Vulnerabilities
CISA Adds Four Exploited Vulnerabilities to KEV Catalog
CISA has added four CVEs—CVE‑2026‑0322, CVE‑2026‑76519, CVE‑2026‑105133, CVE‑2026‑105134—to its Known Exploited Vulnerabilities catalog. The vulnerabilities affect Palo Alto Networks PAN‑OS, Cisco Secure Email Gateway, and Ahsay AhsayCBS, and grant attackers full control of exposed assets. Defenders should prioritize patching and verify no compromise before applying updates.
What Happened
CISA expanded its KEV catalog with four actively exploited CVEs affecting Palo Alto Networks PAN‑OS, Cisco Secure Email Gateway, and Ahsay AhsayCBS.
Impact
- CVE‑2026‑0322 – PAN‑OS code injection that can lead to remote code execution.
- CVE‑2026‑76519 – Cisco Secure Email Gateway relative path traversal allowing arbitrary file access.
- CVE‑2026‑105133 – Ahsay AhsayCBS improper authentication enabling unauthorized access.
- CVE‑2026‑105134 – Ahsay AhsayCBS command injection permitting arbitrary command execution.
What to Do
Federal agencies must follow BOD 26‑04 to patch these CVEs on publicly exposed assets that grant total control. All organizations should adopt a risk‑based approach, prioritize remediation of KEV catalog items, and verify whether systems were compromised before applying patches.
Next Steps
Submit any other actively exploited vulnerabilities for KEV consideration via CISA’s nomination form.
Related vulnerabilities
CISA Adds Two Linux Kernel Vulnerabilities to KEV Catalog
CISA has added CVE-2025-39964 and CVE-2026-53266, both Linux kernel flaws, to its Known Exploited Vulnerabilities catalog. The additions underscore the need for rapid patching of publicly exposed assets that could grant full control. Defenders should verify patch status and monitor for exploitation indicators.
Read briefing
CISA Expands KEV Catalog with Seven Fresh Exploited Vulnerabilities
CISA has just added seven new CVEs to its Known Exploited Vulnerabilities (KEV) catalog, all confirmed to be actively exploited in the wild. The list includes SQL injection in Sangoma Switchvox, HTTP smuggling in Kludex Starlette, OS command injection in Kestra OSS, and several high‑impact flaws in BerriAI LiteLLM, JFrog Artifactory, and SonicWall SMA1000 appliances. Under BOD 26‑04, federal agencies must prioritize patching these high‑risk items on publicly exposed assets, while the broader community is urged to adopt the same risk‑based approach and submit any missing exploited CVEs for incl
Read briefing
Cisco Crosswork Hardening Release: Critical CVEs Uncovered in August 2026
Cisco’s Crosswork team has rolled out a hardening update after an internal security audit revealed several critical weaknesses. Four CVEs—CVE‑2026‑20030, CVE‑2026‑20357, CVE‑2026‑20358, and CVE‑2026‑20359—were patched in the new firmware, with no workarounds available. The vulnerabilities were not known to be actively exploited, but the critical rating urges immediate action. Update your Crosswork devices now to stay protected.
Read briefing
Ubuntu Kernel Vulnerabilities - Oct 2026
Multiple vulnerabilities have been disclosed affecting the Linux kernel in Ubuntu. These vulnerabilities allow for potential remote code execution, privilege escalation, and denial-of-service conditions. Defenders should prioritize patching systems according to the provided Ubuntu Security Notices.
Read briefing