KEV catalog additions, October 14, 2026
CISA KEV Additions Hit Firewalls, Email Gateways, and Backup Servers
On October 14, CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog: a code injection flaw in the Palo Alto Networks PAN-OS management interface (CVE-2026-0322, CVSS 8.6), a critical path traversal in Cisco Secure Email Gateway that lets an unauthenticated attacker write files and run commands as root from a crafted email (CVE-2026-76519, CVSS 9.8), and two chained flaws in AhsayCBS backup software (CVE-2026-105133 and CVE-2026-105134) that attackers are using to plant webshells and cryptocurrency miners. Federal civilian agencies were directed to remediate by October 17. The common thread is position: every one of these products sits at a network chokepoint or holds the organization's backups.
Executives
The devices that guard the network and hold the backups are the ones under active attack this month. If your firewall management interface or backup console is reachable from the internet, that is a board-level exposure until it is fixed.
CIO / CISO
Run these four CVEs to ground in your asset inventory today, and assume compromise where patching lagged: hunt for webshells on AhsayCBS, unexpected child processes from the PAN-OS management daemon, and odd POST patterns on the Cisco gateway. The mitigations map cleanly to ATT&CK M1051, M1035, and M1030.
Engineers
Patch first, then hunt. Restrict the PAN-OS management interface to a dedicated management network, review AhsayCBS web roots for new script files, and check outbound traffic from backup servers for mining pool connections.
Everyone (non-IT)
If your company uses a backup service or email filter you have never heard of, this is why IT sometimes patches in a hurry. These flaws let attackers skip the front door entirely, so the fix cannot wait for a quiet week.