Ahsay AhsayCBS Command Injection Vulnerability (CVE-2026-105134) is being actively exploited, CISA warns
CISA added CVE-2026-105134 (Ahsay AhsayCBS) to its Known Exploited Vulnerabilities catalog on October 14, 2026, which means there is reliable evidence of exploitation in the wild. Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s…
Excerpt from the primary source: CISA Known Exploited Vulnerabilities
Who is affected
Enterprises · Developers
Affected technology: AhsayCBS, Cisco networking & security, PAN-OS / GlobalProtect, Secure Email Gateway
Why it matters
CISA lists this as exploited in the wild. Unpatched AhsayCBS and PAN-OS / GlobalProtect systems are exposed to active attacks now.
Automated: stated only from CISA listings and the exploitation evidence in the sources below.
What you should do · Act now
Treat this as an emergency. Identify every system running AhsayCBS, PAN-OS / GlobalProtect, Cisco networking & security and Secure Email Gateway, apply the vendor's fix or published mitigations immediately, and check for signs of compromise. Patching alone does not remove an attacker who already got in.
CISA's required action for CVE-2026-0322: "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines." US federal civilian agencies must comply by October 17, 2026.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Related
Cisco patches new Secure Email Gateway zero-day exploited in attacks
Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges.
Source reporting says attackers are already exploiting this, so exposed Cisco networking & security systems are at immediate risk.
Treat this as an emergency.
Cisco Secure Email Gateway Relative Path Traversal Vulnerability (CVE-2026-76519) is being actively exploited, CISA warns
CISA added CVE-2026-76519 (Cisco Secure Email Gateway) to its Known Exploited Vulnerabilities catalog on October 14, 2026, which means there is reliable evidence of exploitation in the wild. Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
CISA lists this as exploited in the wild. Unpatched Cisco networking & security and Secure Email Gateway systems are exposed to active attacks now.
Treat this as an emergency.
Palo Alto Networks PAN-OS Code Injection Vulnerability (CVE-2026-0322) is being actively exploited, CISA warns
CISA added CVE-2026-0322 (Palo Alto Networks PAN-OS) to its Known Exploited Vulnerabilities catalog on October 14, 2026, which means there is reliable evidence of exploitation in the wild. Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
CISA lists this as exploited in the wild. Unpatched PAN-OS / GlobalProtect systems are exposed to active attacks now.
Apply the vendor's security update for PAN-OS / GlobalProtect.
Unpatched AhsayCBS Vulnerabilities Exploited in the Wild
The flaws, CVE-2026-105133 and CVE-2026-105134, allow attackers to bypass authentication and inject OS commands.
Source reporting says attackers are already exploiting this, so exposed Microsoft Edge systems are at immediate risk.
Treat this as an emergency.