# CISA Adds Critical Palo Alto, Cisco, and Ahsay Flaws to KEV Catalog Federal agencies must remediate active exploitation vulnerabilities in network infrastructure by October 17, 2026. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-10-15 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/e0e8d48a-5216-48e7-aa7d-f1fde2a755dd ## CISA Expands KEV Catalog The U.S. Cybersecurity and Infrastructure Security Agency recently updated its Known Exploited Vulnerabilities catalog to include four critical flaws. These vulnerabilities affect Palo Alto Networks PAN-OS, Cisco Secure Email Gateway, and Ahsay AhsayCBS platforms. Federal agencies are now under a strict mandate to remediate these specific security gaps by October 17, 2026. ## Critical Cisco Gateway Flaw Cisco Secure Email Gateway is currently suffering from CVE-2026-76519, a relative path traversal vulnerability with a CVSS score of 9.8. Threat actors exploit this by sending crafted email attachments to write arbitrary files onto the underlying operating system. This critical flaw allows attackers to bypass standard security controls within the gateway infrastructure. ## Palo Alto Networks Exposure The management interface of Palo Alto Networks PAN-OS is impacted by CVE-2026-0322, a high-severity code injection vulnerability. With a CVSS score of 8.6, it permits authenticated attackers with high-level privileges to execute arbitrary code as root. Affected hardware includes PA-Series, VM-Series firewalls, and Panorama appliances, requiring immediate restriction of management interface access. ## AhsayCBS Authentication Bypass AhsayCBS faces a dual-threat scenario involving CVE-2026-105133 and CVE-2026-105134. The former allows remote attackers to bypass authentication by manipulating the random parameter in the checkSysPwd function. This initial breach serves as a gateway for attackers to perform further malicious actions, as observed in multiple targeted organizations starting on October 7, 2026. ## Command Injection and Exploitation The second AhsayCBS flaw, CVE-2026-105134, is a critical command injection vulnerability with a 9.3 CVSS score. Attackers chain this with the authentication bypass to gain NT AUTHORITY\SYSTEM privileges. They have been observed deploying JSP web shells and installing XMRig cryptocurrency miners disguised as legitimate Microsoft Edge processes on compromised server systems. ## Active Threat Landscape Huntress researchers confirmed that at least five organizations were targeted using the AhsayCBS vulnerabilities by October 8, 2026. This active exploitation highlights the urgency for private sector entities to review their own infrastructure against the CISA catalog. Attackers are clearly prioritizing these specific backup management platforms to gain deep system-level access. ## Mandatory Federal Compliance Binding Operational Directive 22-01 requires all Federal Civilian Executive Branch agencies to address these identified vulnerabilities by the specified deadline. This directive aims to reduce the significant risk posed by known exploits within government networks. Agencies must prioritize these patches to maintain compliance and ensure the integrity of their critical infrastructure systems. ## Strategic Security Recommendations Beyond federal mandates, private organizations should treat the CISA KEV catalog as a primary intelligence source for vulnerability management. Implementing security updates and restricting access to trusted internal IP addresses remains the most effective defense. Continuous monitoring for unauthorized processes, such as hidden cryptocurrency miners, is essential for detecting ongoing exploitation attempts. ## Sources covering this story - https://securityaffairs.com/201041/security/u-s-cisa-adds-palo-alto-networks-pan-os-ahsay-ahsaycbs-and-cisco-secure-email-gateway-flaws-to-its-known-exploited-vulnerabilities-catalog.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._