CISA lists four exploited flaws across three products
AhsayCBS, Cisco Secure Email Gateway and PAN-OS: four exploited flaws. NVD now provides affected-version ranges.
Getting started
Generated image · SecuFocus
At a glance
Key points
If you run AhsayCBS, a Cisco Secure Email gateway, or a PAN-OS firewall, the catalog calls them exploited. The due date written on the entries is 17 October. If you run none of these three, this note changes nothing.
What changes
On 15 October 2026, the JSON feed of the known exploited vulnerabilities catalog is version 2026.10.14, with 1,745 entries, released on 14 October 2026 at 19:27 UTC. The previous reading still saw version 2026.10.13 and 1,741 entries. Four entries were added on 14 October. Their due date is 17 October 2026. None is marked as known in a ransomware campaign: the field says Unknown.
The CISA alert of 14 October 2026 names the four identifiers and says they were added based on evidence of active exploitation. It does not give a product version. It recalls that directive BOD 26-04 applies to United States federal civilian agencies, and that CISA encourages other organizations to handle catalog entries first. We did not reread the full text of the directive. 17 October is the date written in the catalog. It is not a deadline SecuFocus sets.
The two entries of 13 October, Ivanti Connect Secure and Windows, remain in the feed, with the same due date of 16 October. Each already has a note. This note is about the four additions of 14 October.
On 16 October 2026, the same feed is version 2026.10.15, with 1,746 entries, released on 15 October 2026 at 17:00 UTC. One entry was added on 15 October: CVE-2026-21589, Atlassian. It has its own note. The four additions of 14 October did not change due date: 17 October is still written on them. The ransomware field still says Unknown. On 17 October 2026, the feed is version 2026.10.16, with 1,748 entries, released on 16 October 2026 at 17:15 UTC. Two entries were added on 16 October: CVE-2026-102764, BeyondTrust, and CVE-2025-61624, Fortinet. They have their own note. The four additions of 14 October did not change due date: 17 October is still written on them.
The four, without flattening them
Ahsay AhsayCBS, two entries the catalog says can be chained. CVE-2026-105133 is an authentication bypass: a remote attacker manipulates the random parameter of the checkSysPwd function. The named weakness is CWE-287. Forensic triage says No. CVE-2026-105134 is command injection: the same kind of parameter, on /rps/api/json/UpdateReceivers.do, in the Replication Receiver component. The named weaknesses are CWE-77 and CWE-78. Forensic triage says Yes. Both are due 17 October.
Both NVD records, reread through the API on 19 October 2026, are Analyzed and were last modified on 15 October. The English descriptions supplied by cna@vuldb.com cover AhsayCBS through 10.3.2 and recommend upgrading to 10.3.4. CPE configurations are now present: they cover versions before 10.3.4, with no starting version. The descriptions and the CPE ranges therefore do not end at the same number. The CVSS 3.1 scores supplied by that source remain 7.3 for CVE-2026-105133 and 10.0 for CVE-2026-105134; the CVSS 4.0 scores are 5.5 and 9.3 respectively. The CISA coordinator marks both as actively exploited and automatable, with partial technical impact for the first and total impact for the second. We have not installed the fix.
Cisco Secure Email Gateway, CVE-2026-76519. The catalog calls it a relative path traversal: an unauthenticated remote attacker can write arbitrary files. The named weakness is CWE-23. Forensic triage says Yes. The due date is 17 October.
The NVD record is now Analyzed, last modified on 15 October 2026. According to the description supplied by psirt@cisco.com, the flaw affects Advanced Malware Protection when the file reputation service is enabled. An email containing a crafted attachment can allow file writes and commands with root privileges, without an account. Cisco supplies a CVSS 3.1 score of 9.8. The CPE configurations cover AsyncOS from 15.0 inclusive to before 15.5.5-014, and from 16.0 inclusive to before 16.5.0-780. The first range therefore starts earlier than the 15.5.x branch named by CERT-FR. Both sources give the same end bounds. The CISA coordinator marks exploitation as active and automatable, with total technical impact.
