CISA Flags Critical PAN‑OS, AhsayCBS, and Cisco Secure Email Gateway Flaws in KEV Catalog
What Happened — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added four high‑severity vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE‑2026‑0322 (Palo Alto Networks PAN‑OS code injection, CVSS 8.6), CVE‑2026‑76519 (Cisco Secure Email Gateway relative‑path traversal, CVSS 9.8), CVE‑2026‑105133 (AhsayCBS improper authentication, CVSS 5.5) and CVE‑2026‑105134 (AhsayCBS command injection, CVSS 9.3). Exploitation has been observed in the wild, targeting firewalls, email gateways, and backup management platforms.
Why It Matters for Trust & Control Assurance
- Continuous control‑assurance programs must surface unpatched high‑severity flaws quickly and retain evidence of remediation to satisfy audit expectations.
- Mapping these CVEs to the underlying control objective of “secure configuration and vulnerability management” demonstrates due‑diligence across multiple frameworks.
- Verisq’s Control Mapping capability automates the correlation of discovered vulnerabilities with the relevant VCF control, providing a defensible audit trail.
Who Is Affected – Organizations that deploy Palo Alto firewalls, Cisco Secure Email Gateway, or AhsayCBS backup solutions – spanning finance, healthcare, SaaS, and other regulated sectors.
Recommended Actions
- Apply the vendor‑provided patches for all four CVEs immediately.
- Restrict management‑plane access to trusted internal IP ranges and enforce MFA for privileged accounts.
- Enable continuous vulnerability scanning and map findings to the VCF “secure configuration & vulnerability management” control.
- Document remediation steps in a centralized evidence repository for audit readiness.
Source: Security Affairs
Technical Notes
- CVE‑2026‑0322 – Code injection in PAN‑OS management UI; requires authenticated network access, leads to root code execution.
- CVE‑2026‑76519 – Relative path traversal in Cisco Secure Email Gateway; crafted email attachment writes arbitrary files, CVSS 9.8.
- CVE‑2026‑105133 – Improper authentication in AhsayCBS API (checkSysPwd), CVSS 5.5, enables bypass of login.
- CVE‑2026‑105134 – Command injection via
/rps/api/json/UpdateReceivers.do, unauthenticated, CVSS 9.3.
Source: same as above