CISA adds Cisco, Palo Alto, Fortinet flaws to exploited vulnerabilities catalog
The U.S. CISA catalog now lists critical flaws in network gear and remote support tools that threat actors are actively using to breach systems.
Key points
- CISA added six CVEs from Cisco, Palo Alto Networks, Ahsay, Fortinet, and BeyondTrust to its Known Exploited Vulnerabilities catalog.
- Cisco Secure Email Gateway flaw CVE-2026-76519 allows arbitrary file writes via crafted email attachments.
- PEERSTITCH malware exploited a Fortinet path traversal flaw to expose over 500 firewalls and evade detection.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog this week. The additions include flaws in products from Cisco, Palo Alto Networks, Ahsay, Fortinet, and BeyondTrust that are currently being abused by threat actors.
Cisco confirmed that attackers are exploiting a critical vulnerability in Cisco Secure Email Gateway, tracked as CVE-2026-76519. The flaw has a CVSS score of 9.8 and allows an attacker to write arbitrary files to the underlying operating system by sending a crafted email attachment through the gateway.
Network and Firewall Exploits
Palo Alto Networks confirmed limited exploitation of CVE-2026-0322, a high-severity code injection vulnerability in PAN-OS. The flaw affects PA-Series and VM-Series firewalls and Panorama appliances. An authenticated attacker with high-level privileges can execute arbitrary code with root privileges on the management interface.
Fortinet products are also affected by CVE-2025-61624, a path traversal flaw in the FortiOS auto-script engine. Palo Alto Networks researchers reported that PEERSTITCH malware exploited this vulnerability to deploy implants. The attackers used the flaw to expose more than 500 firewalls, evade detection inside FortiOS memory, and maintain stealthy access.
Backup and Remote Support Risks
Ahsay AhsayCBS backup management platform faces two critical flaws. CVE-2026-105133 is an improper authentication vulnerability that allows remote attackers to bypass authentication by manipulating a random parameter. Starting October 7, 2026, attackers used this flaw to bypass authentication before exploiting CVE-2026-105134 to execute commands on servers.
CVE-2026-105134 is a critical command injection vulnerability in the Replication Receiver component of AhsayCBS. Huntress reported that at least five organizations were targeted by October 8. BeyondTrust Remote Support is also affected by CVE-2026-102764, an authentication bypass by spoofing vulnerability in versions 26.2.3 and earlier.
What should you do?
CISA warns that cyber threat actors are actively exploiting the BeyondTrust vulnerability to gain initial access, establish persistence, escalate privileges, and move laterally. Patches are available for supported versions 24.3.1 and later of BeyondTrust Remote Support. Organizations using older versions must upgrade first.
Federal agencies must address these vulnerabilities by the due date set in Binding Operational Directive (BOD) 22-01. Experts recommend that private organizations review the KEV catalog and address the vulnerabilities in their infrastructure to protect against attacks exploiting these flaws.
What to do and how to stay safe: CISA
- Verify if your environment runs affected versions of Cisco Secure Email Gateway, Palo Alto PAN-OS, AhsayCBS, FortiOS, or BeyondTrust Remote Support.
- Apply security updates for Palo Alto Networks PAN-OS and BeyondTrust Remote Support as soon as vendors provide them.
- Restrict access to Palo Alto Networks management interfaces to trusted internal IP addresses to reduce exposure.
- Monitor logs for signs of PEERSTITCH malware or unauthorized command execution in backup and email systems.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which vulnerabilities were added to the CISA KEV catalog?
CISA added CVE-2026-0322, CVE-2026-76519, CVE-2026-105133, CVE-2026-105134, CVE-2025-61624, and CVE-2026-102764 to the catalog.
Is there a patch for the Fortinet path traversal flaw?
The source material does not confirm a specific patch for CVE-2025-61624, but notes it is exploited by PEERSTITCH malware.
How are attackers exploiting the AhsayCBS flaws?
Attackers bypass authentication using CVE-2026-105133 and then exploit CVE-2026-105134 to execute commands on affected servers.
