CISA adds four exploited vulnerabilities on October 14

The four names on the alert

CISA's alert of October 14, 2026, adds four entries to the known exploited vulnerabilities catalog. They are CVE-2026-0322, code injection in Palo Alto Networks PAN-OS; CVE-2026-76519, relative path traversal in Cisco Secure Email Gateway; CVE-2026-105133, improper authentication in Ahsay AhsayCBS; and CVE-2026-105134, command injection in Ahsay AhsayCBS. What the catalog adds, as a standing question, is The document named in the sources is the record this page will keep. The document named in the sources is the record this page will keep. The document named in the sources is the record this page will keep.what the KEV catalog adds.

No date this page will invent

The fetched alert does not print a remediation due date. Binding operational directive 26-04 still applies to federal civilian executive branch agencies, and CISA still encourages other organizations to prioritize catalog entries. A missing date is not an invitation to borrow one from a news summary. Help Net Security's October 15 piece is an account of the same four identifiers. The earlier October catalog brief is The document named in the sources is the record this page will keep. The document named in the sources is the record this page will keep.the October 11 additions.

Yesterday's Ivanti entry is a different CVE

The October 13 alert on Ivanti Connect Secure was a separate addition, CVE-2026-104935. It stays on its own page. The October 14 alert does not replace it and does not extend its facts. Readers who need that product want that brief. It is Asked directly, What are the four identifiers? CVE-2026-0322, Palo Alto Networks PAN-OS, code injection. CVE-2026-76519, Cisco Secure Email Gateway, relative path traversal. CVE-2026-105133, Ahsay AhsayCBS, improper authentication. CVE-2026-105134, Ahsay AhsayCBS, command injection. The document named in the sources is the record this page will keep.the Ivanti Connect Secure alert.

Impact, at the level the vendors stated

Palo Alto's note on CVE-2026-0322 describes authenticated code execution on the management interface, running as root, and calls exploitation very limited. That is the impact line this page will carry. It will not carry version ranges, Cisco attachment steps, or Ahsay function names. Ahsay's October 13 status update names hotfix versions v9.15.2.70 and v10.3.4.45. Those version strings are the vendor's fix marker, not a procedure. The security desk is The document named in the sources is the record this page will keep. The document named in the sources is the record this page will keep.Security.

Help Net Security's job

The October 15 article lists the four CVEs and treats them as exploited, which is what a catalog addition means. The catalog date is October 14. The article date is October 15. Both can be cited without moving the addition. The article is not a second catalog. The paper is Asked directly, What does Palo Alto say about CVE-2026-0322? Authenticated code execution on the management interface, as root, with exploitation described as very limited. This page does not print version ranges. The document named in the sources is the record this page will keep.Futureweb.

Who is actually obligated

Federal civilian agencies under BOD 26-04 have a directive. Everyone else has CISA's request to prioritize. A private company running PAN-OS or AhsayCBS is in the product scope and not, on this alert, under the federal clock. Scope of the product and scope of the directive are different lists. Privacy is Asked directly, Did Ahsay name fix versions? On October 13 Ahsay announced hotfix versions v9.15.2.70 and v10.3.4.45. Those are the vendor's version numbers. This page does not include a recovery procedure. The document named in the sources is the record this page will keep.Privacy.

What the catalog is for

An addition means CISA says the vulnerability has been exploited. It does not include a proof, a sample, or a map of the bug. The advisory, for a vendor bug rather than a catalog row, remains the story on this desk. That brief is Asked directly, Does the alert give a due date? The alert text this paper fetched does not. This page will not supply October 17 or any other deadline the alert did not print. The document named in the sources is the record this page will keep.the advisory is the story.

Four products, four owners

PAN-OS is Palo Alto's. Secure Email Gateway is Cisco's. AhsayCBS is Ahsay's, with two CVEs on one product. A reader responsible for one of them does not need the other three, except as a list of what changed in the catalog that day. Hardware is Asked directly, Who does BOD 26-04 bind? Federal civilian executive branch agencies. CISA encourages everyone else to prioritize the catalog. Encouragement is not the same obligation. The document named in the sources is the record this page will keep. The document named in the sources is the record this page will keep.Hardware.

What this brief will not become

It will not become a workup. Identifiers, product names, the impact words Palo Alto used, Ahsay's two hotfix versions, and the absence of a due date are the record. Commands and indicators are not. Software is The short answer this page will stand on is this: CVE-2026-0322 in Palo Alto Networks PAN-OS, CVE-2026-76519 in Cisco Secure Email Gateway, and CVE-2026-105133 and CVE-2026-105134 in Ahsay AhsayCBS. Binding operational directive 26-04 applies to federal civilian agencies. The alert this paper fetched does not print a remediation due date.Software.