Attackers Exploit Firewall, Email Gateway and Backup Server Flaws

The US Cybersecurity and Infrastructure Security Agency (CISA) added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue on 14 October 2026, confirming that attackers are already using them. The flaws affect three kinds of equipment that sit at the edge of many business networks: Palo Alto Networks firewalls, Cisco email security gateways and AhsayCBS backup servers. CISA gave US federal civilian agencies until 17 October to fix them.

The deadline is a US government requirement, but these products are widely used by companies, banks, universities and managed service providers across Africa and elsewhere. If your organisation, or an IT provider that manages your systems, runs any of them, treat this as urgent.

Palo Alto Networks PAN-OS: CVE-2026-0322

This high-severity flaw (CVSS 8.6) affects the management interface of PAN-OS, the operating system on Palo Alto Networks firewalls. According to Help Net Security’s summary of the vendor advisory, an attacker who is authenticated and can reach the management interface over the network can run code with root privileges, the highest level of control on the device.

Affected: PA-Series and VM-Series firewalls, and Panorama management appliances. Cloud NGFW and Prisma Access are not affected.

Fix: Fixed releases are available for PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2. Devices on unsupported versions must be upgraded to a supported, fixed release. There is no workaround, but limiting access to the management interface to trusted internal IP addresses significantly reduces the risk. Palo Alto Networks’ advisory also lists IP addresses linked to exploitation attempts, which administrators can check against their logs.

Cisco Secure Email Gateway: CVE-2026-76519

This is a critical path traversal bug (CVSS 9.8) in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway. An attacker can trigger it simply by sending a specially crafted email attachment, which makes it especially dangerous, because the gateway’s job is to process incoming mail from anyone.

Affected: Physical and virtual appliances where File Reputation is enabled and assigned to a mail policy, and where the Content Scanner Tools component is older than version 25.3.0.5525.

Fix: Cisco says there is no workaround. Administrators can either install Content Scanner Tools 25.3.0.5525 or later, which does not need an operating system upgrade or restart, or move AsyncOS releases older than 16.5 to 16.5.0-780. Because an attacker with root access can cover their tracks on the appliance itself, Cisco’s guidance is to also review external firewall and network logs for unexpected uploads to outside IP addresses.

AhsayCBS backup servers: CVE-2026-105133 and CVE-2026-105134

AhsayCBS is backup server software used by many hosting companies and IT service providers to store their clients’ backups. Two flaws are being chained together: an improper authentication bug (CVE-2026-105133) lets attackers get past the login, and a critical command injection bug (CVE-2026-105134) then lets them run commands with SYSTEM privileges.

Help Net Security reports that attackers have used the chain to plant web shells and cryptocurrency miners on internet-facing servers. Earlier patches (v9.15.2.59 and v10.3.4.0) turned out to be incomplete, so a server that was patched previously may still be exposed.

Fix: Version 10 users should install the v10.3.4.45 hotfix, and users of versions 7, 8 and 9 should install v9.15.2.70. Both are available from Ahsay’s partner portal, and the server must be rebooted afterwards. Testing by security firm Huntress indicates the 10.3.4.45 hotfix blocks the first step of the attack chain.

Why edge devices keep getting hit

Firewalls, email gateways and backup servers have three things in common: they face the internet, they are trusted by everything behind them, and they are often patched less often than laptops because nobody wants to interrupt mail flow or backups. That combination makes them attractive targets. A compromised backup server is particularly serious, because backups are what businesses rely on to recover from ransomware.

Many small businesses do not manage these devices directly. They are often looked after by an internet provider, a hosting company or an outsourced IT firm. That is fine, as long as someone is clearly responsible for applying security updates and can confirm that it has been done.

What you should do

1. Find out whether you use these products. Check your asset list, or ask your IT provider directly whether you run PAN-OS firewalls, Cisco Secure Email Gateway or AhsayCBS.
2. Patch now, not at the next maintenance window, using the fixed versions listed above.
3. Lock down management interfaces. Firewall and appliance admin pages should never be reachable from the open internet. Restrict them to a management network or VPN.
4. Re-check previously patched Ahsay servers, since the earlier fixes were incomplete.
5. Look for signs of compromise: unknown files in web folders, unexpected high CPU use (a common sign of cryptominers), new admin accounts and unusual outbound traffic.
6. Protect your backups. Keep at least one recent copy offline or in separate storage that the backup server cannot overwrite.
7. Ask your provider for written confirmation that the updates were applied, with the date and version numbers.

Sources

• CISA: CISA Adds Four Known Exploited Vulnerabilities to Catalog
• Help Net Security: CISA flags exploited flaws in Palo Alto, Cisco and Ahsay products

Featured image: Photo: “IMG_0668” by Jemimus, CC BY 2.0, via Openverse — source