CISA Adds Critical Palo Alto, Cisco, and Ahsay Flaws to KEV Catalog
Federal agencies must remediate active exploitation vulnerabilities in network infrastructure by October 17, 2026.
1CISA Expands KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency recently updated its Known Exploited Vulnerabilities catalog to include four critical flaws. These vulnerabilities affect Palo Alto Networks PAN-OS, Cisco Secure Email Gateway, and Ahsay AhsayCBS platforms. Federal agencies are now under a strict mandate to remediate these specific security gaps by October 17, 2026.
2Critical Cisco Gateway Flaw
Cisco Secure Email Gateway is currently suffering from CVE-2026-76519, a relative path traversal vulnerability with a CVSS score of 9.8. Threat actors exploit this by sending crafted email attachments to write arbitrary files onto the underlying operating system. This critical flaw allows attackers to bypass standard security controls within the gateway infrastructure.
3Palo Alto Networks Exposure
The management interface of Palo Alto Networks PAN-OS is impacted by CVE-2026-0322, a high-severity code injection vulnerability. With a CVSS score of 8.6, it permits authenticated attackers with high-level privileges to execute arbitrary code as root. Affected hardware includes PA-Series, VM-Series firewalls, and Panorama appliances, requiring immediate restriction of management interface access.
4AhsayCBS Authentication Bypass
AhsayCBS faces a dual-threat scenario involving CVE-2026-105133 and CVE-2026-105134. The former allows remote attackers to bypass authentication by manipulating the random parameter in the checkSysPwd function. This initial breach serves as a gateway for attackers to perform further malicious actions, as observed in multiple targeted organizations starting on October 7, 2026.
5Command Injection and Exploitation
The second AhsayCBS flaw, CVE-2026-105134, is a critical command injection vulnerability with a 9.3 CVSS score. Attackers chain this with the authentication bypass to gain NT AUTHORITY\SYSTEM privileges. They have been observed deploying JSP web shells and installing XMRig cryptocurrency miners disguised as legitimate Microsoft Edge processes on compromised server systems.
6Active Threat Landscape
Huntress researchers confirmed that at least five organizations were targeted using the AhsayCBS vulnerabilities by October 8, 2026. This active exploitation highlights the urgency for private sector entities to review their own infrastructure against the CISA catalog. Attackers are clearly prioritizing these specific backup management platforms to gain deep system-level access.
7Mandatory Federal Compliance
Binding Operational Directive 22-01 requires all Federal Civilian Executive Branch agencies to address these identified vulnerabilities by the specified deadline. This directive aims to reduce the significant risk posed by known exploits within government networks. Agencies must prioritize these patches to maintain compliance and ensure the integrity of their critical infrastructure systems.
8Strategic Security Recommendations
Beyond federal mandates, private organizations should treat the CISA KEV catalog as a primary intelligence source for vulnerability management. Implementing security updates and restricting access to trusted internal IP addresses remains the most effective defense. Continuous monitoring for unauthorized processes, such as hidden cryptocurrency miners, is essential for detecting ongoing exploitation attempts.