CISA flags exploited flaws in Palo Alto, Cisco and Ahsay products

CISA has added four vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active abuse in the wild, giving federal agencies until October 17, 2026 to remediate. CVE-2026-0322 is an 8.6-rated RCE in the PAN-OS management interface affecting PA-Series and VM-Series firewalls plus Panorama, letting an authenticated attacker gain root; Palo Alto Networks has shipped fixes for 10.2, 11.1, 11.2, 12.1 and 12.2 and recommends restricting management access since no workaround exists. CVE-2026-76519, scoring 9.8, is a path traversal bug in Cisco Secure Email Gateway's AMP file reputation feature that lets a malicious email attachment write files and run commands as root; Cisco urges upgrading to AsyncOS 16.5.0-780 or updating Content Scanner Tools to 25.3.0.5525. Finally, CVE-2026-105133 (authentication bypass) and CVE-2026-105134 (command injection) in Ahsay's AhsayCBS backup console are being chained by attackers, as documented by Huntress, to deploy webshells and cryptominers with SYSTEM privileges — Ahsay has confirmed its earlier patches were incomplete and now pushes hotfixes v10.3.4.45 and v9.15.2.70.