Four actively exploited vulnerabilities land on CISA's patch-now list, with a three-day federal deadline
CISA added flaws in Palo Alto PAN-OS, Cisco Secure Email Gateway, and Ahsay backup software to its KEV catalog on October 14, giving federal agencies until October 17 to patch.
On October 14, the Cybersecurity and Infrastructure Security Agency added four vulnerabilities to its Known Exploited Vulnerabilities catalog, and the trio of products involved reads like a map of where attackers actually live: the flaws cover Palo Alto Networks’ PAN-OS, Cisco’s Secure Email Gateway, and Ahsay’s AhsayCBS backup software. Federal agencies now have until October 17, 2026 to patch all four — a deadline that, in this case, lands three days after the listing itself. That compressed window is the standard mechanism, but it never stops feeling aggressive when the vulnerabilities in question are already being used against real organizations.
The most severe of the four is CVE-2026-76519, a path traversal flaw in Cisco’s Secure Email Gateway with a CVSS score of 9.8. What makes it genuinely dangerous rather than merely high-numbered is the delivery mechanism: an attacker can achieve root command execution through a crafted email attachment, which means the exploit arrives the way everything else arrives in an email gateway — uninvited, and by design. Cisco has confirmed the flaw is being actively exploited, which is the confirmation that drives a KEV listing in the first place: these aren’t vulnerabilities an agency believes someone could weaponize, they’re ones someone already has.
The AhsayCBS pair — CVE-2026-105133, an authentication bypass, and CVE-2026-105134, a command injection — are being used as a chain rather than individually, chained together to gain SYSTEM privileges, deploy JSP webshells, and drop XMRig cryptocurrency miners onto compromised systems. The combination is telling: a webshell for persistence, a miner for monetization, and a backup product as the entry point. Security software that sits on every machine in an environment with credentials to read all of it has become one of the most reliable initial access vectors in the field, and backup infrastructure is exactly that kind of software.
The exploitation is not theoretical, and it predates the catalog listing. Huntress observed attacks against at least five organizations by October 8, six days before CISA formalized the listings — a reminder that the KEV catalog is a lagging indicator by construction. By the time a flaw makes the list, the organizations already dealing with it didn’t get a heads-up; they got an incident.
The Palo Alto entry, CVE-2026-0322, is a code injection flaw in the PAN-OS management interface with a CVSS score of 8.6, with limited exploitation observed so far. “Limited” is doing quiet work in that sentence. Management interfaces on firewalls and gateways are the single most consequential attack surface a network exposes — compromise one and the device meant to be watching the traffic becomes the thing you have to watch — which is why edge-device vulnerabilities from vendors like Palo Alto and Cisco have dominated recent KEV additions and why even a modest exploitation count justifies the listing.
The October 17 deadline comes from BOD 22-01, the binding operational directive that requires federal civilian agencies to remediate anything on the catalog within a fixed window. The directive is one of the few mechanisms in security that converts a threat intelligence signal into an actual organizational obligation with a date attached, and its premise is straightforward: if a vulnerability is confirmed to be in use by attackers, the calculus that lets patching wait for a convenient maintenance cycle no longer applies. For a flaw like the Cisco one — root execution, via email, on the appliance that handles an organization’s mail — it’s hard to argue with the premise.
The pattern across all four is worth sitting with. None of them are desktop software, none are niche applications; they’re a firewall OS, a mail gateway, and backup infrastructure — the load-bearing perimeter and recovery layer of a typical network. Attackers have figured out that the most efficient place to break in is the security product itself, and this batch of listings is what that conclusion looks like when an agency turns it into paperwork.