CISA Flags Exploited Palo Alto, Cisco, and Ahsay Flaws in KEV Catalog

Active Exploitation Triggers Emergency Patch Deadline

Four high-severity and critical vulnerabilities affecting perimeter security appliances and backup management infrastructure have been added to the Known Exploited Vulnerabilities catalog following confirmed in-the-wild attacks. Federal binding operational directives give U.S. civilian agencies three days, until October 17, 2026, to apply vendor updates across Palo Alto Networks PAN-OS, Cisco Secure Email Gateway, and Ahsay AhsayCBS deployments.

Because these products occupy privileged perimeters or maintain organization-wide backup repositories, compromise gives threat actors immediate, high-privilege access into internal networks. Adversaries are actively targeting administrative endpoints and automated attachment-processing engines to bypass authentication, drop webshells, execute arbitrary root commands, and install cryptominers.

Palo Alto PAN-OS Management Interface RCE (CVE-2026-0322)

A high-severity remote code execution flaw tracked as CVE-2026-0322 impacts the administrative management interface of Palo Alto Networks PAN-OS. The vulnerability allows an authenticated attacker with network access to the management plane to execute arbitrary code with root privileges on PA-Series hardware firewalls, VM-Series virtual firewalls, and Panorama management servers. Cloud NGFW and Prisma Access managed services are not vulnerable.

Technically, the vulnerability carries a CVSS 3.1 score of 8.6 with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. Although exploiting the bug requires high administrative privileges (PR:H), low attack complexity and zero required user interaction mean an adversary who has compromised administrative credentials or hijacked a management session can immediately escalate to complete device control via CWE-94 code injection. Exploit telemetry places its Exploit Prediction Scoring System (EPSS) rating at 1.1% (64.3rd percentile), reflecting focused, early-stage targeted attacks rather than widespread automated scanning. Palo Alto Networks confirmed very limited active exploitation targeting management interfaces and has published three specific indicator IP addresses tied to the initial exploit attempts.

Discovered internally by Palo Alto Networks researcher Suraj Siddharudh, the flaw impacts PAN-OS releases prior to 10.2.0, specific builds including 10.2.7 through 10.2.10, and 12.2.0 through 12.2.4. Fixed builds are available across supported release branches (including PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2), with version 11.2.16 releasing on October 15. Because Threat Prevention signatures cannot cover all potential exploit variations, Palo Alto Networks emphasizes that patching is the only complete defense.

Cisco Secure Email Gateway Root Compromise (CVE-2026-76519)

Cisco Secure Email Gateway (SEG) appliances face active targeted exploitation via CVE-2026-76519, a critical relative path traversal vulnerability rating a maximum CVSS score of 9.8. The bug resides within the Advanced Malware Protection (AMP) feature when the File Reputation service is enabled.

When an affected appliance processes an incoming email containing a specially crafted file attachment, improper handling within the content scanner allows the attachment to traverse directory structures. An unauthenticated remote attacker can exploit this mechanism simply by sending a malicious email through the gateway, overwriting arbitrary system files and executing commands with root privileges on the underlying AsyncOS operating system.

The vulnerability impacts physical and virtual Cisco SEG appliances running vulnerable AsyncOS releases where File Reputation is active on a mail policy and the Content Scanner Tools version is earlier than 25.3.0.5525. Cisco PSIRT confirmed active exploitation in October 2026 following internal security reviews. Notably, threat actors achieving root execution on Cisco SEG units actively wipe or modify local device logs to conceal their activity. Security teams must inspect external network tap and firewall logs for unexpected outbound traffic or anomalous data transfers originating from SEG appliances.

AhsayCBS Authentication Bypass and Command Injection Chain

Threat actors are also actively targeting AhsayCBS, the central management console used extensively by Managed Service Providers (MSPs) and system integrators to configure backup policies and manage client data.

Research published by Huntress demonstrates that attackers are chaining two distinct flaws together. First, CVE-2026-105133 (a medium-severity improper authentication vulnerability) is used to bypass authentication controls on internet-facing AhsayCBS backup servers. Once inside, attackers leverage CVE-2026-105134 (a critical command injection vulnerability) to execute arbitrary commands with SYSTEM privileges. Active exploitation campaigns have weaponized this chain to plant persistent webshells and deploy cryptominers across compromised infrastructure.

Crucially, Ahsay acknowledged on October 12 that its previously issued software patches (v9.15.2.59 and v10.3.4.0) failed to fully resolve CVE-2026-105133, leaving patched servers exposed to the initial authentication bypass. Independent testing confirmed that Ahsay’s latest hotfix release successfully neutralizes the initial entry point.

Remediation and Mitigation Steps

Organizations running affected hardware or management software should immediately implement the following remediation measures:

• Palo Alto Networks PAN-OS: Upgrade PA-Series, VM-Series, and Panorama installations to fixed PAN-OS releases (such as 10.2, 11.1, 11.2, 12.1, or 12.2). As no software workarounds exist for CVE-2026-0322, ensure administrative management interfaces are strictly segregated and accessible only from trusted internal IP addresses.
• Cisco Secure Email Gateway: Update Content Scanner Tools to version 25.3.0.5525 or later. This update distributes automatically without requiring a full AsyncOS software reboot. Appliances running AsyncOS builds older than 16.5 should be migrated directly to release 16.5.0-780.
• Ahsay AhsayCBS: Download and apply hotfix v10.3.4.45 (for version 10 environments) or v9.15.2.70 (for version 7, 8, and 9 installations) from the Ahsay partner portal, followed by a mandatory host server reboot.