On 15 October 2026, CERT-FR published advisory CERTFR-2026-AVI-1325. It covers Cisco AsyncOS for Secure Email Gateway, versions 15.5.x before 15.5.5-014, and versions 16.x before 16.5.0-780. It writes that Cisco says CVE-2026-76519 is actively exploited. The named risks are harm to data integrity and remote arbitrary code execution. The fix points to the vendor bulletin. We did not open that page: it is not on the list. These bounds come from CERT-FR, not from a file we downloaded.
Palo Alto Networks PAN-OS, CVE-2026-0322. The catalog calls it code injection: an authenticated attacker with network access can execute arbitrary code with root privileges. The named weakness is CWE-94. Forensic triage says Yes. The due date is 17 October. The ransomware field says Unknown, as for the other three.
The NVD record is now Analyzed, last modified on 15 October 2026. The description supplied by psirt@paloaltonetworks.com covers the PAN-OS management interface on PA-Series and VM-Series firewalls, and Panorama, virtual or M-Series. According to that description, Cloud NGFW and Prisma Access are not affected. Restricting the interface to trusted internal addresses reduces exposure. The vendor supplies a CVSS 4.0 score of 8.6; its vector requires high privileges. NVD adds a CVSS 3.1 score of 7.2. CPE configurations are now present: they include 12.2.0 inclusive to before 12.2.4 and numerous specific versions or hotfixes in other branches. This is not a blanket rule that every version before 12.2.4 is affected. Check the exact branch and hotfix in the record. The CISA coordinator marks exploitation as active, not automatable, with total technical impact.
On 15 October 2026, advisory CERTFR-2026-AVI-1326 says Palo Alto Networks indicates that CVE-2026-0322 is actively exploited. The affected-systems list covers a bundle of many identifiers, not this one alone. That advisory lists a fix as pending for PAN-OS 11.2.6; the CPE configuration for CVE-2026-0322 also names that version as vulnerable. We do not assign each version line to CVE-2026-0322. We did not open the Palo Alto page.
What we did not check
We did not install AhsayCBS, a Cisco Secure Email gateway, or a PAN-OS firewall. We did not send a crafted email, and we did not replay the identifiers. Exploited comes from the catalog addition, the 14 October alert, and the CISA coordinator mark in the NVD records. It is not a SecuFocus test. Unknown in the ransomware field does not prove a campaign is absent.
We did not open the Ahsay, Cisco or Palo Alto vendor pages: they are outside the allowed list. The versions described here come from NVD and CERT-FR advisories. CPE configurations identify the products and versions associated with each flaw, but do not prove that a fix is installed on your system or that the appliance has not been compromised. None of this replaces checking your deployment.
The choice
If you administer one of these products, check its version and apply the vendor mitigations. For AhsayCBS, both NVD configurations cover versions before 10.3.4. For Cisco, also check AsyncOS versions from 15.0: NVD does not restrict its first range to 15.5.x. The end bounds are 15.5.5-014 and 16.5.0-780 for the respective branches. The file reputation service must be enabled for the described attack.
For PAN-OS and Panorama, restrict management access and check the exact version and hotfix, not just the branch number. The advisory vector requires a high-privilege account. NVD now provides a list specific to CVE-2026-0322, unlike the bundle of versions in the CERT-FR advisory. The federal due date written on all four entries remains 17 October; it is not a deadline granted by SecuFocus. If you use none of these products, this alert requires no action on your devices.
Check and explore
Sources for this article
Numbers connect each reference to the passages that use it. Dates show when the documentation was consulted.
This article draws on the sources above. The exercises are for you to try on your devices; SecuFocus does not present them as tests carried out by its editorial team. Interfaces and features can change. Method and corrections.
Cite this article
Keep this reference with the article when you save or share it.