CISA KEV, 14 October 2026: AhsayCBS, Cisco Secure Email and PAN-OS, and an Ahsay Fix the CVE Records Get Wrong

CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog on 14 October 2026, and under BOD 26-04 all four are due on 17 October, three days later. Two are a chained authentication bypass and command injection in the AhsayCBS backup server. One is an unauthenticated file write in Cisco Secure Email Gateway, triggered by an email attachment. The fourth is an authenticated code execution flaw in the PAN-OS management interface. All four are confirmed exploited.

The AhsayCBS pair needs the most care, because the public records are wrong about what fixes it. The CVE records say upgrading to 10.3.4 resolves both flaws. Ahsay said on 12 October that its 10.3.4.0 and 9.15.2.59 patches "did not fully address" them, and that partners need new hotfixes. A scanner reading the CVE record will mark a 10.3.4.0 server as fixed. This post covers what each vulnerability needs, the vendor's actual fix, and a short script that checks an inventory against the vendors' fix levels instead of the CVE ranges.

The short answer

AhsayCBS: apply hotfix 10.3.4.45 (v10) or 9.15.2.70 (v7 to v9) and reboot, even if you already installed 10.3.4.0. Cisco Secure Email Gateway: update Content Scanner Tools to 25.3.0.5525 or later, which fixes every supported release without a restart, then check the logs for compromise. PAN-OS: upgrade to the hotfix for your release line, and make sure the management interface is reachable only from trusted internal addresses. All four are due under BOD 26-04 by 17 October.

AhsayCBS: when the CVE record and the vendor disagree

AhsayCBS is the server side of Ahsay's backup software, often run by service providers and resellers for their own customers. VulDB published the two CVEs on 4 October. CVE-2026-105133 lets a remote attacker bypass authentication by manipulating a random parameter checked in checkSysPwd. CVE-2026-105134 is a command injection through the same kind of parameter in the Replication Receiver's UpdateReceivers.do endpoint. CISA's entry says the two can be chained, which gives an unauthenticated attacker command execution on the backup server. The records note that an exploit is public. CISA added both on 14 October, and its enrichment marks exploitation as active and automatable.

Three details in the records don't match Ahsay's own guidance:

1. The fixed version. Both records say "upgrading to version 10.3.4 is able to mitigate this issue". Ahsay's 12 October announcement says the previous patches, 10.3.4.0 and 9.15.2.59, didn't fully fix them, and points partners to hotfix 10.3.4.45 for v10 and 9.15.2.70 for v7, v8 and v9, followed by a reboot.
2. The affected versions. The records list AhsayCBS 10.3.0 to 10.3.2 as affected. Ahsay's announcement covers v7 to v10.
3. Where the fix lives. Both hotfixes sit behind Ahsay's partner portal login, so organisations that bought AhsayCBS through a reseller may need to ask their provider.

A backup server is a sensitive thing to lose. It holds copies of customers' data, often their credentials for cloud sources, and the ability to delete or corrupt restore points. If you ran an affected AhsayCBS version exposed to the internet, patch it, then review it for signs of compromise, especially new admin accounts, changed replication targets and unexpected commands, before you trust its backups.

Cisco Secure Email Gateway: the attachment is the attack

CVE-2026-76519 (CVSS 3.1 9.8) is in the Advanced Malware Protection feature. According to Cisco's advisory, the gateway mishandles attachments when the File Reputation service is on, so one crafted email can write arbitrary files and run commands as root. No login is needed: the attacker only has to send mail through the gateway. A device is vulnerable when File Reputation is enabled and assigned to a mail policy, and its Content Scanner Tools version is earlier than 25.3.0.5525. Secure Email and Web Manager and Secure Web Appliance aren't affected. (Secure Email Gateway was on the KEV list earlier this year too; see our page on CVE-2026-76461.)

Cisco says it learned of active exploitation in October 2026 and that there are no workarounds. The fastest fix is the Content Scanner Tools update, which reaches every supported AsyncOS release without an upgrade or restart. If automatic updates are on, it may already be applied. Otherwise run contentscannerupdate on the CLI. Cisco's fixed AsyncOS releases are 15.5.5-014 and 16.5.0-780, and it recommends that anyone on a release earlier than 16.5 move to 16.5.0-780.

Cisco also gives a compromise check: run grep "System Security" system_logs on each appliance, including every member of a cluster. A "Suspected compromise indicator was found" message means you should follow Cisco's recovery guidance and contact TAC.

