CISA KEV Adds Actively Exploited Edge Flaws: PAN-OS, Fortinet, BeyondTrust, Cisco, Ahsay

CISA KEV adds actively exploited PAN-OS, Fortinet, BeyondTrust, Cisco, Ahsay flaws. Patch edge devices, restrict management, hunt now.

• CISA added multiple actively exploited flaws to its KEV catalog, including PAN-OS RCE CVE-2026-0322, Fortinet path traversal CVE-2025-61624, BeyondTrust Remote Support auth bypass CVE-2026-102764, plus Cisco Secure Email Gateway and AhsayCBS issues.
• Affected: internet-facing firewalls, VPN gateways, remote support tools, and email gateways used by schools and government.
• Impact: remote code execution, authentication bypass, and path traversal on edge systems; KEV listing means exploitation is confirmed—verify exact vectors and fixes with vendor advisories.

What to do now

1. Inventory all PAN-OS, FortiOS/FortiPAM/FortiProxy/FortiSwitchManager, BeyondTrust Remote Support, Cisco Secure Email Gateway, AhsayCBS, F5, and Juniper devices; record versions, internet exposure, and management access paths.
2. Apply vendor patches or mitigations immediately, prioritizing internet-facing and KEV-listed systems; if no patch exists, isolate or disable affected services and restrict access to trusted networks, VPN, or IP allowlists.
3. Lock down management interfaces: block public access, enforce MFA and least privilege, set strict session timeouts, and segment management traffic from general network traffic.
4. Hunt for exploitation: review logs for unusual command execution, path traversal attempts, authentication bypass or spoofing, new admin accounts, anomalous VPN sessions, and unexpected outbound connections; ingest vendor IoCs.
5. If compromise is suspected, preserve evidence, contain affected devices, rotate credentials and secrets, engage incident response, and follow district breach notification procedures; track CISA KEV and vendor advisories for deadlines.

Related items

• CISA flags exploited flaws in Palo Alto, Cisco and Ahsay products
• U.S. CISA adds Palo Alto Networks PAN-OS, Ahsay AhsayCBS, and Cisco Secure Email Gateway flaws to its Known Exploited Vulnerabilities catalog
• Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation
• Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution
• BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs
• PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions
• F5, Juniper Networks Patch Critical Vulnerabilities
• CISA Adds Two Known Exploited Vulnerabilities to Catalog