As reported by SecurityAffairs, CISA has added four CVEs across three vendors to its Known Exploited Vulnerabilities catalog — and all four are seeing active exploitation in the wild. This isn't a routine update. It's a signal that adversaries are casting a wide net across network edge, email gateway, and backup infrastructure simultaneously.

Security Impact: As reported by SecurityAffairs, CISA has added four CVEs across three vendors to its Known Exploited Vulnerabilities catalog — and all four are seeing active exploitation in the wild.

Why This Matters

What makes this KEV batch particularly notable is the diversity of attack surfaces and the speed at which exploitation followed discovery. The AhsayCBS flaws (CVE-2026-105133 and CVE-2026-105134) represent a textbook kill chain: bypass authentication, then execute arbitrary commands — all unauthenticated by the time you reach the second stage. Huntress's report of at least five compromised organizations within 24 hours of the first observed exploitation on October 7 underscores how quickly threat actors weaponize these chains.

The Palo Alto PAN-OS flaw requires authenticated access with high privileges, which might seem to limit exposure — but in practice, management interface credentials are frequently over-privileged, shared across teams, or compromised via broader campaigns. An attacker who obtains those credentials gains root on the firewall itself, effectively controlling the entire perimeter.

Cisco's Secure Email Gateway vulnerability is perhaps the most alarming: a crafted email attachment that writes arbitrary files to the underlying OS. The attack vector is the very traffic the appliance is designed to inspect.

Vulnerability Details

CVEVendor / ProductCVSSTypeActive Exploit?
CVE-2026-0322Palo Alto Networks PAN-OS (PA-Series, VM-Series, Panorama)8.6Code Injection (mgmt interface)Limited
CVE-2026-76519Cisco Secure Email Gateway9.8Path Traversal → file writeYes — confirmed
CVE-2026-105133Ahsay AhsayCBS5.5Improper AuthenticationYes — since Oct 7
CVE-2026-105134Ahsay AhsayCBS (Replication Receiver)9.3OS Command Injection (unauth)Yes — since Oct 7
Key takeaway: Three of four flaws have confirmed active exploitation. The AhsayCBS pair is being chained in the wild — authentication bypass followed by unauthenticated RCE. Organizations running AhsayCBS backup infrastructure face the most immediate and severe risk.

Who Is Most Exposed

Who Is Most Exposed
AhsayCBS customers: Managed service providers and enterprises using AhsayCBS for backup management. The unauthenticated command injection on the Replication Receiver endpoint is internet-facing in many deployments and requires no credentials at all once the authentication bypass is leveraged.
Cisco Secure Email Gateway operators: Any organization with an internet-exposed Cisco SEG appliance is at risk. The attack requires only the ability to send a crafted email — no authentication, no privileged access.
Palo Alto firewall deployments with exposed management interfaces: Organizations that have not restricted management plane access to trusted internal IPs are at elevated risk, especially if credential hygiene is poor.

Immediate Actions

AhsayCBS — Highest Priority

  • Disable or restrict internet exposure of AhsayCBS management and Replication Receiver endpoints immediately. The /rps/api/json/UpdateReceivers.do endpoint should not be reachable from untrusted networks.
  • Apply vendor patches as soon as available. If patching is delayed, consider taking the AhsayCBS service offline or placing it behind a VPN.
  • Hunt for post-exploitation artifacts: unexpected scheduled tasks, new admin accounts, modified backup schedules, and outbound connections to unknown infrastructure.

Cisco Secure Email Gateway

  • Apply the vendor patch for CVE-2026-76519 immediately — this is a CVSS 9.8 with confirmed exploitation.
  • Review email gateway logs for anomalous attachment processing and unexpected file writes on the underlying OS.
  • If segmentation allows, restrict inbound management traffic and monitor for signs of persistence on the appliance OS.

Palo Alto PAN-OS

  • Restrict management interface access to trusted internal IP ranges only — this is the vendor's recommended interim mitigation.
  • Rotate and audit all management credentials, especially any with high-privilege or admin-level access.
  • Apply the relevant PAN-OS security update per Palo Alto's advisory.
  • Review management plane logs for anomalous authenticated sessions, particularly from unexpected source IPs or at unusual times.

Shield53 Recommendations

  • Triage by exposure first, not CVSS alone. CVE-2026-105133 carries only a 5.5 score but is the first link in a chain that ends in unauthenticated RCE. Prioritize based on internet exposure and exploit chain potential.
  • Audit your backup infrastructure exposure. Backup and replication systems are increasingly targeted because they hold the keys to recovery — and attackers know that compromising them can neutralize your ransomware response.
  • Enforce management plane isolation across all network appliances. Every device in this KEV batch has a management interface that should never face the public internet. Conduct an external attack surface scan to identify exposed admin interfaces.
  • Deploy detection for the AhsayCBS attack chain. Monitor for rapid successive calls to checkSysPwd followed by POST requests to /rps/api/json/UpdateReceivers.do — this sequence indicates an active exploitation attempt.
  • Prepare for the follow-on attacks. When backup infrastructure is compromised, ransomware operators often follow within days. Ensure your incident response retainer and tabletop plans account for backup system compromise scenarios.

This KEV addition is a reminder that attackers don't target the most sophisticated systems — they target the ones that are exposed, unpatched, and assumed to be safe. Backup platforms and email gateways sit at critical trust boundaries, and when those boundaries fail, the blast radius extends well beyond a single appliance.