- Published
- Source
- Help Net Security
- Filed under
- Malware & exploits
- Vulnerabilities
- 4 CVEs Exploited
The US Cybersecurity and Infrastructure Security Agency (CISA) has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-0322, a high-severity remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS CVE-2026-76519, a critical relative path traversal vulnerability in Cisco Secure Email Gateway (SEG) CVE-2026-105133, a medium-severity improper authentication vulnerability, and CVE-2026-105134, a critical command injection vulnerability, in Ahsay AhsayCBS The agency added them based on evidence of active … More →…
If you run the affected product
- Find every instance – especially the ones reachable from the internet.
- Apply the vendor's patch or mitigation now: exploited flaws are fixed in days, not at the next patch cycle.
- Then check for signs it was used before you patched: web shells, new accounts, unusual outbound traffic.
More helpCISA's Known Exploited Vulnerabilities catalogue (opens in a new tab)
The vulnerabilities in this story
CVE-2026-0322 in the NVD (opens in a new tab)
- CVSS8.6High
- EPSS1.2%chance of exploitation in 30 days
- CISA KEVExploitedon the list since 14 Oct
CVE-2026-76519 in the NVD (opens in a new tab)
- CVSS9.8Critical
- EPSS1.6%chance of exploitation in 30 days
- CISA KEVExploitedon the list since 14 Oct
CVE-2026-105133 in the NVD (opens in a new tab)
- CVSS7.3High
- EPSS<1%chance of exploitation in 30 days
- CISA KEVExploitedon the list since 14 Oct
CVE-2026-105134 in the NVD (opens in a new tab)
- CVSS10.0Critical
- EPSS4.8%chance of exploitation in 30 days
- CISA KEVExploitedon the list since 14 Oct
Exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog (CC0). Exploit prediction: EPSS by FIRST. This product uses the NVD API but is not endorsed or certified by the NVD.
Defender’s notebook
The attacker technique behind this story, in MITRE’s terms – and what to check in your own estate.
Exploit Public-Facing Application
Initial AccessWhat a defender checks
- Find every internet-facing instance of the affected product.
- Patch, or apply the vendor's mitigation now – CISA's KEV list gives a deadline.
- Look for signs it was exploited before you patched: web shells, new accounts, odd outbound traffic.
Build the skillBlue Team Analyst · Vulnerability Management
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
MyCyberWay training
Blue Team Analyst · Vulnerability Management
You can't patch everything at once. Learn what to fix first.
In our Blue Team Analyst programme you run a vulnerability scan, prioritise the output with CVSS, EPSS and asset criticality, and track remediation to closure with the teams who own the fix.
- Read scanner output properly
- Prioritise with CVSS, EPSS and asset criticality
- Track remediation to closure
Headlines and short summaries only, except where a public body publishes under an open licence. Every story links to its publisher, who owns it. MyCyberWay does not edit or endorse third-party reporting.
