CISA gives agencies until October 17 to fix four exploited bugs in Cisco, Palo Alto and Ahsay products
CISA added four exploited flaws in PAN-OS, Cisco Secure Email Gateway and AhsayCBS to KEV with an October 17 federal deadline. We would take the Cisco gateway first, then AhsayCBS servers already patched once, then PAN-OS.
The Watch · Security desk
US federal civilian agencies have 3 days, until October 17, 2026, to address the vulnerabilities. CVSS scores: Cisco Secure Email Gateway flaw CVE-2026-76519, 9.8; PAN-OS flaw CVE-2026-0322, 8.6.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Federal civilian agencies' time to address | 3 days | 3 | |
| Cisco email gateway flaw | 9.8 CVSS score | 14 | |
| PAN-OS flaw | 8.6 CVSS score | 8 |
What happened
- CVE-2026-0322 lets an authenticated attacker with network access to the PAN-OS management interface run code as root on PA-Series, VM-Series and Panorama; Cloud NGFW and Prisma Access are unaffected.
- Palo Alto scores CVE-2026-0322 at CVSS 8.6 and marks its urgency as highest.
- CVE-2026-76519 reaches Cisco appliances only when File Reputation is enabled on a mail policy and Content Scanner Tools is older than version 25.3.0.5525.
- Palo Alto has fixed releases for PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2, with 11.2.16 expected on October 15.
Why it matters
- exposure Any internet-facing AhsayCBS server patched earlier needs a search for webshells and cryptominers, since attackers were planting both.
- constraint On a Cisco gateway, patching does not show whether the box was already compromised. A root attacker can hide evidence, so the useful logs are the ones outside the device.
- decision For PAN-OS, the first question is whether the management interface is reachable from untrusted networks. Palo Alto's only mitigation is restricting it to trusted internal IP addresses.
- cost Cisco customers on licensed, supported releases can close the hole with a Content Scanner Tools update and no restart. Those on releases older than 16.5 face a migration to 16.5.0-780.
Cisco's flaw has the shortest path. According to Cisco, an attacker sends an email with a crafted attachment through an affected device and can then write arbitrary files and execute commands as root [15]. The bug is in the Advanced Malware Protection feature and is scored CVSS 9.8 [14]. "In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability," the company wrote [16]. Cisco lists no workaround: "There are no workarounds that address this vulnerability," it said [19].
Ahsay is second because the exposure may predate the listing. The company confirmed that operators who installed its earlier patches were still exposed [21]. AhsayCBS is the management console for Ahsay's backup software, used mostly by managed service providers and system integrators [23]. Help Net Security rates one of the two flaws medium and the other critical [24]. CISA listed all four CVEs on evidence of exploitation [1]. The reporting does not say which AhsayCBS release closes both flaws.
PAN-OS is third. CVE-2026-0322 needs an authenticated attacker with network access to the management interface [7]. Palo Alto says "Very limited exploitation has been observed targeting the Palo Alto Networks management interface" [9], and its advisory lists three IP addresses tied to the attempts [10]. The company also warns that Threat Prevention coverage is limited, so variations of the known attack pattern may go undetected [13]. In our view, a firewall whose management interface is closed to untrusted networks can take this in a normal patch window. One with that interface open to the internet cannot, because the payoff is root on the firewall [7].
The four CVEs span three vendors [25]. Each sits on a product that guards the network edge or administers other systems. CISA wrote that "These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise" [4]. The reporting does not identify who is exploiting any of them, so the four cannot be tied to one campaign.
The October 17 date [3] binds only federal civilian agencies, and CISA encourages all organizations to prioritize KEV remediation [6]. BOD 26-04 tells agencies to put KEV CVEs on publicly exposed assets that grant total control first [5]. The Cisco and PAN-OS flaws both end in root [15][7]. PAN-OS 11.2.16 is due on October 15, two days before the deadline [26].
What to watch
- Whether Palo Alto ships PAN-OS 11.2.16 on October 15 as expected, ahead of the October 17 federal deadline.
- Whether Ahsay publishes a release that closes both AhsayCBS flaws and says why the earlier patches fell short.
