Recommended Free Tools
CISA’s Known Exploited Vulnerabilities (KEV) Catalog recorded four entries on October 14, 2026 involving Palo Alto Networks PAN-OS, Cisco Secure Email Gateway and Ahsay AhsayCBS. Every entry is marked High urgency, and a KEV listing means CISA has evidence that attackers are exploiting the flaw—not merely that a proof of concept exists.
Patch the instances that are reachable from the internet or protect sensitive administration, mail or backup infrastructure first. Before and after remediation, check for signs of compromise. The available catalog summary does not provide affected-version ranges, fixed builds, CVSS scores, victim counts or exploitation volumes, so those details must come from the relevant vendor security advisories.
![Palo Alto PA-220 8-Port Next Gen Firewall Security Appliance w/ Power Adapter [No License] (Renewed)](https://m.media-amazon.com/images/I/21Q+X1-LrNL._SL160_.jpg)
As an Amazon Associate I earn from qualifying purchases.
The four CVEs added on October 14, 2026
The update covers three named products and four vulnerabilities. AhsayCBS appears twice because two separate flaws were added for the same backup platform.
| CVE | Product and vendor | Vulnerability class | Urgency | Exposure and authentication details | Fixed version or mitigation | Exploitation evidence |
|---|---|---|---|---|---|---|
| CVE-2026-0322 | PAN-OS, Palo Alto Networks | Code injection | High | Not stated in the catalog summary; do not infer prerequisites from the vulnerability label. | Not stated in the catalog summary; use the Palo Alto Networks security advisory for the affected and fixed releases. | Listed in CISA KEV based on evidence of active exploitation. |
| CVE-2026-76519 | Cisco Secure Email Gateway, Cisco | Relative-path traversal | High | Not stated in the catalog summary; confirm authentication and exposure requirements in Cisco’s advisory. | Not stated in the catalog summary; obtain the fixed release and mitigation from Cisco. | Listed in CISA KEV based on evidence of active exploitation. |
| CVE-2026-105133 | AhsayCBS, Ahsay | Improper authentication | High | Not stated in the catalog summary; verify the affected interfaces and authentication conditions with Ahsay. | Not stated in the catalog summary; follow the AhsayCBS security advisory. | Listed in CISA KEV based on evidence of active exploitation. |
| CVE-2026-105134 | AhsayCBS, Ahsay | Command injection | High | Not stated in the catalog summary; do not assume that exploitation requires a particular account or network position. | Not stated in the catalog summary; use Ahsay’s advisory for fixed builds and workarounds. | Listed in CISA KEV based on evidence of active exploitation. |
Why a KEV entry changes the response
KEV is an operational signal. CISA adds a vulnerability when it has evidence of exploitation in the wild, so defenders should treat these four CVEs as incidents requiring prioritized action rather than as routine backlog items. The catalog is designed to help organizations order remediation by risk.
#1 Best Overall
CISA’s broader guidance says that Binding Operational Directive 26-04 applies only to federal civilian executive branch agencies, while all organizations are encouraged to use risk-based vulnerability management and prioritize KEV vulnerabilities. A September 14, 2026 CISA GovDelivery bulletin states: “CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.” That bulletin is separate from the four October 14 index additions, but its explanation of the catalog’s purpose applies to this response.
What the four vulnerability classes mean for investigation
PAN-OS code injection
Code injection generally means attacker-controlled input can be interpreted as code by the product. For PAN-OS, examine management-plane access, administrator activity, configuration changes and unusual outbound connections. A vulnerable appliance that is exposed to the internet deserves immediate attention, but the exact exploit path and authentication requirements must be confirmed in Palo Alto Networks’ advisory.
Rank #2
![Palo Alto Software Palo Alto 3050 [PA-3050] Network Security Firewall Appliance (Renewed)](https://m.media-amazon.com/images/I/215S7tx0kNL._SL160_.jpg)
- Item Package Quantity - 1
- Product Type - ELECTRONIC SWITCH
- This pre-owned product has been professionally inspected, tested and cleaned by Amazon qualified vendors.
- Accessories may not be original, but will be compatible and fully functional. Product may come in generic box.
Cisco Secure Email Gateway relative-path traversal
Path traversal flaws can let an attacker reach files outside an intended directory by manipulating a path. Review web, administration and system logs for abnormal path requests, unexpected file access or newly created files, then compare appliance configurations and software integrity with a known-good baseline. Do not assume from the class name alone whether a login is required or which interfaces are reachable.
AhsayCBS improper authentication
An authentication flaw can allow access without the checks the application is supposed to enforce. Treat AhsayCBS instances that manage backup jobs, repositories or administrative accounts as high-impact assets. Review successful and failed logins, account creation or privilege changes, API activity and access to backup data. Confirm the affected component and fixed build with Ahsay before changing production systems.
Rank #3
AhsayCBS command injection
Command injection can allow an attacker to cause operating-system commands to run through application input. Investigate unexpected jobs, scripts, processes, scheduled tasks, outbound connections and changes to backup repositories or service accounts. Because this is a separate CVE from the improper-authentication issue, patch and investigate both entries even when they affect the same AhsayCBS deployment.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to patch first
There is no evidence in the available CISA summary that one of the four CVEs has a higher exploitation rate than the others. Use exposure and business impact to set the order:
- Identify internet-facing instances. Inventory PAN-OS appliances, Cisco Secure Email Gateway systems and AhsayCBS servers, including systems behind reverse proxies, load balancers or remote-access gateways. Record product versions, management interfaces and the data or privileges each system controls.
- Move exposed, high-impact systems to the front of the queue. Prioritize an internet-reachable management interface, mail gateway or backup server over an isolated test instance. Among systems with similar exposure, remediate the one protecting the most sensitive data or administrative authority first.
- Apply the vendor’s exact fix. Retrieve the current Palo Alto Networks, Cisco or Ahsay advisory and verify the affected-version range, fixed release, upgrade prerequisites and any temporary mitigation. The catalog summary does not supply those version numbers, so guessing a patch level can leave an appliance vulnerable or cause an avoidable outage.
- Contain while a change window is prepared. Restrict administrative interfaces to trusted networks, remove unnecessary internet exposure, enforce strong administrator authentication where supported, and follow the vendor’s documented workaround. Treat these measures as temporary risk reduction, not a substitute for the fixed release.
- Investigate before and after remediation. Preserve relevant logs, review activity for the vulnerability’s product and class, and look for unauthorized accounts, configuration changes, files, processes, commands or outbound traffic. If indicators appear, isolate the system and activate incident-response procedures instead of simply patching and closing the ticket.
- Validate and document. Confirm the running build after the upgrade, test mail flow, firewall policy or backup operations as appropriate, and record the asset, CVE, installed fix, evidence reviewed and any residual exposure.
What the public record does not establish
The October 14 entries do not publish a victim count, exploitation volume, percentage of affected deployments, CVSS score or product-version range. They also do not, by themselves, establish whether exploitation requires authentication, a particular network position or a specific configuration. Those facts should be taken from the corresponding vendor advisories, not inferred from “code injection,” “path traversal,” “improper authentication” or “command injection.”
Practical takeaway for security teams
Put all four CVEs into the emergency remediation workflow because CISA’s KEV designation is evidence of active exploitation. Start with exposed and high-impact assets, investigate for compromise, and use vendor documentation to select the exact fixed release. Federal civilian executive branch agencies must follow the deadlines and requirements of the applicable directive; other organizations should apply the same risk-based prioritization principle to their own environments.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
