The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added four vulnerabilities to its Known Exploited Vulnerabilities catalog last week, covering products from Cisco, Palo Alto Networks and Ahsay. The Cisco flaw is rated 9.8 out of 10 and can give an attacker root access to an email security gateway. Federal civilian agencies had until October 17 to patch, and every organization running the affected products should treat that deadline as a guide to urgency.

The three vendors face different problems. Cisco has confirmed active exploitation, Palo Alto says attacks have been very limited, and Ahsay has admitted that its first patches did not fully work.

Cisco Secure Email Gateway: a critical path traversal

CVE-2026-76519 is a critical relative path traversal flaw in the Advanced Malware Protection feature of Cisco Secure Email Gateway. A crafted email attachment can let an attacker write arbitrary files to the system and run commands as root. The flaw carries a CVSS score of 9.8.

Two conditions apply. The File Reputation service must be enabled and assigned to a mail policy, and Content Scanner Tools must be earlier than version 25.3.0.5525. Cisco’s Product Security Incident Response Team became aware of active exploitation in October 2026.

For releases older than AsyncOS 16.5, Cisco says to migrate to 16.5.0-780. Content Scanner Tools 25.3.0.5525 or later also fixes the flaw without a restart. Cisco says no workarounds exist.

Detection is harder than patching. Because root access lets an attacker erase local evidence, administrators should check external network and firewall logs for unexpected uploads to outside IP addresses rather than relying on the gateway’s own records.

Palo Alto PAN-OS: root access, limited exploitation

CVE-2026-0322 is a high-severity remote code execution bug in the management interface of PAN-OS. An authenticated attacker with network access can run code as root. The flaw has a CVSS score of 8.6 and affects PA-Series, VM-Series and Panorama. Cloud NGFW and Prisma Access are not affected.

Palo Alto says exploitation has been very limited, and its advisory lists three IP addresses tied to attempts. The company’s own researcher, Suraj Siddharudh, found the flaw internally. Fixed releases exist for PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2. Palo Alto says there are no workarounds, but restricting management interface access to trusted internal IP addresses reduces the risk.

Ahsay AhsayCBS: a chain with an incomplete patch

The Ahsay problem involves two flaws used together. CVE-2026-105133 is a medium-severity authentication bypass. CVE-2026-105134 is a critical command injection bug. Attackers chain them: the first gets past authentication, and the second runs code with SYSTEM privileges.

Attackers are planting webshells and cryptominers on internet-facing servers. Security firm Huntress documented the attacks on October 8. Ahsay’s October 12 alert then admitted that earlier patches, versions 9.15.2.59 and 10.3.4.0, did not fully fix the flaws.

Administrators should install version 10.3.4.45 for the v10 line, or 9.15.2.70 for versions 7, 8 and 9, and then reboot. Huntress testing says the v10.3.4.45 hotfix blocks the chain’s initial entry point.

What security teams should do now

The common thread is internet-facing infrastructure: an email gateway, a firewall management interface and a backup server. Each sits at a trust boundary, and a compromise gives an attacker a strong foothold.

Teams should take four steps. Check whether any of the affected products are in the environment. Apply the fixed versions, noting that the Ahsay fix supersedes earlier patches. Limit management interface exposure, which Palo Alto recommends and which helps for all three. And hunt for signs of compromise, using external logs for the Cisco case and checks for webshells and miners for Ahsay.

Prioritization follows the evidence. The Cisco flaw comes first, because it is critical, confirmed as exploited and has no workaround. The Ahsay chain is second, since attackers are already installing webshells and miners. The Palo Alto bug is third, though restricting management access is a cheap step that teams can take immediately.

What it says about the vendor landscape

The advisories show different responses from vendors. Cisco has acknowledged active exploitation and offered a patch but no workaround, so delay means exposure. Palo Alto reports limited exploitation and found the flaw itself, which reduces the urgency but not the need to restrict access. Ahsay’s case is the most troubling, because an incomplete fix left customers exposed after they had applied what they believed was the cure.

CISA also issued a separate patching alert for Ivanti Connect Secure on October 13, which suggests the problem extends across the industry and is not limited to one supplier. For buyers, the practical lesson is to weigh how quickly a vendor ships complete fixes and how clearly it communicates exploitation status.

The October 17 federal deadline has passed, but private organizations are not bound by it. The catalog’s value is that it marks flaws attackers are already using, and those deserve patching first.