Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

U.S. CISA adds Palo Alto Networks PAN-OS, Ahsay AhsayCBS, and Cisco Secure Email Gateway flaws to its Known Exploited Vulnerabilities catalog

1 source · 2 articlesFirst reported Updated ()1 · 1 read
Merged summary · from the lead articleSummaries by Vani AI

CISA added actively exploited Palo Alto PAN-OS, Cisco email gateway, and AhsayCBS flaws to the KEV catalog.

CISA added four actively exploited flaws to its Known Exploited Vulnerabilities catalog and ordered federal civilian agencies to fix them by October 17, 2026. CVE-2026-76519 (CVSS 9.8) is a relative path traversal in Cisco Secure Email Gateway that Cisco says is exploited by crafted email attachments that write arbitrary files. CVE-2026-0322 (CVSS 8.6) is authenticated code injection in the PAN-OS management interface, with limited exploitation observed on PA-Series, VM-Series, and Panorama. AhsayCBS flaws CVE-2026-105133 and CVE-2026-105134 were chained from October 7 for authentication bypass and unauthenticated command injection, deploying JSP webshells and XMRig miners against at least five organizations.

Key facts
  • CISA ordered federal agencies to remediate the four KEV flaws by October 17, 2026.
  • Cisco CVE-2026-76519 (CVSS 9.8) is exploited with crafted email attachments that write files.
  • PAN-OS CVE-2026-0322 allows privileged root code execution on the management interface.
  • Ahsay flaws were chained for SYSTEM command execution, JSP webshells, and XMRig.
  • Huntress reported at least five Ahsay organizations targeted by October 8.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
CVEs
CVE-2026-0322CVE-2026-76519CVE-2026-105133CVE-2026-105134
Vendors
Palo Alto NetworksCiscoAhsay
Products
PAN-OSCisco Secure Email GatewayAhsayCBSPanoramaCisco AMPContent Scanner ToolsAsyncOSCisco AsyncOSAdvanced Malware ProtectionPA-SeriesVM-SeriesCloud NGFW
Malware
XMRig
Organizations
CISAHuntressCiscoQualysPalo Alto NetworksCanadian Centre for Cyber Security
Countries
United StatesCanada

Coverage

oldest first · one row per article · UTC
  1. · 15d ago Qualys ThreatPROTECTFirst report

    Palo Alto Networks (PAN-OS) Remote Code Execution Vulnerability Exploited in Attack (CVE-2026-0322)

    Attackers are exploiting CVE-2026-0322, an authenticated PAN-OS flaw that enables root code execution.

  2. · 15d ago Qualys ThreatPROTECT

    CISA Warns of Cisco Secure Email Gateway Arbitrary File Write Vulnerability (CVE-2026-76519)

    CISA says actively exploited Cisco Secure Email Gateway flaw CVE-2026-76519 allows root command execution.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-0322
Authenticated root RCE in Palo Alto PAN-OS management
8.62%KEV
KEV
CVE-2026-105134
+1 related CVE
CVE-2026-105133
Unauthenticated OS Command Injection in AhsayCBS
10.0
group max
82%KEVPoC
KEV
CVE-2026-76519
Relative Path Traversal to Root RCE in Cisco Secure Email Gateway
9.82%KEVPoC
KEV