Government Advisory

CISA Flags Four Actively Exploited Flaws in Palo Alto, Cisco and Ahsay Products

CISA · 14 Oct 2026

Key Takeaway Check whether you run PAN-OS, Cisco Secure Email Gateway or AhsayCBS, apply the vendor patches as a priority, and look for signs of compromise on any internet-facing system that went unpatched.

The US Cybersecurity and Infrastructure Security Agency (CISA) has added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence that attackers are already using them. The flaws are CVE-2026-0322, a code injection issue in Palo Alto Networks PAN-OS; CVE-2026-76519, a relative path traversal issue in Cisco Secure Email Gateway; and two Ahsay AhsayCBS issues, CVE-2026-105133 (improper authentication) and CVE-2026-105134 (command injection).

CISA says these types of vulnerabilities are a frequent attack vector for malicious cyber actors. Its Binding Operational Directive 26-04 requires US federal civilian agencies to prioritise rapid fixes for KEV-listed vulnerabilities on publicly exposed assets that give an attacker total control after exploitation. It also sets basic expectations for checking whether a system was compromised before the patch was applied.

The directive applies only to federal agencies, but CISA encourages all organisations to adopt risk-based vulnerability management and to prioritise remediation of KEV Catalog vulnerabilities. Australian businesses using any of these products should treat the listings as a prompt to review their exposure.

CISA KEV Palo Alto Networks Cisco Ahsay Patch Management

Summarised by CISO AI from CISA, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.