A mail scanner, a backup server, a firewall

Field Log // 037 Status Live Difficulty Free Cost Nothing

The Story

On 14 October CISA added four exploited bugs to its Known Exploited Vulnerabilities catalog, with a federal due date of 17 October. The three products behind them are a mail scanner, a backup server and a firewall. Every one of them was bought to make a network safer. Every one of them was this week's way in.

"Four CVEs on the exploited list" is the headline, and it flattens three very different risks into one scary number. They do not deserve equal panic, so rank them. Cisco is the worst: an unauthenticated attacker gets root. Ahsay is also unauthenticated, and the ugly twist is that the vendor's first fix did not work. Palo Alto needs an attacker who already holds a privileged admin login, which is a real risk but not the same emergency as the other two. Patch by that order, not by the order a bulletin lists them.

The Cisco one is CVE-2026-76519, rated CVSS 9.8, a relative path traversal in the Advanced Malware Protection feature of Secure Email Gateway. An unauthenticated attacker sends a crafted email attachment, writes arbitrary files, and runs commands as root on the underlying operating system. It needs two conditions to be true at once: File Reputation enabled on a mail policy, and Content Scanner Tools earlier than 25.3.0.5525. The fix is Content Scanner Tools 25.3.0.5525 or later, which in many cases needs no full upgrade and no reboot, or AsyncOS 15.5.5-014 or 16.5.0-780. There is no workaround. Cisco says its cloud instances are already mitigated and that it contacted owners where it detected possible compromise. Secure Email and Web Manager and Secure Web Appliance are not affected. This is the second exploited Secure Email Gateway flaw in roughly two months. The last one was CVE-2026-76461.

The backup server is Ahsay AhsayCBS, and it takes two bugs chained together. CVE-2026-105133 is an improper authentication flaw reached through the random parameter in the API checkSysPwd function. CVE-2026-105134 is an operating system command injection in the Replication Receiver endpoint at /rps/api/json/UpdateReceivers.do. Chained, they give an unauthenticated attacker remote code execution, often as SYSTEM. Huntress first observed exploitation on 7 October at 23:20 UTC, and counted five organisations targeted as of 8 October. Targeted, not breached: the distinction is the whole point, because being on the receiving end of an attempt is not the same as being owned. What Huntress saw was webshells and cryptomining. No ransomware and no confirmed theft of backup data has been reported. Huntress published four Sigma rules and a set of indicators of compromise.

On 10 October Ahsay confirmed that release 10.3.4.0 had not adequately addressed either flaw. The first fix did not hold. The corrective hotfix is 10.3.4.45 for version 10, delivered through the authenticated partner portal and requiring a reboot. Older lines have a separate hotfix, available from the same partner portal. There is no independent verification of the new hotfix publicly available, and that matters more than usual here, because the vendor already shipped one fix that failed. Apply it, then keep watching, because patching a hole does not remove an attacker who already came through it.

The firewall is Palo Alto PAN-OS, CVE-2026-0322, rated CVSS 8.6, a code injection in the management interface that gives root on the firewall itself or on Panorama. Read the next sentence slowly, because most coverage skips it: the attacker must already be authenticated with a high privilege account on the management interface. This is not an unauthenticated path. It is an admin who turns their access into full root. Palo Alto describes very limited exploitation and has published three addresses seen in it: 66.42.72.14, 208.83.239.114 and 149.248.47.234. The affected products are PA-Series and VM-Series firewalls and Panorama on the 10.2, 11.1, 11.2, 12.1 and 12.2 lines below the fixed builds. Cloud NGFW and Prisma Access are not affected. Restricting the management interface to trusted internal addresses or a jump box is best practice and you should do it, but on its own it closes nothing, because the attacker here is already inside the trust boundary. There is no confirmed public proof of concept.

The Build

What to actually do with four CVEs on the clock: rank them by what the attacker needs, patch the unauthenticated root bugs first, treat Ahsay as a breach-already case because the first fix failed, and do not let a management-plane bug lull you into thinking the firewall is the safe one.

