On October 14, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation. The entries affect Palo Alto Networks PAN-OS, Cisco Secure Email Gateway, and Ahsay AhsayCBS. CISA’s alert also sets out who must follow Binding Operational Directive 26-04 (BOD 26-04): Federal Civilian Executive Branch (FCEB) agencies.

The four new KEV entries

CISA’s October 14 alert names these vulnerabilities and products:

  • CVE-2026-0322: code injection in the management interface of Palo Alto Networks PAN-OS.
  • CVE-2026-76519: relative path traversal in Cisco Secure Email Gateway.
  • CVE-2026-105133: improper authentication in Ahsay AhsayCBS.
  • CVE-2026-105134: command injection in AhsayCBS.

The Cisco entry follows NeoTeo’s earlier coverage of CVE-2026-76519, now part of CISA’s broader update covering three product families.

Who BOD 26-04 covers

CISA says BOD 26-04 applies to FCEB agencies. The agency encourages other organizations to prioritize KEV vulnerabilities through risk-based vulnerability management. Help Net Security reported that U.S. federal civilian agencies were due to address the four vulnerabilities by October 17, 2026. That reported deadline is for those agencies; CISA’s guidance to other organizations is to prioritize the catalog through their own risk-based management. (CISA; Help Net Security)

Product scope and reported fixes

For CVE-2026-0322, Help Net Security reported that an authenticated attacker with network access to the PAN-OS management interface could execute arbitrary code with root privileges. The report lists PA-Series and VM-Series firewalls and Panorama as affected, and Cloud NGFW and Prisma Access as unaffected. It gives the vulnerability a CVSS score of 8.6 and reports fixes for PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2. It also reports no known workaround; limiting management-interface access to trusted internal IP addresses can reduce risk. (Help Net Security)

For CVE-2026-76519, the reported exposure conditions are specific: the Cisco Secure Email Gateway must run a vulnerable AsyncOS release, File Reputation must be enabled and assigned to a mail policy, and Content Scanner Tools must be earlier than 25.3.0.5525. Help Net Security describes the attack route as a crafted attachment sent through an affected appliance and gives the flaw a CVSS score of 9.8. For supported, licensed AsyncOS releases, the report says updating Content Scanner Tools to 25.3.0.5525 or later addresses the issue without an operating-system upgrade or restart. It reports that installations on AsyncOS versions earlier than 16.5 should migrate to 16.5.0-780. (Help Net Security)

Ahsay replaces earlier AhsayCBS patches

On October 12, Ahsay said its earlier AhsayCBS patches v9.15.2.59 and v10.3.4.0 did not fully address CVE-2026-105133 and CVE-2026-105134. Ahsay directs affected v10 installations to v10.3.4.45, and affected v7, v8, and v9 installations to v9.15.2.70; its instructions call for a server reboot after applying the hotfix. Both downloads require a valid partner-portal login. (Ahsay’s security alert)

Huntress describes the two flaws as a chain: CVE-2026-105133 bypasses authentication, followed by CVE-2026-105134, which enables command execution with SYSTEM privileges. Huntress said it first observed exploitation at 23:20:15 UTC on October 7, 2026, and had seen five organizations targeted by October 8. Those figures describe Huntress’s observations. (Huntress)