Skip to content
CISA Adds Critical Vulnerabilities in PAN-OS, Cisco, and Ahsay to KEV Catalog

CISA Adds Critical Vulnerabilities in PAN-OS, Cisco, and Ahsay to KEV Catalog

First seen 15 Oct 2026, 23:39 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 16, 2026 at 00:38 UTC
  • •CISA added four critical vulnerabilities to its KEV catalog on October 14, 2026.
  • •CVE-2026-76519 and CVE-2026-105134 are actively exploited, allowing remote code execution.
  • •Federal agencies must remediate these vulnerabilities by October 17, 2026.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including critical flaws in Palo Alto Networks PAN-OS, Cisco Secure Email Gateway, and AhsayCBS. The vulnerabilities are CVE-2026-0322 (high-severity code injection), CVE-2026-76519 (critical relative path traversal), CVE-2026-105133 (improper authentication), and CVE-2026-105134 (critical command injection). Active exploitation has been confirmed for these vulnerabilities, particularly CVE-2026-76519 and CVE-2026-105134, which have been used to deploy web shells and cryptocurrency miners. Ahsay customers are specifically advised to address these vulnerabilities due to previous patches failing to fully mitigate the issues. Federal agencies have until October 17, 2026, to remediate these vulnerabilities. The vulnerabilities were added to the KEV catalog on October 14, 2026, based on evidence of active exploitation.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-04
CVE-2026-105133 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-04
CVE-2026-105134 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-14
CISA adds vulnerabilities to KEV catalog
CISA added four vulnerabilities, including CVE-2026-0322 and CVE-2026-76519, to its KEV catalog due to active exploitation.
Ground.News
2026-10-15
First public PoC for CVE-2026-0322
The first public proof-of-concept for the high-severity code injection vulnerability in PAN-OS was released.
Securityaffairs
2026-10-15
First public PoC for CVE-2026-76519
The first public proof-of-concept for the critical relative path traversal vulnerability in Cisco Secure Email Gateway was released.
Securityaffairs

More articles in this cluster (3)

Following this threat?

Track XMRig and CVE-2026-0322 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (20)

1 / 4

Common questions

Which products are affected by these vulnerabilities?
The vulnerabilities affect Palo Alto Networks PAN-OS, Cisco Secure Email Gateway, and AhsayCBS.
What is the deadline for remediation?
Federal agencies must remediate these vulnerabilities by October 17, 2026.
How are attackers exploiting these vulnerabilities?
Attackers are exploiting these vulnerabilities to execute arbitrary code, deploy web shells, and install cryptocurrency miners.