1. Rank first, patch in that order, by the seventeenth

CISA put all four on the clock with the same 17 October due date. The date is shared, the urgency is not. One of these lets a stranger become root from an email. One lets a stranger become root from the internet after the vendor's first patch failed. One needs an attacker who is already your admin. Fix them in that order.

# CISA KEV, added 14 Oct, federal due date 17 Oct, ranked by what the attacker needs
#   1. CVE-2026-76519   Cisco Secure Email Gateway   unauthenticated -> root
#   2. CVE-2026-105133 + CVE-2026-105134  Ahsay AhsayCBS  unauthenticated -> SYSTEM
#   3. CVE-2026-0322    Palo Alto PAN-OS   needs a high-privilege admin first

2. Cisco: check the two conditions, then update the scanner

The bug only bites when both conditions are true, so checking is quick. If File Reputation is on a mail policy and your Content Scanner Tools are below the fixed build, you are exposed to an unauthenticated root. The scanner update often lands without a full appliance upgrade or a reboot.

# exposed only if BOTH are true
#   File Reputation enabled on a mail policy
#   Content Scanner Tools earlier than 25.3.0.5525

# fix, no workaround exists
#   Content Scanner Tools 25.3.0.5525 or later   (often no full upgrade, no reboot)
#   or AsyncOS 15.5.5-014 or 16.5.0-780
# not affected: Secure Email and Web Manager, Secure Web Appliance

3. Ahsay: the first fix failed, so treat it as already breached

This is the one to take personally if you run it, because the vendor shipped a fix on version 10.3.4.0 and then confirmed it did not work. A patch that failed once has earned skepticism, and there is no independent confirmation that the new one holds. So you patch and you hunt, in that order, and you do not assume the hotfix cleaned up after an attacker who was already in.

# patch
#   version 10 line -> hotfix 10.3.4.45, authenticated partner portal, reboot required
#   older lines     -> separate hotfix, same partner portal (version not printed here, unverified)

# then hunt, because 10.3.4.0 proved a fix can miss
#   Huntress Sigma rules and IOCs, exploitation seen from 7 Oct 23:20 UTC
#   look for webshells and cryptomining, not just the entry point
#   a hotfix closes the door, it does not evict who walked through it

4. Palo Alto: lock the management plane, and know what it does not fix

The firewall is the one people assume is safe, and here it is a root on the box, but only for an attacker who already has a privileged admin login. Restricting the management interface is correct and you should, but be honest about what it buys: it keeps outsiders off the door, it does nothing about an insider or a stolen admin credential, which is exactly the attacker this bug needs.

# affected: PA-Series, VM-Series, Panorama on 10.2, 11.1, 11.2, 12.1, 12.2 below fixed builds
# not affected: Cloud NGFW, Prisma Access

# restrict the management interface to trusted IPs or a jump box
#   closes the door to outsiders, closes NOTHING against an admin who is already in
# watch for the addresses Palo Alto published
#   66.42.72.14   208.83.239.114   149.248.47.234
# patch to the fixed build. no confirmed public proof of concept, patch anyway.

5. A list is not a risk assessment

Four CVEs on one catalog looks like one wave. It is three separate stories with three separate answers, and treating them as equal either wastes your Cisco hours on the Palo Alto bug or the reverse. The catalog tells you what is exploited. It does not tell you what to do first. You do.

# the honest read of "four exploited CVEs this week"
#   unauthenticated root is a fire. an admin-only root is a strong lock on an inside job.
#   a failed vendor fix means patch-and-hunt, not patch-and-forget.
#   rank by what the attacker must already have, then spend your time there.

Related: three holes, one patched box, root is the same lesson one week earlier, that a patch or a clean check is a claim to verify, not a result to trust.

Sources

Primary advisories and first-hand reporting, so you can check the conditions and the ranking yourself rather than taking mine.