PAN-OS: authenticated, but only as safe as your management interface

CVE-2026-0322 lets an authenticated attacker with network access to the management interface run code as root on PA-Series and VM-Series firewalls and Panorama. Cloud NGFW and Prisma Access aren't affected. Palo Alto's advisory says it has seen "very limited exploitation" targeting the management interface, and that no special configuration is needed to be affected.

The fixes are hotfixes per maintenance line. For example, 11.1.5 to 11.1.6 needs 11.1.6-h39, 11.1.7 needs 11.1.7-h11, and 11.2.11 to 11.2.13 needs 11.2.13-h3, or you can move to the latest fixed release in your train. There are no workarounds. Threat Prevention customers get limited coverage from Threat IDs 510046 and 510047, but only if management traffic is routed through a data-plane interface and decrypted. The real control is the one Palo Alto has repeated for years: the management interface should be reachable only from trusted internal addresses.

Check your inventory against the vendor fix levels

This script reads a simple CSV of devices and versions and checks each against the vendor's fix levels above, not the CVE records. For AhsayCBS it also prints what the CVE record would have told you. The version comparison is deliberately simple, so for anything unusual, confirm against the vendor advisory. It uses only the standard library.

#!/usr/bin/env python3
"""Check an inventory against the vendor fix floors for the four CISA KEV additions of
14 October 2026 (due 17 October). Uses the vendors' advisories, not the CVE records, because
for AhsayCBS the two disagree. Standard library only.
Input CSV columns: name,product,version[,extra]  where product is ahsaycbs, cisco-esa or pan-os,
and extra is the Content Scanner Tools version for cisco-esa.
Usage: python3 kev_2026_10_14.py inventory.csv"""
import csv, re, sys

def v(s):
    """'11.1.6-h39' -> (11, 1, 6, 39); '15.5.5-014' -> (15, 5, 5, 14); '10.3.4.45' -> (10, 3, 4, 45)"""
    nums = [int(n) for n in re.findall(r"\d+", s)]
    return tuple(nums + [0] * (4 - len(nums)))

def ahsay(ver, _):
    # Ahsay, 12 Oct 2026: 10.3.4.0 and 9.15.2.59 did not fully fix CVE-2026-105133/105134.
    floor = "10.3.4.45" if v(ver)[0] >= 10 else "9.15.2.70"
    fixed = v(ver) >= v(floor) and (v(ver)[0] >= 10 or v(ver)[:3] == v(floor)[:3])
    cve_record_says = "affected" if (10, 3, 0, 0) <= v(ver) < (10, 3, 3, 0) else "not listed as affected"
    need = f"at or above hotfix {floor}" if fixed else f"needs hotfix {floor} or later"
    return fixed, f"{need}; CVE record: {cve_record_says}"

def cisco_esa(ver, cst):
    if cst and v(cst) >= v("25.3.0.5525"):
        return True, f"Content Scanner Tools {cst} includes the fix"
    floors = {(15, 5): "15.5.5-014", (16, 5): "16.5.0-780"}
    floor = floors.get(v(ver)[:2])
    if floor and v(ver) >= v(floor):
        return True, f"AsyncOS {floor} or later"
    return False, "update Content Scanner Tools to 25.3.0.5525+ or move to 16.5.0-780 (only if File Reputation is on)"

PAN_ROWS = [  # (first version in row, last maintenance release in row, fix for that row) per PAN-OS advisory
    ("12.2.0", "12.2.3", "12.2.4"), ("12.1.8", "12.1.10", "12.1.10-h2"), ("12.1.5", "12.1.7", "12.1.7-h8"),
    ("12.1.0", "12.1.4", "12.1.4-h12"), ("11.2.14", "11.2.15", "11.2.16"), ("11.2.11", "11.2.13", "11.2.13-h3"),
    ("11.2.8", "11.2.10", "11.2.10-h15"), ("11.2.5", "11.2.7", "11.2.7-h21"), ("11.2.0", "11.2.4", "11.2.4-h22"),
    ("11.1.14", "11.1.16", "11.1.16-h3"), ("11.1.11", "11.1.13", "11.1.13-h15"), ("11.1.8", "11.1.10", "11.1.10-h35"),
    ("11.1.7", "11.1.7", "11.1.7-h11"), ("11.1.5", "11.1.6", "11.1.6-h39"), ("11.1.0", "11.1.4", "11.1.4-h37"),
    ("10.2.17", "10.2.18", "10.2.18-h12"), ("10.2.14", "10.2.16", "10.2.16-h11"), ("10.2.11", "10.2.13", "10.2.13-h26"),
    ("10.2.8", "10.2.10", "10.2.10-h41"), ("10.2.0", "10.2.7", "10.2.7-h38"),
]
PAN_LATEST = {"12.2": "12.2.4", "12.1": "12.1.10-h2", "11.2": "11.2.16", "11.1": "11.1.16-h3", "10.2": "10.2.18-h12"}

