PAN-OS and Cisco Secure Email Gateway zero-days added to KEV
The headline on 2026-10-15 is a cluster of edge-device zero-days that CISA added to the Known Exploited Vulnerabilities catalog on 2026-10-14. These are not theoretical. They are being used in attacks right now, which moves them from patch eventually to patch now.
CVE-2026-0322 in Palo Alto Networks PAN-OS is a code injection flaw that attackers are using to gain root code execution on firewalls, per Cyber Security News and SecurityWeek. Palo Alto has shipped a patch. A firewall that an attacker can run code on as root is a full compromise of your network boundary, so treat this as top priority.
CVE-2026-76519 in Cisco Secure Email Gateway is a relative path traversal rated CVSS 9.8 and is being exploited as a zero-day. Cisco has warned on it, CERT-EU published advisory 2026-017, and both Cyber Security News and SecurityWeek cover active exploitation. CVE-2026-105133 (improper authentication, CVSS 7.3) and CVE-2026-105134 (command injection, CVSS 10) in Ahsay AhsayCBS round out the same KEV batch.
Ivanti Connect Secure credential theft
One day earlier, on 2026-10-13, CISA added CVE-2026-104935, an authentication bypass by spoofing in Ivanti Connect Secure rated CVSS 8.6. CISA is warning that attackers are exploiting this zero-day to steal credentials, per Cyber Security News. It also sits at rank 5 among the hottest CVEs with an EPSS score of 0.2598. If you run Connect Secure, apply the Ivanti fix and rotate any credentials that could have been exposed.
Also added on 2026-10-13 was CVE-2026-96951, a Microsoft Windows command injection vulnerability. Keep it on the same patch-now list as the rest of this week's KEV adds.
Ransomware-linked movers and this month's Windows updates
Among the hottest exploited CVEs, three carry explicit ransomware linkage: CVE-2026-63077 in JetBrains TeamCity (CVSS 9.8, EPSS 0.8957), CVE-2026-35273 in Oracle PeopleSoft PeopleTools (CVSS 9.8, EPSS 0.9668), and CVE-2026-41940 in WebPros cPanel and WHM (CVSS 9.8, EPSS 0.9853). Ransomware linkage plus near-certain EPSS is the strongest signal to patch immediately if you run any of these.
On the Microsoft side, this month's cumulative updates carry large CVE counts and KEV content. KB5126646 for Windows Server 2025 covers 1041 CVEs, KB5127648 for Windows 11 24H2 ARM64 covers 1008, and KB5126655 for Windows Server 2022 covers 977. Microsoft also fixed a Windows 11 update issue that caused black screens or Explorer crashes, per Cyber Security News, so the usual check-before-you-ship caution applies.
What else the press is reporting
Cyber Security News flagged multiple Active Directory vulnerabilities (CVE-2026-69982, CVE-2026-96252, CVE-2026-108131) that let attackers bypass a security feature remotely, and a Windows Server zero-day CVE-2026-70111 that can crash servers with a single packet. A proof of concept is out for the Fortinet FortiClient EMS authentication bypass CVE-2026-35616, so expect broader exploitation attempts soon.
Microsoft disrupted a phishing network tied to more than a billion scam messages, per Help Net Security. On the defensive planning side, NCSC refreshed its TLS guidance and published post-quantum updates to it.
Do this first
Work the newly exploited edge devices before anything else, then verify your Windows patch state.
- Patch PAN-OS for CVE-2026-0322 and Cisco Secure Email Gateway for CVE-2026-76519 now; both are exploited zero-days.
- Patch AhsayCBS (CVE-2026-105133, CVE-2026-105134) and Ivanti Connect Secure (CVE-2026-104935), then rotate credentials that touched those systems.
- Prioritize ransomware-linked CVE-2026-63077, CVE-2026-35273, and CVE-2026-41940 where those products exist in your estate.
- Deploy this month's Windows cumulative updates, watching for the black screen and Explorer issue Microsoft just addressed.
- Use the free Senserva Microsoft Patch Tracker to rank your open Microsoft patches by KEV, EPSS, and ransomware linkage, and the non-Microsoft exploited-CVE tracker to follow these KEV additions.
Sources
- Cyber Security News: Hackers Exploit Palo Alto PAN-OS 0-day Flaw to Gain Root Code Execution on Firewalls (2026-10-15)
- SecurityWeek: Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution (2026-10-15)
- Cyber Security News: Cisco Secure Email Gateway 0-Day Vulnerability Actively Exploited in Attacks (2026-10-15)
- SecurityWeek: Cisco Warns of Exploited Secure Email Gateway Vulnerability (2026-10-15)
- CERT-EU: 2026-017: Critical Vulnerability in Cisco Secure Email Gateway (2026-10-15)
- Help Net Security: CISA flags exploited flaws in Palo Alto, Cisco and Ahsay products (2026-10-15)
- Cyber Security News: CISA Warns of Hackers Exploiting Ivanti Connect Secure Zero-Day to Steal Credentials (2026-10-15)
- CISA Cybersecurity Advisories: CISA Adds Four Known Exploited Vulnerabilities to Catalog (2026-10-14)
- Cyber Security News: Microsoft Windows Server 0-Day Flaw Lets Attackers Crash Servers With a Single Packet (2026-10-15)
- Cyber Security News: Multiple Active Directory Vulnerabilities Let Attackers Bypass Security Feature Remotely (2026-10-15)
- Cyber Security News: PoC Released for Critical Fortinet FortiClient EMS Authentication Bypass Vulnerability (2026-10-15)
- Cyber Security News: Microsoft Fixes Windows 11 Update Issue that Causes Black Screen Errors or Windows Explorer crash (2026-10-15)
- Help Net Security: Microsoft disrupts phishing network behind more than a billion scam messages (2026-10-15)
Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-10-15.
Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.