Skip to content
eastbaycyber
CISA KEV additions

CISA Adds 4 Known Exploited Vulnerabilities to Catalog (October 14, 2026)

Source: CISA KEV Catalog · Updated 2026-10-14

Summary

On October 14, 2026, CISA added 4 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-105134, CVE-2026-76519, CVE-2026-105133, CVE-2026-0322. A KEV listing means CISA has evidence of active exploitation. CISA sets a remediation due date for US federal civilian agencies under its binding operational directives; any organization running the affected products should treat these as patch-now priorities.

CVE-2026-105134: Ahsay AhsayCBS Command Injection Vulnerability

Ahsay · AhsayCBS

Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.

Federal due date
2026-10-17
Ransomware use
Unknown
Added
2026-10-14

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

NVD record

CVE-2026-76519: Cisco Secure Email Gateway Relative Path Traversal Vulnerability

Cisco · Secure Email Gateway

Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.

Federal due date
2026-10-17
Ransomware use
Unknown
Added
2026-10-14

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

NVD record · Cisco KEV history

CVE-2026-105133: Ahsay AhsayCBS Improper Authentication Vulnerability

Ahsay · AhsayCBS

Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.

Federal due date
2026-10-17
Ransomware use
Unknown
Added
2026-10-14

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

NVD record

CVE-2026-0322: Palo Alto Networks PAN-OS Code Injection Vulnerability

Palo Alto Networks · PAN-OS

Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.

Federal due date
2026-10-17
Ransomware use
Unknown
Added
2026-10-14

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

NVD record · Palo Alto Networks KEV history

Also added to KEV in October 2026

  • October 13, 2026: CVE-2026-96951, Microsoft Windows (Microsoft Windows Command Injection Vulnerability)
  • October 13, 2026: CVE-2026-104935, Ivanti Connect Secure (Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability)
  • October 8, 2026: CVE-2023-22894, Strapi Strapi (Strapi Cleartext Storage of Sensitive Information Vulnerability)
  • October 8, 2026: CVE-2021-3199, ONLYOFFICE Docs (ONLYOFFICE Docs Server Path Traversal Vulnerability)
  • October 8, 2026: CVE-2016-3081, Apache Struts (Apache Struts Command Injection Vulnerability)
  • October 8, 2026: CVE-2015-5477, ISC BIND ( ISC BIND Data Processing Errors Vulnerability)
  • October 8, 2026: CVE-2015-3306, ProFTPD ProFTPD (ProFTPD Improper Access Control Vulnerability)
  • October 4, 2026: CVE-2026-88779, Citrix NetScaler (Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memor)
  • October 2, 2026: CVE-2026-102490, Zammad GmbH Zammad (Zammad GmbH Zammad Improper Privilege Management Vulnerability)
  • October 2, 2026: CVE-2026-102489, Zammad GmbH Zammad (Zammad GmbH Zammad Session Fixation Vulnerability)
  • October 1, 2026: CVE-2026-104286, Fortinet FortiMail (Fortinet FortiMail Path Traversal Vulnerability)

Check whether you run these products: our vulnerability scanner comparison covers tools that detect KEV-listed flaws. See also the KEV dashboard and KEV history by vendor.