Key points
- CISA added CVE-2026-76519 for Cisco Secure Email Gateway to the Known Exploited Vulnerabilities catalog.
- Palo Alto Networks PAN-OS code injection CVE-2026-0322 is now on the list after confirmed exploitation.
- AhsayCBS flaws CVE-2026-105133 and CVE-2026-105134 were added following targeted attacks on five organizations.
Security operations teams must address six newly listed vulnerabilities in the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog. The additions include flaws in Cisco, Palo Alto Networks, Ahsay, Fortinet, and BeyondTrust products. These entries signal that threat actors are actively using these weaknesses to breach networks, making immediate remediation essential for organizations running these specific software versions.
In plain English
The Cisco Secure Email Gateway flaw allows attackers to write files to the operating system via crafted email attachments. Palo Alto Networks reported limited exploitation of a code injection bug in its management interface that grants root access. AhsayCBS has two linked issues: one bypasses authentication, and the other allows command execution. Fortinet’s path traversal flaw enables malware deployment, while BeyondTrust Remote Support suffers from an authentication bypass.
The background
According to Security Affairs, Cisco confirmed active exploitation of its critical vulnerability, which carries a CVSS score of 9.8. Palo Alto Networks stated that authenticated attackers with high-level privileges can exploit its high-severity flaw affecting PA-Series, VM-Series, and Panorama appliances. Huntress reported that attackers used the Ahsay authentication bypass starting October 7, 2026, to target at least five organizations before exploiting the second flaw for command injection.
What changes now
The inclusion in the KEV catalog triggers mandatory remediation for federal agencies under Binding Operational Directive 22-01. Private sector organizations are also advised to review their infrastructure against these specific CVEs. For BeyondTrust, CISA noted that patches exist for supported versions, urging users of older releases to upgrade immediately to close the authentication bypass gap before threat actors establish persistence and move laterally.
Who needs to act first
Teams should prioritize systems exposed to the internet or untrusted networks, as these are most likely to be targeted by automated scanning tools. Verify which internal assets run the affected software versions before attempting mass updates. Isolate critical servers if immediate patching is not feasible, reducing the attack surface while waiting for maintenance windows. Ensure backup procedures are current before applying changes to avoid data loss during the remediation process for these complex enterprise systems.
Background: Authentication bypass vulnerabilities
Enforce server-side session validation for every request. Use short-lived tokens with strict scope. Implement multi-factor authentication to block credential theft. Remove client-side logic that makes access decisions. Audit your code for logic flaws that skip verification steps.
Read the full guide: Stop Authentication Bypass Vulnerabilities with Priority Controls
What to do and how to stay safe: Cisco
- Inventory all instances of Cisco Secure Email Gateway, Palo Alto PAN-OS, AhsayCBS, FortiManager, and BeyondTrust Remote Support across your network.
- Check current software versions against vendor advisories to determine if they are affected by the specific CVEs listed in the catalog.
- Restrict access to management interfaces for Palo Alto devices to trusted internal IP addresses as a temporary mitigation measure.
- Monitor logs for unusual authentication attempts or file operations on Ahsay and BeyondTrust systems while preparing updates.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific CVEs were added to the CISA KEV catalog?
CISA added CVE-2026-0322, CVE-2026-76519, CVE-2026-105133, CVE-2026-105134, CVE-2025-61624, and CVE-2026-102764.
Are patches available for all the listed vulnerabilities?
Patches are available for Palo Alto Networks and BeyondTrust Remote Support; Cisco and Ahsay fixes are implied by the context of exploitation but not explicitly confirmed as released in the source.
What is the severity of the Cisco Secure Email Gateway flaw?
The Cisco flaw is rated critical with a CVSS score of 9.8.
