CISA flags actively exploited flaws in Palo Alto PAN-OS, Cisco Secure Email Gateway and Ahsay backup
Firewalls, email gateways and backup servers sit at the trust boundaries attackers most want to own, and backup compromise directly undermines ransomware recovery. A deadline of days rather than weeks is CISA's signal of urgency, and private-sector teams should match it. Where immediate patching is not possible, restricting firewall management interfaces to trusted networks is a practical interim control.
What Happened
CISA added four vulnerabilities to its KEV catalog on evidence of active exploitation: CVE-2026-0322 in Palo Alto Networks PAN-OS, CVE-2026-76519 in Cisco Secure Email Gateway, and CVE-2026-105133 and CVE-2026-105134 in Ahsay AhsayCBS. US federal civilian agencies have until 17 October 2026 to address them. Help Net Security reported that the PAN-OS flaw carries a CVSS score of 8.6 and affects the management interface, and that the Cisco flaw can be exploited by sending an email with a crafted attachment through an affected device.
Why It Matters
Firewalls, email gateways and backup servers sit at the trust boundaries attackers most want to own, and backup compromise directly undermines ransomware recovery. A deadline of days rather than weeks is CISA's signal of urgency, and private-sector teams should match it. Where immediate patching is not possible, restricting firewall management interfaces to trusted networks is a practical interim control.
Sources
- Cybersecurity and Infrastructure Security Agency (opens in a new tab): CISA Adds Four Known Exploited Vulnerabilities to Catalog (2026-10-14)
- Help Net Security (opens in a new tab): CISA flags exploited flaws in Palo Alto, Cisco and Ahsay products (2026-10-15)
More From This Briefing
- EU AI Office opens first AI Act enforcement test over OpenAI and Anthropic agent incidents
- CISA urges immediate patching of exploited Ivanti Connect Secure flaw that may evade Ivanti's own integrity tool
- CISA adds actively exploited Microsoft Windows command injection flaw CVE-2026-96951 to KEV catalog
- Virginia bill proposes three-year statewide moratorium on data centre approvals from July 2027
This story is part of the Laurenceo Intelligence briefing for 16 October 2026, a daily sourced briefing on AI, technology and enterprise risk published in Bermuda by Laurenceo, founded by Jorai Laurenceo. It is produced by an automated research pipeline and checked before publication; how this is made. General information only, not legal, regulatory or financial advice.