory.

The flaw was discovered internally by Palo Alto Networks’ Suraj Siddharudh.

About CVE-2026-76519

CVE-2026-76519 is a relative path traversal vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway, caused by improper handling of email attachments when the file reputation service is enabled.

“An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system,” Cisco warned.

The flaw has a CVSS score of 9.8 and was found during internal security scanning. “In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability,” the company wrote.

This vulnerability affects physical and virtual Cisco Secure Email Gateway appliances running a vulnerable release of Cisco AsyncOS Software, when two conditions are met:

• The File Reputation service, part of Cisco AMP, is enabled and assigned to a mail policy
• The Content Scanner Tools version is earlier than 25.3.0.5525

Cisco warns that attackers with root access may remove or hide evidence of exploitation, and advises admins to check network and firewall logs outside the device for suspicious activity, including unexpected uploads to external IP addresses.

“There are no workarounds that address this vulnerability,” Cisco said.

The company recommends that customers running AsyncOS releases older than 16.5 migrate to release 16.5.0-780. The fix is also available for all licensed and supported AsyncOS releases through Content Scanner Tools version 25.3.0.5525 and later, which doesn’t require a software upgrade or a restart.

About CVE-2026-105133, CVE-2026-105134

Backup server operators who installed Ahsay’s earlier patches for two AhsayCBS vulnerabilities were still exposed, the company has confirmed. Attackers have been exploiting the flaws to plant webshells and cryptominers on internet-facing servers.

AhsayCBS is the management console for Ahsay’s backup software. It is mostly used by managed service providers and system integrators to create and manage users and configure backup policies.

Huntress researchers, who documented the attacks in a blog post on October 8, said the two flaws are being chained together to get into targeted systems. “First, CVE-2026-105133 is used to bypass authentication,” they explained. CVE-2026-105134 is then used to execute code on the server with SYSTEM privileges.

In an October 12 security alert, Ahsay admitted that its previous patches, v9.15.2.59 and v10.3.4.0, did not completely fix CVE-2026-105133 and CVE-2026-105134.

Citing the severity of the risks, the company urged partners to “take immediate action to secure your environment and protect your customers data.”

Organizations running v10 versions should install the AhsayCBS v10.3.4.45 hotfix, and those on v7, v8 and v9 should install v9.15.2.70. Both are available through Ahsay’s partner portal, and the company asks administrators to reboot the server after applying them.

The same day, Huntress updated its blog post to say its own testing confirmed that the 10.3.4.45 hotfix blocks the initial entry point of the attack chain, which earlier v10 versions had left open.