The US Cybersecurity and Infrastructure Security Agency (CISA) has added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, meaning it has evidence that attackers are using each of them. The October 14 alert names flaws in Cisco Secure Email Gateway, Palo Alto Networks PAN-OS and two in Ahsay's AhsayCBS backup server.
All four sit in equipment that faces the internet or holds sensitive data: an email security appliance, a firewall operating system and a backup platform. US federal civilian agencies must prioritize them under Binding Operational Directive 26-04, and CISA urges every organization to treat KEV entries as a patching priority.
A malicious attachment can reach root on Cisco's mail gateway
The most severe entry is CVE-2026-76519 in Cisco Secure Email Gateway, rated CVSS 9.8 (Critical). According to the NVD record, the flaw is in the gateway's Advanced Malware Protection (AMP) feature and stems from improper handling of email attachments when the file reputation service is enabled. An unauthenticated, remote attacker who sends an email with a crafted attachment through an affected device could write arbitrary files and execute commands with root privileges on the underlying operating system. CISA's catalog lists it as a relative path traversal vulnerability. Because the attack arrives as an ordinary email, the device built to screen malicious mail is the one exposed. This is a different bug from the Cisco email gateway flaw CISA flagged in September.
PAN-OS: a code injection bug, few public details
CVE-2026-0322 is listed by CISA as a Palo Alto Networks PAN-OS code injection vulnerability. The KEV alert gives no score, affected versions or exploitation detail; Palo Alto Networks' security advisory carries the specifics, including fixed releases. PAN-OS appliances have been a recurring target, including a root-level XML flaw reported in September.
Ahsay backup flaws now officially exploited
The two AhsayCBS entries confirm what we reported earlier this month, when attackers hit unpatched Ahsay backup servers to mine cryptocurrency. In severity order:
- CVE-2026-105134 (CVSS 9.3, Critical): OS command injection in the Replication Receiver component of AhsayCBS up to 10.3.2. CISA lists it as a command injection vulnerability.
- CVE-2026-105133 (CVSS 5.5, Medium): improper authentication in the AhsayCBS API, also up to 10.3.2.
Per NVD, upgrading to AhsayCBS 10.3.4 resolves both, and exploits for both are public.
Patch Cisco, Palo Alto and AhsayCBS 10.3.4 now
- Cisco Secure Email Gateway: apply the fixed release in Cisco's advisory for CVE-2026-76519, with priority on gateways that use AMP file reputation.
- PAN-OS: check Palo Alto Networks' advisory for CVE-2026-0322 and update to a fixed version.
- AhsayCBS: upgrade to 10.3.4 or later and check backup servers for signs of earlier compromise.
- Do not stop at patching: CISA's directive sets expectations for checking whether a system was compromised before the fix was applied.
A KEV listing is CISA saying the race has already started. For an email gateway, a firewall and a backup server, three systems defenders lean on during an incident, that means patching first and then checking whether attackers got there first.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.