Threat reportVulnerabilityTL-2026-3610
CISA KEV: Exploited Flaws in Palo Alto PAN-OS (CVE-2026-0322), Cisco Secure Email Gateway (CVE-2026-76519) and Ahsay AhsayCBS (CVE-2026-105133, CVE-2026-105134)
CISA KEV: Exploited Flaws in Palo Alto PAN-OS (TL-2026-3610) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-10-15. It has no confirmed attribution, affects Palo Alto Networks PAN-OS (PA-Series, VM-Series, Panorama), references 4 CVEs (CVE-2026-0322, CVE-2026-76519, CVE-2026-105133), maps to 10 MITRE ATT&CK techniques (T1036.004, T1057, T1059.001), and is covered by 9 detection rules and 23 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 4Referenced vulnerabilities
- Techniques
- 10MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 23Indicators of compromise
Key facts for TL-2026-3610
- Threat ID
- TL-2026-3610
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, technology, telecoms, finance
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 23
Malware and tooling in CISA KEV: Exploited Flaws in Palo Alto PAN-OS
Malware and tooling: JSP webshell (AhsayCBS), xmrig, NSSM, XMRig
How CISA KEV: Exploited Flaws in Palo Alto PAN-OS works
CISA added four exploited vulnerabilities to the KEV catalog on 2026-10-14: an authenticated root RCE in the PAN-OS management interface (CVSS 4.0 8.6, very limited exploitation), an unauthenticated path traversal to root command execution in Cisco Secure Email Gateway (CVSS 9.8, active exploitation, no workaround), and a chained AhsayCBS authentication bypass plus command injection used to drop webshells and an XMRig miner. Federal civilian agencies must remediate by 2026-10-17.
CVE-2026-0322 (CWE-94) affects the management interface of PAN-OS on PA-Series, VM-Series and Panorama (virtual and M-Series); Cloud NGFW and Prisma Access are not affected. An authenticated attacker with network access to the management interface can execute arbitrary code as root. The CVSS 4.0 vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/.../E:A with a score of 8.6. Palo Alto Networks states that very limited exploitation has been observed against the management interface and lists three source IPs (66.42.72.14, 208.83.239.114, 149.248.47.234). There is no known workaround; Threat Prevention signatures 510046 and 510047 give limited coverage and require SSL decryption and DP-port configuration changes. Customers should restrict management interface access to trusted internal IPs and upgrade to a fixed release in the 10.2, 11.1, 11.2, 12.1 or 12.2 branches (the 11.2.16 fix was expected on 2026-10-15). The flaw was found internally by Suraj Siddharudh of Palo Alto Networks.
CVE-2026-76519 (CWE-23, Cisco advisory cisco-sa-esa-afw-zqYJkjxp, bug CSCwu56223, CVSS 3.1 9.8, vector AV:N/AC:L/PR:N/UI:N) is a relative path traversal in the Advanced Malware Protection / file reputation handling of Cisco Secure Email Gateway. An unauthenticated remote attacker can send a crafted email attachment to write arbitrary files and execute commands as root. It is exploitable when the File Reputation service is enabled in a mail policy and Content Scanner Tools is older than 25.3.0.5525. Cisco PSIRT became aware of active exploitation in October 2026. There is no workaround. Fixes are AsyncOS 15.5.5-014, AsyncOS 16.5.0-780, migration for the 16.0 branch, or Content Scanner Tools 25.3.0.5525 or later, which needs no restart. Cisco's log check is `grep "System Security" system_logs` for the messages 'Suspected compromise indicator was found', 'Security scan did not complete' and 'No compromise indicator was found'.
CVE-2026-105133 (improper authentication in checkSysPwd() in com/ahsay/obs/api/ApiStructsAction.java, CVSS 5.5) and CVE-2026-105134 (OS command injection in the Replication Receiver component, reached via /rps/api/json/UpdateReceivers.do, CVSS 9.3) affect the AhsayCBS backup server console. Huntress observed them chained: the first bypasses authentication and the second gives code execution as SYSTEM. Exploitation began 2026-10-07 23:20:15 UTC, and Huntress saw five organizations targeted by 2026-10-08. Earlier fixes (9.15.2.59, 10.3.2 and 10.3.4.0) were incomplete, so 10.3.4 was still vulnerable. Ahsay acknowledged this on 2026-10-12 and shipped hotfix 10.3.4.45 (v10) and 9.15.2.70 (v7/v8/v9). Post-exploitation shows suspicious child processes (cmd, PowerShell) spawned by cbssvcX64.exe, JSP webshells in the application directory, and payloads fetched with curl from an Alibaba Cloud OSS bucket. The payloads were Taskgmr.ps1, a modified NSSM renamed msedge.exe, an XMRig miner renamed edge.exe, config.json and the vulnerable WinRing0x64.sys driver. Persistence is a SYSTEM service named MicrosoftEdgeUpdateSvc. Taskgmr.ps1 (assessed as AI-assisted) stops the service while Task Manager is open and kills Task Manager at 18:00 or after an hour of overnight use. No threat actor is attributed to any of the four CVEs and no public PoC is cited in the sources.
