The US Cybersecurity and Infrastructure Security Agency has added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, and it is giving federal civilian agencies only until October 17 to fix them. The list is uncomfortable reading for security teams, because every product on it exists to protect a network: Cisco’s Secure Email Gateway, Palo Alto Networks firewalls, and Ahsay’s backup management console.
CISA adds flaws to the catalog only when it has evidence they are being exploited in the wild, and the agency warned that vulnerabilities of this kind are a routine attack path against federal systems. The compressed deadline — three days instead of the usual weeks — signals how exposed the affected products are.
The worst of the four guards the inbox
The most serious entry is CVE-2026-76519, a flaw rated 9.8 out of 10 in Cisco Secure Email Gateway. Cisco describes it as a path traversal weakness in the appliance’s Advanced Malware Protection feature, triggered by the way the device handles email attachments when its file reputation service is turned on.
The attack requires no password and no cooperation from anyone inside the target organization. According to Cisco, an attacker simply sends an email carrying a crafted attachment through a vulnerable appliance. A successful exploit lets the attacker write arbitrary files and run commands with root privileges on the underlying operating system — effectively taking over the box that inspects the company’s mail.
The flaw affects physical and virtual Secure Email Gateway appliances when two conditions hold: the file reputation service is enabled and assigned to a mail policy, and the Content Scanner Tools component is older than version 25.3.0.5525. Cisco says it found the bug during internal security scanning, and that its product security team became aware of active exploitation this month. There are no workarounds. The fix ships in Content Scanner Tools 25.3.0.5525 and later, which Cisco says can be applied without a full software upgrade or a restart; customers on AsyncOS releases older than 16.5 are told to migrate to release 16.5.0-780.
One warning in Cisco’s advisory deserves emphasis: an attacker who gains root access can delete or conceal evidence of the intrusion on the device itself. The company advises administrators to look for suspicious activity — including unexpected uploads to external addresses — in network and firewall logs stored outside the appliance. Analysis by Pacific Technology Group notes this is the third actively exploited zero-day aimed at Cisco’s email gateway in under a year.
A root flaw in the firewall, too
CVE-2026-0322 affects the management interface of Palo Alto Networks’ PAN-OS. It allows an attacker who is already authenticated and has network access to run arbitrary code with root privileges on the firewall. The flaw carries a CVSS score of 8.6, Palo Alto Networks has marked its urgency as the highest level, and it says it has observed very limited exploitation aimed at the management interface.
The affected products are PA-Series and VM-Series firewalls and Panorama; Cloud NGFW and Prisma Access are not affected. Fixed releases are available across the PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 lines. The company says there are no workarounds, though restricting the management interface to trusted internal addresses reduces exposure — advice that applies to every firewall, patched or not.
The backup console that was patched, then patched again
The remaining two entries, CVE-2026-105133 and CVE-2026-105134, affect AhsayCBS, the management console for Ahsay’s backup software, which is used mainly by managed service providers. Researchers at Huntress documented attackers chaining the pair: the first flaw bypasses authentication, and the second executes code with SYSTEM privileges. The goal, in the attacks observed, was to plant webshells and cryptominers on internet-facing servers.
The uncomfortable detail is that Ahsay had already shipped fixes for both flaws once. On October 12 the company acknowledged that its earlier patches had not fully closed them. Corrected hotfixes are now available — version 10.3.4.45 for version 10 installations and 9.15.2.70 for versions 7 through 9 — and Huntress says its testing confirms the new hotfix blocks the attack chain’s entry point.
Why this batch matters
Taken together, the four entries describe a pattern defenders keep relearning: the highest-value targets on a network are often the security and management systems themselves, because they hold broad privileges and are frequently left unpatched longest. An email gateway sees every attachment, a firewall defines the perimeter, and a backup console can reach the data an organization would need after a ransomware attack.
For administrators, the practical steps are the ones in the advisories: apply the Cisco content scanner update or PAN-OS fixes now rather than at the next maintenance window, install the corrected Ahsay hotfix even if the earlier patch went in, and check logs held off the devices for signs the flaws were used before the patches arrived. CISA’s October 17 deadline binds federal agencies, but the exploitation it is based on does not distinguish between public and private networks. More coverage is in our cybersecurity section.
