CISA lists exploited flaws in PAN-OS, Cisco Secure Email Gateway and AhsayCBS
Attackers are using all four, and CISA’s three-day deadline for US federal agencies passed on 17 October. Treat any of these products still unpatched as possibly compromised.
Affects
PAN-OS · Cisco · Ahsay
What to do
Patch all three products, restrict PAN-OS management to trusted internal addresses, and reboot AhsayCBS after the hotfix.
- KEV release
- CVEs
- CVE-2026-0322CVE-2026-76519CVE-2026-105133CVE-2026-105134
- CVSS
- 9.8 (v3.1, Cisco, CVE-2026-76519)10 (v3.1, VulDB, CVE-2026-105134, via NVD)8.6 (v4.0, Palo Alto Networks, CVE-2026-0322)7.2 (v3.1, NVD, CVE-2026-0322)7.3 (v3.1, VulDB, CVE-2026-105133, via NVD)
- Exploitation
- Exploited, in the CISA catalogue
- Affected
- PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 before the fixed builds, on PA-Series, VM-Series and Panorama
- Cisco Secure Email Gateway with File Reputation on and Content Scanner Tools before 25.3.0.5525
- AhsayCBS v7 to v10 before the October hotfixes
- Fixed in
- PAN-OS 12.2.4 and the hotfix builds in the vendor advisory
- Content Scanner Tools 25.3.0.5525, AsyncOS 15.5.5-014 or 16.5.0-780
- AhsayCBS 10.3.4.45 hotfix, 9.15.2.70 hotfix for v7 to v9
What each flaw needs
The Cisco flaw needs only an email with a crafted attachment. The two AhsayCBS flaws chain an authentication bypass into operating system commands. The PAN-OS flaw needs a login to the management interface and gives root on the firewall.
What to do now
The Cisco gateway goes first: the flaw needs no login, and the update needs no restart.
- Update Cisco Content Scanner Tools, or move to a fixed AsyncOS release.
- Apply the AhsayCBS hotfix for your version, then reboot the server.
- Upgrade PAN-OS to the fixed build for your branch in the Palo Alto Networks advisory.
- Restrict the PAN-OS management interface to trusted internal addresses or a jump host.
- Review each device for unexpected files, accounts and configuration changes since early October.
Who is affected
Cisco Secure Email Gateway, physical or virtual, where the File Reputation service is on and assigned to a mail policy. Cisco states there is no workaround. Ahsay states its earlier patches, v9.15.2.59 and v10.3.4.0, did not fully fix the AhsayCBS flaws. PAN-OS on PA-Series, VM-Series and Panorama is affected. Cloud NGFW and Prisma Access are not.
Detection notes
Cisco became aware of active exploitation in October. Palo Alto Networks reports very limited exploitation against the management interface. CISA marks both, and the AhsayCBS command injection, for forensic triage.
- Files written outside expected paths on an email gateway, and attachments flagged by File Reputation
- Calls to the AhsayCBS Replication Receiver endpoint /rps/api/json/UpdateReceivers.do
- Management interface sign-ins to PAN-OS from addresses outside the admin network
Essential Eight mapping
Patch applications and patch operating systems: the Essential Eight Maturity Model sets 48 hours for internet-facing services where a working exploit exists. Regular backups: a compromised backup server puts the recovery copy at risk, so check AhsayCBS before relying on it.
Sources
- PrimaryCISA, Known Exploited Vulnerabilities Catalog (release 2026.10.23)Retrieved 25 Oct 2026
- PrimaryPalo Alto Networks, CVE-2026-0322 PAN-OS authenticated RCE in the management interfaceRetrieved 25 Oct 2026
- PrimaryCisco, Secure Email Gateway arbitrary file write vulnerability (cisco-sa-esa-afw-zqYJkjxp)Retrieved 25 Oct 2026
- PrimaryAhsay, critical security alert for CVE-2026-105133 and CVE-2026-105134Retrieved 25 Oct 2026
- PrimaryCyber Security Agency of Singapore, AL-2026-143Retrieved 25 Oct 2026
- PrimaryNVD, CVE-2026-0322Retrieved 25 Oct 2026
- PrimaryNVD, CVE-2026-76519Retrieved 25 Oct 2026
- PrimaryNVD, CVE-2026-105133Retrieved 25 Oct 2026
- PrimaryNVD, CVE-2026-105134Retrieved 25 Oct 2026