MITRE ATT&CK techniques used in TL-2026-3610
Defense Evasion
T1036.004 Masquerading: Masquerade Task or Service
Discovery
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1569.002 System Services: Service Execution
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Impact
T1496.001 Resource Hijacking: Compute Hijacking
Persistence
T1505.003 Server Software Component: Web Shell; T1543.003 Create or Modify System Process: Windows Service
Affected products and versions in CISA KEV: Exploited Flaws in Palo Alto PAN-OS
- Palo Alto Networks — PAN-OS (PA-Series, VM-Series, Panorama)
Vulnerable versions: 12.2 < 12.2.4; 12.1 < 12.1.4-h12 / 12.1.7-h8 / 12.1.10-h2; 11.2 < 11.2.4-h22 / 11.2.7-h21 / 11.2.10-h15 / 11.2.13-h3 / 11.2.16; 11.1 < 11.1.16-h3 and earlier hotfix ranges; 10.2 < 10.2.7-h38 / 10.2.10-h41 / 10.2.13-h26 / 10.2.16-h11 / 10.2.18-h12
Fixed in: 12.2.4; 12.1.4-h12; 12.1.7-h8; 12.1.10-h2; 11.2.16; 10.2.18-h12 - Cisco — Secure Email Gateway (AsyncOS, Content Scanner Tools)
Vulnerable versions: AsyncOS 15.5 and 16.0 and releases earlier than 16.5; Content Scanner Tools earlier than 25.3.0.5525 with File Reputation enabled
Fixed in: AsyncOS 15.5.5-014; AsyncOS 16.5.0-780; Content Scanner Tools 25.3.0.5525 - Ahsay — AhsayCBS
Vulnerable versions: v10 through 10.3.4.0; v7/v8/v9 before 9.15.2.70
Fixed in: 10.3.4.45; 9.15.2.70
Remediation for CISA KEV: Exploited Flaws in Palo Alto PAN-OS
Patches
- PAN-OS: upgrade to a fixed release per branch (for example 12.2.4, 12.1.10-h2, 11.2.16, 10.2.18-h12 or later)
- Cisco SEG: AsyncOS 15.5.5-014 or 16.5.0-780 or later, or Content Scanner Tools 25.3.0.5525 or later
- AhsayCBS: hotfix 10.3.4.45 (v10) or 9.15.2.70 (v7/v8/v9)
Immediate actions
- Restrict PAN-OS management interface access to trusted internal IPs only
- Block 66.42.72.14, 208.83.239.114 and 149.248.47.234 and hunt management-interface logs for activity from them
- Restrict AhsayCBS management interface to trusted IPs or require VPN
- On Cisco SEG run grep "System Security" system_logs for compromise indicator messages
- Hunt for child processes of cbssvcX64.exe, JSP webshells in the AhsayCBS directory and the MicrosoftEdgeUpdateSvc service
- Re-image AhsayCBS hosts from trusted backups if IOCs are found
Workarounds
- PAN-OS: none known
- Cisco SEG: none available
- AhsayCBS: limit management interface exposure via IP allowlist or VPN until patched
Longer-term hardening
- Never expose management interfaces or backup consoles to the internet
- Alert on Edge-named binaries with daemonized flags or mismatched original file names
- Enable SSL decryption and Threat Prevention signatures 510046 and 510047 on PAN-OS as limited coverage
CVEs associated with CISA KEV: Exploited Flaws in Palo Alto PAN-OS
CVE-2026-0322, CVE-2026-76519, CVE-2026-105133, CVE-2026-105134
Weaknesses (CWE) in CISA KEV: Exploited Flaws in Palo Alto PAN-OS
Timeline of CISA KEV: Exploited Flaws in Palo Alto PAN-OS
- CVE-2026-105133 and CVE-2026-105134 identifiers for AhsayCBS published (per The Hacker News)
- Huntress observes first exploitation of AhsayCBS CVE-2026-105133 / CVE-2026-105134 at 23:20:15 UTC
- Huntress publishes analysis of the AhsayCBS chain; five organizations targeted; webshells and XMRig deployed
- Ahsay acknowledges incomplete earlier patches (9.15.2.59, 10.3.4.0) and releases hotfix 10.3.4.45 and 9.15.2.70
- CISA adds CVE-2026-0322, CVE-2026-76519, CVE-2026-105133 and CVE-2026-105134 to the KEV catalog
- Palo Alto Networks publishes CVE-2026-0322 advisory, reporting very limited exploitation and three attacker IPs
- PAN-OS 11.2.16 fix expected; Help Net Security reports the CISA additions
- Remediation deadline for federal civilian agencies
Sources cited for CISA KEV: Exploited Flaws in Palo Alto PAN-OS
- CISA flags exploited flaws in Palo Alto, Cisco and Ahsay products (Help Net Security)
- CISA Adds Four Known Exploited Vulnerabilities to Catalog
- Palo Alto Networks Advisory CVE-2026-0322 PAN-OS: Authenticated RCE in the Management Interface
- Cisco Secure Email Gateway Arbitrary File Write Vulnerability (cisco-sa-esa-afw-zqYJkjxp)
- Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer (Huntress)
- Ahsay patch announcement for CVE-2026-105133 / CVE-2026-105134
- Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks (BleepingComputer)
- Attackers Exploit AhsayCBS Flaws to Deploy Webshells and Cryptominers (The Hacker News)
Detection coverage for TL-2026-3610
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3610 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.