CISA Adds Four Actively Exploited Vulnerabilities to KEV Catalog

On October 14, 2026, CISA updated its Known Exploited Vulnerabilities (KEV) Catalog to include four vulnerabilities that have been identified as being actively exploited in the wild. The newly added vulnerabilities affect widely used enterprise and network security infrastructure, specifically Palo Alto Networks PAN-OS (CVE-2026-0322), Cisco Secure Email Gateway (CVE-2026-76519), and Ahsay AhsayCBS (CVE-2026-105133, CVE-2026-105134).

These vulnerabilities represent a diverse set of attack vectors, ranging from improper authentication and path traversal to remote code execution via command and code injection. Given their presence in the KEV catalog and evidence of active exploitation, these flaws pose a significant risk to organizational environments. In accordance with Binding Operational Directive (BOD) 26-04, federal agencies are required to prioritize the remediation of these vulnerabilities on internet-facing assets. All organizations are encouraged to review their inventory against these CVEs and prioritize patching to prevent unauthorized access or system takeover.

Impact

Successful exploitation of these vulnerabilities can lead to unauthorized access, total control of the affected asset, or remote command execution. Targeted sectors include organizations relying on Cisco email infrastructure, Palo Alto network perimeters, and Ahsay backup solutions. The volume of victims remains internal to organizational risk management reports, but the inclusion in the CISA KEV catalog confirms these are being used as viable initial access or lateral movement vectors by malicious actors.

Recommendation

• Prioritize remediation for CVE-2026-0322, CVE-2026-76519, CVE-2026-105133, and CVE-2026-105134 across all internet-facing and internal assets immediately.
• Review network egress and ingress logs for signs of anomalous traffic or unauthorized command execution related to these products.
• Implement risk-based vulnerability management practices as outlined in BOD 26-04, focusing on assets that grant total control post-exploitation.
• Conduct a compromise assessment to determine if these assets were accessed by unauthorized actors prior to the application of security patches.