PAN-OS code injection CVE-2026-0322 is being exploited now
CISA added Palo Alto Networks PAN-OS code injection flaw CVE-2026-0322 (CVSS 7.2) to the Known Exploited Vulnerabilities catalog on October 14, and Cyber Security News confirmed CISA is warning it is being used in attacks. If you run PAN-OS, this is a patch-now item, not a patch-eventually one. Being on the KEV list means federal agencies have a hard deadline and everyone else should treat it the same way.
The same KEV batch brought four more exploited flaws worth your attention. Cisco Secure Email Gateway relative path traversal CVE-2026-76519 carries a CVSS of 9.8. Ahsay AhsayCBS command injection CVE-2026-105134 is a maximum-severity 10.0, paired with authentication bypass CVE-2026-105133 at 7.3. Atlassian multiple products flaw CVE-2026-21589 (CVSS 7.5) rounds out the additions. All five were added October 14 and 15.
Chinese APT exploited a BeyondTrust zero-day since August
Multiple outlets reported that a Chinese APT exploited a BeyondTrust zero-day, tracked as CVE-2026-102764, to gain root access and deploy backdoors. SecurityWeek, BleepingComputer, and Cyber Security News all covered it, and BleepingComputer notes the activity dates back to August and could grant full admin access in minutes. BeyondTrust has now shipped a patch. If you run their privileged access products, apply it and hunt for signs of prior compromise rather than assuming your perimeter held.
What the press adds on Office, GitLab, and Adobe
Microsoft's October rollout patched two dozen remote code execution flaws in Office, per SecurityWeek, so Office deployments need the current updates. A proof-of-concept exploit is now public for a critical GitLab RCE, CVE-2026-97229, which shortens the window before opportunistic scanning begins. Adobe also fixed a critical Acrobat flaw, CVE-2026-81983, where a malicious PDF can trigger one-click memory corruption.
One operational caveat on the Windows side: BleepingComputer reports the October update delivered in KB5127648 may break Smart App Control. Test before broad deployment, but do not let that delay the security fixes bundled in this month's cumulative updates.
Ransomware-linked movers to watch
Three high-ranking exploited CVEs this cycle carry ransomware linkage, which is the clearest signal to move fast. JetBrains TeamCity deserialization flaw CVE-2026-63077 (CVSS 9.8), Oracle PeopleSoft PeopleTools missing authentication CVE-2026-35273 (CVSS 9.8), and WebPros cPanel and WHM missing authentication CVE-2026-41940 (CVSS 9.8) are all KEV-listed and ransomware-associated. ProFTPD CVE-2015-3306 remains the top mover with an EPSS of 0.995.
Do this first
Work the KEV additions and the ransomware-linked movers in order.
- Patch PAN-OS for CVE-2026-0322 and hunt, given confirmed exploitation.
- Apply the BeyondTrust fix for CVE-2026-102764 and check for backdoors dating to August.
- Update Cisco Secure Email Gateway (CVE-2026-76519) and AhsayCBS (CVE-2026-105134, CVE-2026-105133).
- Deploy October Office and Windows updates; stage KB5127648 carefully due to the Smart App Control issue.
- Prioritize ransomware-linked CVE-2026-63077, CVE-2026-35273, and CVE-2026-41940.
Check your own exposure
Senserva's free non-Microsoft exploited-CVE tracker follows CISA KEV additions daily, so you can confirm whether today's PAN-OS, Cisco, and Ahsay adds touch your estate. The free Microsoft Patch Tracker ranks open Microsoft patches by KEV, EPSS, and ransomware linkage to help you sequence the Office and Windows work this week.
Sources
- Cyber Security News: CISA Warns of Palo Alto Networks PAN-OS Code Injection Vulnerability Exploited in Attacks (2026-10-16)
- Cyber Security News: Chinese Hackers Exploit BeyondTrust Zero-Day to Gain Root Access and Deploy Backdoors (2026-10-16)
- SecurityWeek: Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day (2026-10-16)
- BleepingComputer: BeyondTrust patches zero-day exploited in attacks since August (2026-10-16)
- SecurityWeek: Microsoft Patches Two Dozen RCE Flaws in Office (2026-10-16)
- Cyber Security News: PoC Exploit Released for Critical GitLab RCE Vulnerability (CVE-2026-97229) (2026-10-16)
- Cyber Security News: Critical Adobe Acrobat Flaw Lets Malicious PDFs Trigger One-Click Memory Corruption (2026-10-16)
- BleepingComputer: Microsoft: October Windows update may break Smart App Control (2026-10-16)
- CISA Cybersecurity Advisories: CISA Adds One Known Exploited Vulnerability to Catalog (2026-10-15)
Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-10-16.
Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.