CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection Vulnerability CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Vulnerability CVE-2026-105133 Ahsay AhsayCBS Improper Authentication Vulnerability CVE-2026-105134 Ahsay AhsayCBS Command Injection Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities . CISA will continue to add vulnerabilities to the catalog that meet the specified criteria . Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form . Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.
Palo Alto Networks
paloaltonetworks.comPalo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. [...]
Confidence & Source Corroboration
Sovereign Directives, KEV Catalog & Technical Alerts
Target Vendor Technical Disclosures & Patch Bulletins
The company says it’s aware of limited exploitation against customers’ firewalls, and it has made IoCs available. The post Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution appeared first on SecurityWeek .
Technical Forensic Briefing
Incident Overview
Palo Alto Networks, within its operating sector, has been subject to a cybersecurity incident. Ground-truth telemetry indicates the threat activity is currently unconfirmed or under forensic attribution. Active vulnerability telemetry tracks associated Common Vulnerabilities and Exposures: CVE-2026-0322.
Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. [...]
Compromised Assets & Data Scope
The specific volume of affected customer or organizational records remains under active forensic investigation. Primary affected online infrastructure and perimeter domains include paloaltonetworks.com.
Specific classes of compromised records, credentials, or proprietary information continue to be audited through ongoing forensic investigation.
Authoritative Directives & Vendor Disclosures
- Continuous Telemetry Monitoring: Formal statutory regulatory filings (SEC Form 8-K, State AG portals) and sovereign agency advisories (CISA, NCSC) are continuously monitored via automated ingestion pipeline.
Milestone Timeline (9 events logged)
Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks
CISA Adds Four Known Exploited Vulnerabilities to Catalog
Press Coverage: Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution
Press Coverage: CISA flags exploited flaws in Palo Alto, Cisco and Ahsay products
Press Coverage: U.S. CISA adds Palo Alto Networks PAN-OS, Ahsay AhsayCBS, and Cisco Secure Email Gateway flaws to its Known Exploited Vulnerabilities catalog
Press Coverage: PEERSTITCH malware: How Attackers Compromised 500 Firewalls Through FortiManager
Press Coverage: Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
Press Coverage: Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
Press Coverage: PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity
Have updated information or a new verifiable source?
This incident record is a flat Markdown file tracked in Git. Propose an update or add a milestone via Pull Request.