Grade One Press

Technology reporting you can check

News · Security & privacy

CISA orders three-day patch for four exploited flaws in PAN-OS, Cisco, and AhsayCBS

The federal cyber agency added four vulnerabilities across firewalls, email gateways, and backup software to its catalog, mandating remediation by 17 October under Binding Operational Directive 26-04.

Grade One Newsroom · 1 min read

Sources: 1 · top grade 1How evidence is graded

US agencies given three days to patch four exploited flaws

Grade 1 · Primary

Source: US Cybersecurity and Infrastructure Security Agency

What changed
CISA added four actively exploited flaws in PAN-OS, Cisco Secure Email Gateway, and AhsayCBS to its catalog, mandating a three-day remediation deadline under BOD 26-04.
Who it affects
Federal civilian agencies and organizations running Palo Alto Networks, Cisco, or Ahsay software.
What it does not tell you
The alert does not disclose threat actor identities or the number of compromised networks.

The full story Check the source

The US Cybersecurity and Infrastructure Security Agency added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog on 14 October 2026 [1].

The additions include a code injection flaw in Palo Alto Networks PAN-OS (CVE-2026-0322) and a path traversal vulnerability in Cisco Secure Email Gateway (CVE-2026-76519) [1]. Two further flaws affect Ahsay AhsayCBS backup software: an authentication bypass (CVE-2026-105133) and a command injection weakness (CVE-2026-105134) [1].

Under Binding Operational Directive 26-04, federal civilian executive branch agencies must remediate all four vulnerabilities within three days, establishing a mandatory deadline of 17 October 2026 [1].

What it covers

Mandatory remediation duties for all US Federal Civilian Executive Branch agencies running affected perimeter firewall appliances, email gateways, and cloud backup servers [1].

What it does not tell you

The catalog notice does not disclose specific threat actor groups, evidence of ransom demands, or telemetry indicating the scale of private-sector compromises [1].

Sources and their grades

  1. US Cybersecurity and Infrastructure Security Agency, CISA Adds Four Known Exploited Vulnerabilities to Catalog. Read 15 October 2026. Grade 1 · Primary Binding Operational Directive 26-04 compliance due date 17 October 2026.

A grade says how much weight a source will take, from 1 (a body that can compel an answer and has nothing to sell) to 5 (somebody describing what they sell, or themselves). The standard sets out what each grade may be used for.

Filed under Government Regulation Security Vulnerabilities

Comments

Commenting needs an account, made with nothing but an email address. A first comment is read before it appears.

More news

See all