CISA adds active PAN-OS and Cisco CVEs

CISA added CVE-2026-0322 in PAN-OS, CVE-2026-76519 in Cisco Secure Email Gateway, and CVE-2026-105133 and CVE-2026-105134 in AhsayCBS to its Known Exploited Vulnerabilities catalog after finding signs of active exploitation. For CVE-2026-0322, the remediation requirement applies to U.S. federal civilian executive branch agencies, with a deadline of Oct. 17, 2026.

What did Palo Alto Networks say about CVE-2026-0322?

Palo Alto Networks described CVE-2026-0322 as an authenticated remote code execution flaw in the PAN-OS management interface, capable of running arbitrary code with root privileges. The scope includes PA-Series and VM-Series firewalls, as well as Panorama, both virtual and M-Series.

The Canadian Centre for Cyber Security said CISA added the flaw to the KEV catalog on Oct. 14, 2026, and listed the affected branches and fixed versions. SecurityWeek added that Palo Alto Networks released patches for PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 branches.

What conditions make Cisco Secure Email Gateway worse?

Canada’s technical advisory said CVE-2026-76519 affects Cisco AsyncOS versions for Secure Email Gateway earlier than 15.5.5-014 and 16.5.0-780, and also detailed affected versions of Secure Email and Web Manager. Cisco confirmed real-world exploitation.

Help Net Security said exploitation requires File Reputation, part of Cisco AMP, to be enabled and assigned to an email policy, along with a Content Scanner Tools version earlier than 25.3.0.5525. Under those conditions, a crafted attachment can allow file writes and command execution with root privileges.

What did Bitdefender report about AhsayCBS?

Bitdefender reported an exploitation chain that combines CVE-2026-105133, an authentication flaw, and CVE-2026-105134, a command injection issue rated CVSS 10.0 by VulDB. The company said AhsayCBS servers exposed to the internet are vulnerable if they run versions earlier than v10.3.4.45 or v9.15.2.70.

The firm also said the vendor has hotfixes available. CISA, for its part, added both vulnerabilities to the KEV after detecting active exploitation.

What other flaws did CISA add to KEV?

In addition to the flaws in PAN-OS, Cisco and AhsayCBS, CISA added CVE-2016-3081 in Apache Struts, CVE-2015-5477 in ISC BIND, CVE-2015-3306 in ProFTPD, CVE-2021-3199 in ONLYOFFICE Docs Server, and CVE-2023-22894 in Strapi, after reports of confirmed abuse.

The additions broaden the set of products where the agency identified exploitation or confirmed abuse, with direct impact on enterprise and infrastructure environments.

CISA advisory: critical vulnerability

CISA published an advisory on critical vulnerabilities that were already being exploited in PAN-OS, Cisco Secure Email Gateway and AhsayCBS. The KEV catalog collects active flaws that require priority remediation, and in this case the agency added several CVEs with evidence of real abuse.

In PAN-OS, the critical vulnerability is CVE-2026-0322, which affects PA-Series and VM-Series firewalls, as well as Panorama. In Cisco Secure Email Gateway, CVE-2026-76519 requires specific conditions for exploitation, while in AhsayCBS CISA added CVE-2026-105133 and CVE-2026-105134 after detecting active exploitation.