Cisco, Ahsay, Palo Alto: 4 CVEs Added to CISA KEV Oct 14

CISA added four CVEs from three vendors to its Known Exploited Vulnerabilities (KEV) catalog on October 14, 2026, all with the same due date of October 17: Cisco Secure Email Gateway (CVE-2026-76519), AhsayCBS (CVE-2026-105133 and CVE-2026-105134), and Palo Alto Networks PAN-OS (CVE-2026-0322). Each product sits in the middle of an organization's operations: an email gateway, a backup server, and a firewall.

All of them were exploited before a complete fix existed. Cisco and Palo Alto shipped fixes with their October 14 advisories. Ahsay's first patch turned out not to close its flaws, and hotfixes arrived between October 10 and 12.

Cisco Secure Email Gateway: CVE-2026-76519

Cisco describes an arbitrary file write flaw (CWE-23) in the Advanced Malware Protection (AMP) feature. When File Reputation is on, the gateway mishandles certain email attachments, and an unauthenticated remote attacker who sends a crafted attachment can write files on the underlying operating system. Command execution as root can follow. Cisco scores it 9.8 (Critical).

An appliance is exposed when both conditions hold: File Reputation is enabled and assigned to a mail policy, and the Content Scanner Tools package is older than 25.3.0.5525. Physical and virtual gateways are in scope. Cisco Secure Email and Web Manager and Secure Web Appliance are not affected, and Cisco has already fixed Secure Email Cloud Gateway.

Cisco says its PSIRT became aware of active exploitation in October 2026 and that a limited number of customers are affected. It has not said how many appliances were compromised or what the attackers did next, and no attacker has been named. The company found the flaw during internal security scanning and reports no workarounds.

The fix comes in two forms: AsyncOS 15.5.5-014 or 16.5.0-780, with 16.0 customers asked to migrate, or Content Scanner Tools 25.3.0.5525 or later, which installs without a full upgrade or a restart. This is the second Secure Email Gateway zero-day in about two months, after CVE-2026-76461 in September.

AhsayCBS: CVE-2026-105133 and CVE-2026-105134

Attackers chain two flaws in AhsayCBS, the management server for Ahsay's backup software. CVE-2026-105133 is an improper authentication flaw in the checkSysPwd function of the JSON API, scored 7.3 (High). Horizon3.ai's reverse engineering shows that a request body carrying "FromServlet":"Y" skips the password check, which makes every JSON API action reachable without credentials. CVE-2026-105134 is an OS command injection in the Replication Receiver, scored 10.0 (Critical). Horizon3.ai traced it to a path traversal in the replicated-upload service that lets an attacker write a JSP file into the web-served directory. That path requires the target to be configured or licensed as a replication receiver.

Huntress began seeing exploitation on October 7, three days after the CVE records were published, and had counted five targeted organizations by October 8. The attackers chained both flaws, set up a malicious receiver, and dropped JSP webshells. They then used curl and certutil to pull payloads from a cloud storage bucket and installed an XMRig Monero miner disguised as edge.exe. Persistence came from a service named MicrosoftEdgeUpdateSvc running a modified service manager, and a script stopped the miner whenever Task Manager opened. Horizon3.ai notes that a compromised AhsayCBS host puts centrally managed backup policies, storage, and users at risk.

The patch story needs care. Early reporting said the flaws were fixed in 10.3.2, and some databases say 10.3.4 resolves them. Huntress found 10.3.4 still vulnerable, and Ahsay confirmed that earlier patches, 9.15.2.59 and 10.3.4.0, did not fully address the flaws. The remediation is a hotfix: 10.3.4.45 for v10, and 9.15.2.70 for v9, with v7 and v8 first moving to 9.15.0.0. Hotfix downloads need an Ahsay partner portal account, and the server must reboot afterward. Horizon3.ai independently confirmed that 10.3.4.45 blocks the authentication bypass used as the entry point.

Palo Alto PAN-OS: CVE-2026-0322

A code injection flaw in the PAN-OS management interface lets an authenticated attacker with network access to that interface run arbitrary code as root on the firewall. Palo Alto scores it 8.6 (High) on CVSS 4.0, with high privileges required, which keeps the score below the other three. The advisory lists exploit maturity as attacked, and no special configuration is needed to be affected.

