On 14 October 2026, the US Cybersecurity and Infrastructure Security Agency added four vulnerabilities to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. The entries affect Palo Alto Networks PAN-OS, Cisco Secure Email Gateway, and Ahsay AhsayCBS, and the alert sets out who must follow Binding Operational Directive 26-04: Federal Civilian Executive Branch agencies, with other organisations urged to prioritise the catalog through risk-based management.

The four flaws

The October 14 alert names CVE-2026-0322, code injection in the management interface of Palo Alto Networks PAN-OS; CVE-2026-76519, relative path traversal in Cisco Secure Email Gateway; CVE-2026-105133, improper authentication in Ahsay AhsayCBS; and CVE-2026-105134, command injection in AhsayCBS. Help Net Security reported that US federal civilian agencies were due to address the four vulnerabilities by 17 October 2026. That reported deadline is for those agencies; CISA's guidance to other organisations is to prioritise the catalog through their own risk-based management.

Why this set matters

The affected product set reads like an attacker's perimeter wish list: a next-generation firewall that terminates VPN and SSL decryption, an email gateway that sits at the front door of mail flow, and a backup platform that, by design, holds copies of everything that matters. Edge appliances and backup infrastructure are often unmonitored, under-patched and trusted by everything behind them, which is why advanced actors target them first.

KEV inclusion means threat actors are exploiting these bugs against real targets right now, not in theory. If you run any of the three product families, check your version against the vendor's fixed release, look for signs of compromise on internet-facing management interfaces, and treat the federal deadline as your floor, not someone else's problem. This article is a patch alert, not a substitute for the vendor's advisory for your exact build.