On October 14, 2026, CISA added four CVEs to the Known Exploited Vulnerabilities catalog: CVE-2026-0322 (Palo Alto Networks PAN-OS code injection), CVE-2026-76519 (Cisco Secure Email Gateway relative path traversal), and CVE-2026-105133 / CVE-2026-105134 (AhsayCBS improper authentication / command injection). Active exploitation is the bar for the list.
Why networking gear is in this post
PAN-OS and Cisco Secure Email are the kind of internet-facing controls that turn a missed patch into a foothold. BOD 26-04 is the federal rapid-remediation frame CISA points at again — FCEB agencies must prioritize KEVs on publicly exposed assets that yield total control after exploit. Even if you are not federal, treating KEV day as patch day is still the sane default.
AhsayCBS is easier to forget because backup appliances sit off the glamorous edge. Auth and command-injection pairs there are how ransomware crews quietly own the restore path. Inventory it.
Ops checklist
Confirm PAN-OS and Cisco Secure Email builds against vendor fixed releases, restrict management planes, and verify AhsayCBS is not reachable from the open internet. Then check logs for pre-patch compromise — BOD language assumes threat actors may have beaten you to the CVE. I am not publishing exploit detail; patch and validate.
Ticket hygiene: one change window for PAN-OS and Cisco Secure Email if the same team owns both edges, separate owner for AhsayCBS backups, and a written “checked for pre-patch compromise” checkbox. KEV lists punish “we will get to it Friday.”
Vendor advisories beat Twitter threads. Pull Palo Alto, Cisco, and Ahsay fixed releases from primary channels, stage, then roll. KEV is the priority signal — not free permission to skip change control.
Have a blessed day!