PA-Series and VM-Series firewalls and Panorama (virtual and M-Series) are in scope. Cloud NGFW and Prisma Access are not. Palo Alto says it has seen very limited exploitation against the management interface and published three source addresses: 66.42.72[.]114, 208.83.239[.]114, and 149.248.47[.]234. The flaw was found internally by one of the company's own researchers.

Fixes exist for the 10.2, 11.1, 11.2, 12.1, and 12.2 trains, each with its own minimum hotfix level, such as 12.2.4, 11.1.16-h3, and 10.2.18-h12. The 11.2.16 release carried an expected date of October 15. Older unsupported versions have to move to a supported release. There is no workaround. Threat Prevention signatures 510046 and 510047 offer limited protection and need SSL Decryption, and Palo Alto warns that variations of the attack may slip past them.

Reachability Sets the Risk, and Patch Status Differs

The three products share a role more than a bug class. Each one holds privileged access to something else: mail flow, backup data, or network traffic. What separates them is how an attacker reaches the flaw.

Cisco's flaw arrives by email, so the entry point is any message the gateway is built to accept. Ahsay's chain targets a management console that was reachable from the internet in the cases Huntress saw. Palo Alto's flaw requires valid credentials and network access to the management interface, which is why it carries the lowest score of the four. Palo Alto still reports exploitation, and the due date is the same.

The patch picture differs just as much. Cisco's fix is available now in two forms, and the lighter one needs no restart. Ahsay's first fixes did not hold, and customers need a hotfix that comes through a partner portal. Palo Alto's fixes depend on the maintenance train, with one release still pending on October 15, and no workaround exists for any of the three.

For teams that keep a single "critical first" queue, this batch is a reminder that the score alone sorts the list poorly. A 9.8 reachable through email, a 10.0 on an exposed console, and an 8.6 behind a login all landed on the same deadline.

Reading It on VulnTracker

All four entries show Added to KEV on October 14, 2026 and remediation due October 17, 2026. Ransomware use is listed as unknown for each.

Scores follow the sources the pages show: 9.8 Critical for Cisco (CVSS 3.1), 10.0 Critical for CVE-2026-105134 and 7.3 High for CVE-2026-105133 (VulDB), and 8.6 High for Palo Alto (CVSS 4.0). SSVC reads Active, Automatable, and Total impact for Cisco and for CVE-2026-105134. It reads Active, Automatable, and Partial impact for CVE-2026-105133, and Active, Not automatable, and Total impact for PAN-OS, which fits a flaw that needs credentials. On the two Ahsay pages the EPSS scores are 1.8 percent and 0.4 percent, which shows once more that a low EPSS can sit next to confirmed exploitation.

NVD had not analyzed any of the four when this was written, so the structured platform lists are empty and the Affected Products lists carry the versions. Cisco shows 23 AsyncOS builds and PAN-OS shows five base versions. The AhsayCBS pages list 10.3.0 through 10.3.2, and the vendor and Huntress say 10.3.4.0 is also affected, so check your build against the hotfix levels above.

What to Do Before October 17

Cisco: check whether File Reputation is enabled on a mail policy and run contentscannerstatus on each gateway. If the version is below 25.3.0.5525, run contentscannerupdate or move to 15.5.5-014 or 16.5.0-780. Review firewall logs for unexpected uploads from the gateway, and contact Cisco TAC if you suspect compromise, since a clean result does not rule it out.
Ahsay: apply hotfix 10.3.4.45 on v10 or 9.15.2.70 on v9, and move v7 and v8 to 9.15.0.0 first. Restrict the management interface to trusted addresses or a VPN. Hunt for unexpected JSP files under the webapps directory, an unfamiliar MicrosoftEdgeUpdateSvc service, edge.exe or msedge.exe in temp folders, and unrecognized administrator accounts. Huntress advises re-imaging a confirmed compromised host from a trusted backup, because attackers hid secondary backdoors.
Palo Alto: move each PA-Series, VM-Series, and Panorama system to the fixed release for its train, and block the management interface from untrusted networks. Search logs for the three published source addresses. If you cannot patch today, route management traffic through a data-plane port and apply the Threat Prevention signatures as a partial layer.
For all three: list every instance you run, including forgotten test appliances, and treat exposure of any management interface to the internet as a finding on its own.

Three vendors, three different ways in, and one shared deadline. Patch in order of reachability: the email gateway first, the exposed backup console next, and the firewall management plane right behind them, while you pull every management interface off untrusted networks. Track the vendors you run on VulnTracker, and the next time one of them lands in KEV you will see the due date the day CISA sets it.