CISA KEV Catalog Updated with Palo Alto, Cisco, Ahsay Flaws

Executive Summary

On October 14, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) took action to address significant ongoing threats by adding four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. This action confirms that all four flaws are being actively exploited in the wild. The vulnerabilities impact widely used enterprise products from Palo Alto Networks, Cisco, and Ahsay. The inclusion in the KEV catalog serves as a directive for Federal Civilian Executive Branch (FCEB) agencies to remediate these vulnerabilities by October 17, 2026, and as a strong recommendation for all organizations to prioritize patching immediately.

Vulnerability Details

The four actively exploited vulnerabilities are:

1. CVE-2026-0322: A high-severity code injection vulnerability (CVSS 8.6) in the management interface of Palo Alto Networks PAN-OS. An authenticated attacker with network access to the management interface could exploit this flaw to execute arbitrary code with root privileges. Palo Alto Networks has confirmed limited exploitation.

2. CVE-2026-76519: A critical relative path traversal vulnerability (CVSS 9.8) in Cisco Secure Email Gateway (SEG). Exploitation allows an unauthenticated attacker to write arbitrary files and execute commands with root privileges by sending a specially crafted email. Cisco became aware of active exploitation in October 2026.

3. CVE-2026-105133: A medium-severity improper authentication vulnerability in AhsayCBS backup software. This flaw is used in conjunction with the next CVE.

4. CVE-2026-105134: A critical command injection vulnerability in AhsayCBS. Attackers are chaining this flaw with CVE-2026-105133 to gain initial access, install webshells, and deploy cryptocurrency miners on vulnerable backup servers.

Affected Systems

• Palo Alto Networks: PAN-OS on PA-Series (hardware), VM-Series (virtual), and CN-Series (container) firewalls.
• Cisco: Secure Email Gateway (SEG), both physical and virtual appliances.
• Ahsay: AhsayCBS backup and recovery software suite.

These products are commonly deployed in enterprise and government networks for perimeter security, email filtering, and data backup, making them high-value targets for attackers.

Exploitation Status

All four vulnerabilities have been confirmed by CISA and the respective vendors to be under active exploitation. The attackers targeting the Ahsay vulnerabilities are reportedly focused on cryptomining, a financially motivated activity. The actors exploiting the Palo Alto Networks and Cisco flaws could have more varied objectives, including espionage, data theft, or establishing persistent access for future attacks, given the critical position these devices hold in a network.

Impact Assessment

Successful exploitation of these vulnerabilities can have severe consequences:

• PAN-OS (CVE-2026-0322): Root-level compromise of a core network firewall allows an attacker to monitor or manipulate all network traffic, pivot to other internal systems, and disable security controls.
• Cisco SEG (CVE-2026-76519): Compromise of an email gateway can lead to the interception of sensitive communications, widespread phishing attacks against the organization, and a launchpad for further internal attacks.
• AhsayCBS (CVE-2026-105133/105134): Gaining control of a backup server not only allows attackers to deploy malware but also gives them access to an organization's backed-up data. This could be leveraged for data theft or to destroy backups as part of a ransomware attack.

IOCs — Directly from Articles

No specific Indicators of Compromise (IOCs) were provided in the source articles.

Cyber Observables — Hunting Hints

Security teams should hunt for signs of exploitation. The following patterns could indicate related activity:

Detection & Response

Detection:

1. Log Review: Scrutinize logs from affected PAN-OS, Cisco SEG, and AhsayCBS devices for anomalous activity, such as unexpected administrative logins, configuration changes, or outbound network connections. (D3-NTA: Network Traffic Analysis)
2. Vulnerability Scanning: Use authenticated vulnerability scanners to identify affected devices and software versions within your environment.
3. Integrity Checks: For AhsayCBS, perform file integrity checks on the web server directories to look for unauthorized webshells or other malicious files.

Response:

1. Patch Immediately: Follow vendor guidance and apply the necessary security patches or updates to all affected systems. This is the highest priority.
2. Hunt for Compromise: After patching, assume compromise and actively hunt for signs of exploitation using the observables listed above.
3. Isolate & Rebuild: If a system is found to be compromised, isolate it from the network and prepare to rebuild it from a known-good state. Ensure all credentials used on the compromised system are rotated.

Mitigation

1. Apply Patches: The primary mitigation for all four vulnerabilities is to apply the security updates provided by Palo Alto Networks, Cisco, and Ahsay without delay. (M1051: Update Software)
2. Restrict Management Access: For the PAN-OS vulnerability, restrict access to the firewall management interface to a dedicated and secured management network. Do not expose the management interface to the internet. (M1035: Limit Access to Resource Over Network)
3. Network Segmentation: Place critical infrastructure like email gateways and backup servers in properly segmented network zones with strict access controls to limit their exposure. (M1030: Network Segmentation)
4. Vendor Best Practices: Implement vendor-recommended security hardening best practices for all network appliances and servers.