def pan_os(ver, _):
    train = ".".join(ver.split(".")[:2])
    if train not in PAN_LATEST:
        return False, "unsupported train: move to a supported fixed release"
    if v(ver) >= v(PAN_LATEST[train]):
        return True, f"{PAN_LATEST[train]} or later"
    for lo, hi, fix in PAN_ROWS:
        if v(lo)[:3] <= v(ver)[:3] <= v(hi)[:3]:
            return v(ver) >= v(fix), f"fix for this line is {fix} (or {PAN_LATEST[train]})"
    return False, f"upgrade to {PAN_LATEST[train]}"

CHECKS = {"ahsaycbs": ("CVE-2026-105133/105134", ahsay), "cisco-esa": ("CVE-2026-76519", cisco_esa),
          "pan-os": ("CVE-2026-0322", pan_os)}
open_items = 0
for row in csv.reader(open(sys.argv[1])):
    if not row or row[0].startswith("#"):
        continue
    name, product, version, extra = (row + [""])[:4]
    cve, check = CHECKS[product]
    fixed, note = check(version, extra)
    open_items += not fixed
    print(f"{'ok   ' if fixed else 'PATCH'}  {name:<12} {product:<9} {version:<12} {cve:<22} {note}")
print(f"\n{open_items} device(s) still exposed. CISA's due date for all four CVEs: 17 October 2026.")
sys.exit(1 if open_items else 0)

A sample inventory:

# name,product,version,extra
backup-1,ahsaycbs,10.3.4.0
backup-2,ahsaycbs,10.3.4.45
backup-old,ahsaycbs,9.15.2.59
mail-gw-1,cisco-esa,15.5.3-017,25.2.1.4410
mail-gw-2,cisco-esa,16.0.1-010,25.3.0.5525
fw-edge-1,pan-os,11.1.6-h12
fw-edge-2,pan-os,11.2.13-h3
fw-dc-1,pan-os,10.2.13-h26
panorama,pan-os,11.1.7-h4

$ python3 kev_2026_10_14.py inventory.csv
PATCH  backup-1     ahsaycbs  10.3.4.0     CVE-2026-105133/105134 needs hotfix 10.3.4.45 or later; CVE record: not listed as affected
ok     backup-2     ahsaycbs  10.3.4.45    CVE-2026-105133/105134 at or above hotfix 10.3.4.45; CVE record: not listed as affected
PATCH  backup-old   ahsaycbs  9.15.2.59    CVE-2026-105133/105134 needs hotfix 9.15.2.70 or later; CVE record: not listed as affected
PATCH  mail-gw-1    cisco-esa 15.5.3-017   CVE-2026-76519         update Content Scanner Tools to 25.3.0.5525+ or move to 16.5.0-780 (only if File Reputation is on)
ok     mail-gw-2    cisco-esa 16.0.1-010   CVE-2026-76519         Content Scanner Tools 25.3.0.5525 includes the fix
PATCH  fw-edge-1    pan-os    11.1.6-h12   CVE-2026-0322          fix for this line is 11.1.6-h39 (or 11.1.16-h3)
ok     fw-edge-2    pan-os    11.2.13-h3   CVE-2026-0322          fix for this line is 11.2.13-h3 (or 11.2.16)
ok     fw-dc-1      pan-os    10.2.13-h26  CVE-2026-0322          fix for this line is 10.2.13-h26 (or 10.2.18-h12)
PATCH  panorama     pan-os    11.1.7-h4    CVE-2026-0322          fix for this line is 11.1.7-h11 (or 11.1.16-h3)

5 device(s) still exposed. CISA's due date for all four CVEs: 17 October 2026.
$ echo $?
1

The first line is the problem in miniature: a backup server on 10.3.4.0 that the CVE record doesn't list as affected, but that Ahsay says still needs a hotfix.

The fair view

CISA's three-day deadline applies to US federal civilian agencies, and everyone else can set their own pace. For these four, the pace should be fast. All four are being exploited, three need no credentials, and the AhsayCBS chain has a public exploit. The PAN-OS risk is much lower where management interfaces are properly restricted, and the Cisco flaw only applies with File Reputation enabled, so some readers will find they're not exposed at all.

The broader lesson is about where version data comes from. The AhsayCBS records were written from an early report and haven't caught up with the vendor's later guidance. Tools that rely only on CVE ranges will report those servers as fixed. When the vendor publishes something newer than the CVE record, the vendor wins.