CISA Flags Four Actively Exploited Flaws in PAN-OS, Cisco Email Gateway, AhsayCBS

En bref

• CISA added four CVEs to its Known Exploited Vulnerabilities catalog on October 14, 2026.
• Affected products: Palo Alto Networks PAN-OS, Cisco Secure Email Gateway, and Ahsay AhsayCBS.
• Hostile actors are already exploiting these flaws, creating federal enterprise risk.
• Agencies must remediate rapidly based on risk and apply vendor security updates.

On October 14, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) placed four security flaws on its Known Exploited Vulnerabilities (KEV) list. The affected products are Palo Alto Networks PAN-OS, Cisco Secure Email Gateway, and Ahsay AhsayCBS. The CVEs are CVE-2026-0322, CVE-2026-76519, CVE-2026-105133, and CVE-2026-105134. Hostile actors are already leveraging these weaknesses in the wild.

Federal agencies and any organization running these platforms face immediate exposure. Because the vulnerabilities are under active attack, the risk extends beyond government networks to contractors, schools, and private sector partners that rely on the same technology. For K-12 districts in New Brunswick and elsewhere, internet-facing email gateways and backup appliances are common targets.

The KEV designation carries binding operational directives for U.S. federal civilian agencies, requiring them to patch within set timeframes. Even for non-federal entities, the message is clear: treat these four CVEs as urgent. CISA, along with Palo Alto Networks, Cisco, and Ahsay, has released security updates. Applying them based on risk and exposure is the fastest way to reduce the attack surface.

This event underscores a broader trend: adversaries continue to weaponize known flaws before many defenders can respond. The October 2026 deadline for federal remediation highlights how quickly vulnerability management requirements can shift. Organizations should verify whether their PAN-OS, Secure Email Gateway, or AhsayCBS instances are vulnerable and confirm patch levels.

What to watch: further exploitation reports, additional CVEs from the same vendors, and whether the KEV deadlines are met. IT teams should monitor vendor advisories and CISA updates closely, and be prepared to isolate or mitigate affected systems if patching is delayed.

À faire maintenant

1. Immediately inventory all PAN-OS, Cisco Secure Email Gateway, and AhsayCBS instances; identify versions and internet exposure.
2. Apply vendor-provided security updates for CVE-2026-0322, CVE-2026-76519, CVE-2026-105133, and CVE-2026-105134 without delay.
3. If patching cannot be completed immediately, isolate affected systems or disable vulnerable services until fixes are deployed.
4. Review logs for signs of exploitation and hunt for indicators of compromise tied to these CVEs.
5. Enforce multi-factor authentication and least privilege on all affected platforms.
6. Subscribe to CISA KEV and vendor advisories for updated remediation deadlines and new flaws.
7. Report suspected incidents to CISA or local cyber authorities.

Références CVE

• CVE-2026-0322
• CVE-2026-76519
• CVE-2026-105133
• CVE-2026-105134

Source originale

CISA Advisories