THE U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four newly observed vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The list comprises CVE-2026-0322 (Palo Alto Networks PAN-OS code injection), CVE-2026-76519 (Cisco Secure Email Gateway relative path traversal), CVE-2026-105133 (Ahsay AhsayCBS improper authentication), and CVE-2026-105134 (Ahsay CBS command injection).
Palo Alto Networks’ PAN-OS flaw affects PA-Series and VM-Series firewalls and Panorama appliances, with limited exploitation seen against the management interface. Cisco’s CVE-2026-76519 is being actively exploited via crafted email attachments to write files on the underlying OS, with a CVSS score of 9.8.
The AhsayCBS issues involve a two‑step chain: an improper authentication bypass (CVE-2026-105133) followed by a command‑injection flaw (CVE-2026-105134) in the Replication Receiver component; by early October 2026 Huntress reported that at least five organisations were targeted, with attackers using the bypass to gain remote code execution and install JSP shells and cryptocurrency miners.
CISA notes federal agencies must address these flaws under BOD 22‑01, with a due date of 17 October 2026, and private organisations are advised to review the KEV catalog and apply the pertinent updates. The article confirms exploitation activity in the wild for the Cisco vulnerability and provides specific incident details for AhsayCBS, including observed chains that achieve NT AUTHORITY\SYSTEM access and subsequent deployment of miners. Palo Alto Networks also recommends restricting management‑interface access to trusted internal IPs and applying updates.