CISA orders mitigation of exploited flaws in Cisco, Palo Alto Networks, Microsoft and Ahsay

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added actively exploited vulnerabilities in products from Cisco, Palo Alto Networks, Microsoft, Ahsay, and Ivanti to its Known Exploited Vulnerabilities catalog. The order mandates that federal executive branch civilian agencies mitigate these issues between October 16 and October 17, 2026, in compliance with Binding Operational Directive 22-01.

These additions follow confirmed attacks in production environments where malicious actors are leveraging authentication weaknesses, command injection, and directory traversal. Various security firms and the manufacturers themselves have warned of incidents aimed at compromising email gateways, firewall consoles, and backup platforms.

Compromise vectors in email gateways and firewalls

Vulnerability CVE-2026-76519 in Cisco Secure Email Gateway has a severity score of 9.8 on the CVSS scale, which assesses the technical gravity of software flaws. Cisco confirmed that external attackers exploit this defect by sending an email with a specially crafted attachment to trigger a relative path traversal, allowing for the writing of arbitrary files to the underlying operating system.

Meanwhile, Palo Alto Networks recorded malicious activity against the PAN-OS management interface via identifier CVE-2026-0322, rated with a severity of 8.6. The code injection vulnerability allows authenticated attackers with elevated privileges to execute commands as root on PA and VM series firewalls, as well as Panorama devices. The company urged blocking access to this interface from public networks and restricting it to trusted internal IP addresses.

Attack chain against backup platforms

In the AhsayCBS backup management software, attackers have chained two distinct vulnerabilities to take control of corporate servers. The first is CVE-2026-105133, with a score of 5.5, which consists of an improper authentication flaw in the checkSysPwd function of the API, allowing login bypass by altering a system parameter.

Once authentication is bypassed, attackers use CVE-2026-105134, rated at 9.3, which corresponds to a command injection in the platform's replication receiver. The firm Huntress documented that this combination began being exploited on October 7, 2026, and affected at least five organizations the following day. The intrusion allowed attackers to obtain system privileges, upload web interfaces in JSP files, and install the XMRig cryptocurrency mining program disguised as Microsoft Edge processes.

Command injection in Windows and access bypass in Ivanti

During its October 2026 patch cycle, Microsoft fixed 1,415 vulnerabilities, including a zero-day flaw under attack registered as CVE-2026-96951, with a severity of 8.8. This is a command injection in Windows Shell that allows bypassing Mark of the Web defenses, a protection mechanism that catalogs files downloaded from the internet to prevent their automatic opening. The attack depends on the victim opening a malicious file or link sent via email or messaging.

Additionally, CISA added flaw CVE-2026-104935, with a severity of 8.6, located in Ivanti Connect Secure. The breach allows bypassing authentication controls through spoofing techniques in versions prior to 25.1.3.0, enabling unauthorized remote command execution without valid credentials, while versions 22.7R2.14 and earlier remain unaffected by the issue.

Faced with these incidents, security experts recommend that private organizations review CISA's Known Exploited Vulnerabilities catalog and apply the corresponding patches to their infrastructure to halt attacker activity.