- Whether Cisco, Palo Alto or CISA attribute the exploitation to a named actor or add indicators beyond the three PAN-OS IP addresses.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption
- Insufficient
- Hype gap0
- Incentives
- Insufficient
- Confidence74
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
CISA added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation.
- [2]
The four CVEs are CVE-2026-0322 (Palo Alto Networks PAN-OS), CVE-2026-76519 (Cisco Secure Email Gateway), and CVE-2026-105133 and CVE-2026-105134 (Ahsay AhsayCBS).
- [3]
US federal civilian agencies have three days, until October 17, 2026, to address the vulnerabilities.
- [4]
CISA warned: "These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise."
- [5]
BOD 26-04 requires federal agencies to prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control of the asset post-exploitation, and sets basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.
- [6]
BOD 26-04 applies only to Federal Civilian Executive Branch agencies, but CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.
- [7]
CVE-2026-0322 is a flaw in the PAN-OS management interface that allows an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall; it affects PA-Series and VM-Series firewalls and Panorama, while Cloud NGFW and Prisma Access are not affected.
- [8]
CVE-2026-0322 has a CVSS score of 8.6, and Palo Alto Networks has marked its urgency as highest.
- [9]
Palo Alto Networks says: "Very limited exploitation has been observed targeting the Palo Alto Networks management interface."
- [10]
Palo Alto Networks' advisory lists three IP addresses tied to the exploit attempts.
- [11]
Fixed releases are available for PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2, and PAN-OS 11.2.16 is expected on October 15.
- [12]
Palo Alto Networks says no known workarounds exist for CVE-2026-0322, but customers can minimize the risk by restricting management interface access to trusted internal IP addresses.
- [13]
Palo Alto Networks' advisory says limited coverage in Threat Prevention means known attack patterns can be identified using the current Threat ID, but variations may exist that cannot currently be detected.
- [14]
CVE-2026-76519 is a relative path traversal vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway, caused by improper handling of email attachments when the file reputation service is enabled, with a CVSS score of 9.8.
- [15]
Cisco says an attacker could exploit CVE-2026-76519 by sending an email that contains a crafted attachment through an affected device, and a successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.
- [16]
Cisco wrote: "In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability."
- [17]
CVE-2026-76519 affects physical and virtual Cisco Secure Email Gateway appliances running a vulnerable AsyncOS release when the File Reputation service is enabled and assigned to a mail policy and the Content Scanner Tools version is earlier than 25.3.0.5525.
- [18]
Cisco warns that attackers with root access may remove or hide evidence of exploitation, and advises admins to check network and firewall logs outside the device for suspicious activity, including unexpected uploads to external IP addresses.
- [19]
Cisco said: "There are no workarounds that address this vulnerability."
- [20]
Cisco recommends that customers running AsyncOS releases older than 16.5 migrate to release 16.5.0-780; the fix is also available for all licensed and supported AsyncOS releases through Content Scanner Tools version 25.3.0.5525 and later, which does not require a software upgrade or a restart.
- [21]
Backup server operators who installed Ahsay's earlier patches for two AhsayCBS vulnerabilities were still exposed, the company has confirmed.
- [22]
Attackers have been exploiting the AhsayCBS flaws to plant webshells and cryptominers on internet-facing servers.
- [23]
AhsayCBS is the management console for Ahsay's backup software and is mostly used by managed service providers and system integrators to create and manage users and configure backup policies.
- [24]
Help Net Security describes CVE-2026-105133 as a medium-severity improper authentication vulnerability and CVE-2026-105134 as a critical command injection vulnerability.
- [25]
The four CVEs span three vendors: Palo Alto Networks, Cisco and Ahsay.
- [26]
PAN-OS 11.2.16 is expected two days before the October 17 federal deadline.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
2 independent publishers whose own reporting we read for this story.
- cisa.govCISA Adds Four Known Exploited Vulnerabilities to Catalog
1 article · October 14, 2026
- helpnetsecurity.comCISA flags exploited flaws in Palo Alto, Cisco and Ahsay products
1 article · October 15, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.