CISA Confirms Active Exploitation of Three Critical Flaws in Palo Alto, Ahsay, Cisco

Key points

• Three critical vulnerabilities are under active exploitation.
• Affected products: Palo Alto Networks PAN-OS, Ahsay AhsayCBS, Cisco Secure Email Gateway.
• CISA added them to the KEV catalog this week.
• Federal agencies must patch by mandated deadlines.
• No CVE identifiers were provided, but severity is high.

This week, the Cybersecurity and Infrastructure Security Agency (CISA) expanded its Known Exploited Vulnerabilities (KEV) catalog with three critical flaws that are currently being exploited by threat actors. The affected products are Palo Alto Networks PAN-OS, Ahsay AhsayCBS, and Cisco Secure Email Gateway. CISA's confirmation of exploitation means these are not theoretical risks but active threats.

Organizations using any of these products are at risk. PAN-OS is widely deployed in enterprise firewalls, AhsayCBS is a backup solution, and Cisco Secure Email Gateway is used for email security. Government agencies, critical infrastructure, and private sector entities all rely on these tools, making the impact potentially broad.

The addition to the KEV catalog triggers mandatory remediation timelines for U.S. federal agencies, but all organizations should treat this as a high-priority patching event. The flaws are rated critical, and exploitation has been confirmed, so delays could lead to compromise.

While specific CVE identifiers were not provided in the initial announcement, vendors are expected to release patches or mitigations. Security teams should monitor vendor advisories and CISA's updates for technical details and deadlines.

What to watch: further exploitation activity, additional technical details from vendors, and whether other products are affected. Proactive hunting for indicators of compromise on these systems is recommended.

What to do now

1. Inventory all instances of PAN-OS, AhsayCBS, and Cisco Secure Email Gateway in your environment.
2. Apply vendor patches or mitigations immediately upon release.
3. Monitor network traffic and logs for signs of exploitation.
4. Restrict external access to these systems until patched.
5. Review CISA's KEV catalog entry for specific deadlines and guidance.
6. Enable enhanced logging and alerting on affected products.
7. If patching is delayed, implement compensating controls such as network segmentation.

Original source

Security Affairs