CISA adds active PAN-OS and Cisco CVEs

CISA added CVE-2026-0322 in PAN-OS, CVE-2026-76519 in Cisco Secure Email Gateway, and CVE-2026-105133 and CVE-2026-105134 in AhsayCBS to its Known Exploited Vulnerabilities catalog after detecting signs of active exploitation. For CVE-2026-0322, the remediation requirement applies to US federal civilian executive branch agencies and is due by Oct. 17, 2026.

What did Palo Alto Networks say about CVE-2026-0322?

Palo Alto Networks described CVE-2026-0322 as an authenticated remote code execution flaw in the PAN-OS management interface, with the potential to run arbitrary code with root privileges. The scope includes PA-Series and VM-Series firewalls, as well as Panorama in both virtual and M-Series form.

The Canadian Centre for Cyber Security said CISA added the flaw to the KEV catalog on Oct. 14, 2026, and listed the affected branches and fixed versions. SecurityWeek added that Palo Alto Networks released patches for PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2.

What makes the Cisco Secure Email Gateway case worse?

A technical notice from the Government of Canada said CVE-2026-76519 affects Cisco AsyncOS for Secure Email Gateway versions earlier than 15.5.5-014 and 16.5.0-780, and it also detailed affected versions of Secure Email and Web Manager. Cisco confirmed exploitation in the wild.

Help Net Security said exploitation requires File Reputation, part of Cisco AMP, to be enabled and assigned to an email policy, along with a Content Scanner Tools version earlier than 25.3.0.5525. Under those conditions, a crafted attachment can allow file writes and command execution with root privileges.

What did Bitdefender report about AhsayCBS?

Bitdefender reported an exploitation chain that combines CVE-2026-105133, an authentication flaw, and CVE-2026-105134, a command injection flaw with a CVSS score of 10.0 according to VulDB. The company said Internet-facing AhsayCBS servers are exposed if they run versions earlier than v10.3.4.45 or v9.15.2.70.

The firm also said vendor hotfixes are available. CISA, for its part, added both vulnerabilities to the KEV catalog after detecting active exploitation.

What other flaws did CISA add to the KEV catalog?

Along with the flaws in PAN-OS, Cisco and AhsayCBS, CISA added CVE-2016-3081 in Apache Struts, CVE-2015-5477 in ISC BIND, CVE-2015-3306 in ProFTPD, CVE-2021-3199 in ONLYOFFICE Docs Server and CVE-2023-22894 in Strapi, after reports of confirmed abuse.

The addition of these cases expands the set of products where the US agency detected exploitation or confirmed abuse, with direct impact on enterprise and infrastructure environments.