Four Exploited Flaws Hit the Firewall, the Mail Gateway, and the Backup Server

Four trusted boxes, four open doors

The Cybersecurity and Infrastructure Security Agency (CISA) keeps the Known Exploited Vulnerabilities (KEV) catalog. On October 14, 2026, CISA added four flaws to that catalog. Each one had evidence of active exploitation.

The four flaws do not hit office laptops. They hit the boxes that guard everything else. A firewall, an email gateway, and a backup server all appear in one batch.

Binding Operational Directive (BOD) 26-04 covers Federal Civilian Executive Branch (FCEB) agencies. Reporting on the catalog entries gives those agencies a due date of October 17, 2026. CISA urges every other organization to treat KEV entries as a priority too.

The firewall flaw

CVE-2026-0322 is a code injection flaw in the PAN-OS management interface. PAN-OS runs Palo Alto Networks firewalls. An authenticated attacker with network access can run code as root.

The Common Vulnerability Scoring System (CVSS) score is 8.6 under version 4.0. Palo Alto Networks says it saw very limited exploitation. The flaw affects PA-Series and VM-Series firewalls, plus Panorama appliances. Cloud NGFW and Prisma Access are not affected.

No workaround exists for this flaw. The vendor tells customers to upgrade to a fixed release. Until then, restrict management access to trusted internal addresses only.

The email gateway flaw

CVE-2026-76519 is a relative path traversal flaw in Cisco Secure Email Gateway. It sits in the Advanced Malware Protection (AMP) feature. The flaw mishandles attachments when the file reputation service is on.

This one needs no login at all. An attacker sends one email with a crafted attachment. A successful attack writes files and runs commands as root. The CVSS score is 9.8 under version 3.1.

Exposure depends on two settings. File Reputation must sit in a mail policy. The Content Scanner Tools package must be older than 25.3.0.5525. Cisco says no workaround exists, and the fixed tools package is the fix.

The backup server pair

CVE-2026-105133 is an improper authentication flaw in Ahsay AhsayCBS. It sits in the checkSysPwd function of the server software. Its CVSS score is 5.5 under version 4.0.

CVE-2026-105134 is a command injection flaw in the same product. It sits in the Replication Receiver endpoint. Its CVSS score is 9.3 under version 4.0.

Attackers chain the pair in order. The first flaw bypasses authentication on the console. The second runs commands with SYSTEM level access. Huntress observed exploitation starting October 7, 2026.

Post attack activity included web shells on servers. Attackers also planted XMRig cryptocurrency miners disguised as Microsoft Edge. Ahsay says its earlier patches did not fully fix either flaw. The current hotfixes are 10.3.4.45 for version 10, and 9.15.2.70 for versions 7 through 9.

The governance lesson

Edge and security appliances often sit outside normal patch cycles. Teams patch servers and laptops on a schedule. The firewall and mail gateway wait for a maintenance window. The backup server waits even longer.

That habit is the risk in this story. These boxes hold trusted positions and broad access. A backup server holds copies of the data itself. An email gateway sees every message that enters. A firewall decides what traffic may pass.

Governance means the inventory names these boxes plainly. It means each one carries an owner and a patch clock. It also means patch records show the fixed build, not just effort. PolicyCortex does not patch these appliances. Your team or your vendor applies the vendor fix.

What to do this week

List every PAN-OS, Secure Email Gateway, and AhsayCBS system you run. Compare each build against the vendor fixed versions. Patch the exposed systems first, before routine work.

Then check for compromise before you close the ticket. Root access can remove local logs and leave hidden access. Use network logs and outside records where you can. Record the build, the patch date, and the check result.

Sources

• CISA alert, CISA Adds Four Known Exploited Vulnerabilities to Catalog, October 14, 2026. https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog
• CISA Known Exploited Vulnerabilities Catalog. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CVE-2026-0322 record, CVE Program, updated October 14, 2026. Palo Alto Networks advisory at https://security.paloaltonetworks.com/CVE-2026-0322
• CVE-2026-76519 record, CVE Program, updated October 14, 2026. Cisco advisory cisco-sa-esa-afw-zqYJkjxp at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp
• CVE-2026-105133 record, CVE Program.
• CVE-2026-105134 record, CVE Program, updated October 4, 2026.
• Huntress, Threat Actors Exploit Critical AhsayCBS Flaws, October 2026. https://www.huntress.com/blog/ahsaycbs-flaws-exploit
• Original diagram by PolicyCortex.

Next step

Want appliance patch evidence collected on a schedule, not by spreadsheet? See how PolicyCortex reads it from the live tenant.