Federal civilian agencies have until 17 Oct to fix all four. The two AhsayCBS bugs follow Ahsay’s 10 Oct notice that its first fix fell short.
The US Cybersecurity and Infrastructure Security Agency added four vulnerabilities to its Known Exploited Vulnerabilities catalog on Wednesday, based on evidence of active exploitation. They are CVE-2026-0322, a code injection flaw in Palo Alto Networks PAN-OS; CVE-2026-76519, a path traversal flaw in Cisco Secure Email Gateway; and CVE-2026-105133 and CVE-2026-105134, an authentication bypass and a command injection flaw in AhsayCBS that CISA says can be chained. Federal civilian agencies must remediate by 17 October. Ahsay told partners on 10 October that its earlier release did not fully fix the two Ahsay bugs.
Sources: CISA · CISA KEV catalog · Ahsay