Four more security flaws joined the Known Exploited Vulnerabilities (KEV) catalog on 14 October 2026, the US agency CISA said. It added them because it has evidence of active exploitation. They are a code injection flaw in Palo Alto Networks PAN-OS (CVE-2026-0322) and a path traversal flaw in Cisco Secure Email Gateway (CVE-2026-76519). Two more hit Ahsay AhsayCBS: improper authentication (CVE-2026-105133) and command injection (CVE-2026-105134).
CISA's notice does not name the attackers or say how many systems were hit. It gives no affected versions and no fixes. In plain terms, code and command injection let an attacker make a system run instructions it should not. Path traversal lets an attacker reach files outside the intended folder. Improper authentication means the login check can be bypassed.
A KEV listing means attacks are already happening, which is a firmer signal for patch order than a flaw's rating. CISA's rule for federal civilian agencies, BOD 26-04, puts exposed systems that give full control first. It also expects agencies to check for break-ins that came before the patch. Executives can ask three things. Do we run these products? Are they reachable from the internet? Who checks for earlier compromise?