CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog. The set includes a Palo Alto PAN-OS code injection flaw (CVE-2026-0322), a Cisco Secure Email Gateway path traversal flaw (CVE-2026-76519), and two Ahsay AhsayCBS issues: an improper authentication vulnerability (CVE-2026-105133) and a command injection vulnerability (CVE-2026-105134).
The Ahsay improper authentication bug is the most directly identity-relevant, as authentication bypasses can let attackers access backup management systems without valid credentials, potentially exposing sensitive data and enabling further compromise. Combined with the command injection flaw, an attacker could chain unauthenticated access into full system control.
Under BOD 26-04, federal civilian agencies must prioritize rapid remediation of these KEV-listed flaws, particularly on publicly exposed assets. What to take away: Patch these quickly, especially internet-facing backup, email, and firewall appliances, and review authentication logs for signs of unauthorized access.