Cisco, Palo Alto and Ahsay flaws under attack: fix by October 17

CISA added four exploited flaws to its Known Exploited Vulnerabilities catalog on October 14 and gave federal civilian agencies until October 17 to fix them. One is in Cisco Secure Email Gateway, one in Palo Alto Networks PAN-OS, and two in AhsayCBS, a backup management console.

The Cisco gateway reads every inbound email, so an attacker needs no account to reach it. The PAN-OS flaw needs a login to the firewall's management interface. AhsayCBS is popular with managed service providers, according to SecurityWeek, so a company can be exposed through its MSP's backup server without running the software itself.

Patch order

Cisco Secure Email Gateway

The bug is in the file reputation part of Cisco's Advanced Malware Protection. NHS England's alert, which summarizes Cisco's advisory, lists two conditions, and a gateway is exposed only when both hold: a mail policy uses File Reputation, and the installed Content Scanner Tools build is older than 25.3.0.5525.

Cisco released the fixed AsyncOS builds on September 14, when it grouped this bug with others under CVE-2026-76440, according to SecurityWeek. Any 16.0 release needs to move to a fixed build. The quicker route is updating Content Scanner Tools, which needs no software upgrade and no restart, CSO Online reports. Cisco lists no workaround. It has patched its cloud-hosted gateways, and SecurityWeek says it has contacted cloud customers whose devices showed signs of compromise.

To look for signs of attack, run grep "System Security" system_logs on the appliance. Cisco says via CSO Online that a clean result should not end the investigation, because an attacker with root may hide evidence, so also check firewall and network logs held elsewhere for unexpected uploads from the gateway. A compromised appliance holds the SSH keys used to join a cluster, CSO Online adds, so check every member. A compromised virtual appliance should be rebuilt on a fixed release without importing the old configuration files, after the evidence is saved; physical ones go through Cisco TAC.

AhsayCBS

Huntress first saw attacks on October 7 at 23:20 UTC. CVE-2026-105133 skips the login and CVE-2026-105134 runs commands, and together they give code execution as SYSTEM. By October 8, five organizations had been targeted.

Ahsay confirmed on October 10 that its 10.3.4.0 release did not fully fix the two flaws, eSecurityPlanet reported. Version 10 servers need the 10.3.4.45 hotfix; versions 7, 8 and 9 need 9.15.2.70. Reboot after installing. Huntress says it tested 10.3.4.45 and it blocks the entry point. If you find signs of the attack, Huntress advises rebuilding the host from a trusted backup, because the attackers hid more back doors.

PAN-OS

CVE-2026-0322 lets an attacker who can log in to the management interface run code as root. PA-Series and VM-Series firewalls are at risk, as is Panorama; Palo Alto's Cloud NGFW and Prisma Access services are not. Palo Alto reports "very limited exploitation" and has not named the attackers.

Fixed builds listed by Cybersecurity News are 12.2.4, 12.1.10-h2, 11.1.16-h3 and 10.2.18-h12, and on 11.2 the hotfixes 11.2.4-h22, 11.2.7-h21, 11.2.10-h15 and 11.2.13-h3, and Palo Alto expected to ship 11.2.16 on October 15. Confirm your train in Palo Alto's advisory. Unsupported versions get no fix, and there is no workaround.