Today's briefing covers the four vulnerabilities CISA added to its Known Exploited Vulnerabilities Catalog on 2026-10-14, all on evidence of active exploitation, and the risk-based remediation rules of Binding Operational Directive 26-04 that now frame them. Two of the four are Ahsay AhsayCBS flaws that CISA says can be chained, a third lets an unauthenticated remote attacker write arbitrary files on a Cisco Secure Email Gateway, and the two entries detailed below carry a KEV due date of 2026-10-17.
CISA added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-10-14, based on evidence of active exploitation: CVE-2026-0322, a Palo Alto Networks PAN-OS code injection vulnerability; CVE-2026-76519, a Cisco Secure Email Gateway relative path traversal vulnerability; CVE-2026-105133, an Ahsay AhsayCBS improper authentication vulnerability; and CVE-2026-105134, an Ahsay AhsayCBS command injection vulnerability.
The alert places the additions under Binding Operational Directive (BOD) 26-04, Prioritizing Security Updates Based on Risk, which sets vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. The directive requires agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically KEV-listed CVEs on publicly exposed assets that grant total control of the asset after exploitation, while deferring action on lower-risk vulnerabilities. It also sets basic expectations for when agencies must check whether threat actors compromised a system before the patch was applied. BOD 26-04 binds only FCEB agencies; CISA encourages every organization to adopt risk-based vulnerability management and to prioritize remediation of KEV Catalog vulnerabilities.
The three products named are a firewall operating system, an email gateway, and a backup server: systems that sit at an organization's edge or hold the data it recovers from. The directive's own test, a publicly exposed asset that grants total control after exploitation, is the right first filter outside government too. Operators should inventory internet-reachable PAN-OS, Cisco Secure Email Gateway, and AhsayCBS instances today, apply vendor mitigations to those first, and, following the directive's expectation, check exposed systems for compromise that predates the patch instead of closing the ticket on patch status alone.
The KEV entry describes CVE-2026-105134 as a command injection vulnerability in Ahsay AhsayCBS that could allow a remote attacker to execute operating system commands by manipulating the random parameter of the Replication Receiver component's /rps/api/json/UpdateReceivers.do endpoint. CISA notes that it can be chained with CVE-2026-105133, the AhsayCBS improper authentication vulnerability added in the same batch. The required action is to apply mitigations according to the vendor's instructions, in line with BOD 26-04 and CISA's Forensics Triage Requirements, to follow the directive's guidance for cloud services, or to discontinue use of the product if mitigations are unavailable; stakeholders are responsible for evaluating each asset's internet exposure. The due date is 2026-10-17, and known ransomware campaign use is recorded as unknown.
An authentication weakness paired with command injection on the same product is the shape of a full pre-authentication compromise, and the target here is a backup server, the system an organization relies on to recover from a breach. The three-day due date signals that CISA treats it accordingly. Operators running AhsayCBS should apply the vendor's mitigations before 2026-10-17, restrict network access to the Replication Receiver endpoint until they do, review requests to /rps/api/json/UpdateReceivers.do for manipulated parameters, and verify that backup sets and server credentials have not been altered before trusting them for recovery.
CISA's KEV entry describes CVE-2026-76519 as a relative path traversal vulnerability in Cisco Secure Email Gateway that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. The required action is to apply mitigations according to the vendor's instructions, in line with BOD 26-04 and CISA's Forensics Triage Requirements, to follow the directive's guidance for cloud services, or to discontinue use of the product if mitigations are unavailable, with stakeholders responsible for evaluating each asset's internet exposure. The due date is 2026-10-17, and known ransomware campaign use is recorded as unknown.
An email gateway is internet-facing by design, and an unauthenticated arbitrary file write on its operating system is a foothold on a system that sees an organization's inbound and outbound mail. Because exploitation is already confirmed, patch status alone does not answer whether a gateway was touched. Operators should apply Cisco's mitigations before 2026-10-17, then check the appliance file system for files that should not be there and review the gateway's administrative and configuration changes since before the listing, as the forensics triage requirement in the required action implies.
