Three IT Checks This Week: Cisco Email Gateway Attachments, Ahsay Backup Servers, and Palo Alto Firewalls

All three items this week are exploited bugs in equipment that sits at the edge of an office network: the appliance that scans incoming email, the server that stores backups, and the firewall. CISA added all three to its Known Exploited Vulnerabilities catalog on October 14.

None of these is a "patch next month" job. If your office or your IT provider runs any of these products, confirm the version this week and check for signs that someone got in first.

Cisco Secure Email Gateway can be taken over by an email attachment

What happened

On October 14, Cisco published a critical advisory for CVE-2026-76519, a bug in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway, rated CVSS 9.8. Cisco says an attacker "could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device," and that a successful attack could let them "write arbitrary files and execute commands with root privileges on the underlying operating system." Nobody has to open the email. The gateway itself is the target. (Cisco advisory)

Cisco states that "In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability." CISA added it to the Known Exploited Vulnerabilities catalog the same day. This is a different bug from the Cisco email gateway flaw in our September brief, so a September patch does not cover it.

Who is affected

Physical and virtual Cisco Secure Email Gateway appliances running a vulnerable AsyncOS release, when both of these are true: the File Reputation service is enabled and assigned to a mail policy, and the Content Scanner Tools version is earlier than 25.3.0.5525. Cisco says Secure Email and Web Manager and Secure Web Appliance are not affected. For Cisco Secure Email Cloud, Cisco says it has directly contacted customers where it found signs of possible compromise.

What to check or fix now

• Find out whether your mail flows through a Cisco Secure Email Gateway, including one your IT provider or a parent company manages.
• On the appliance CLI, run contentscannerstatus. Version 25.3.0.5525 or later contains the fix. Cisco says this update needs no software upgrade or restart, and appliances with automatic Content Scanner Tools updates may already have it.
• Plan the AsyncOS upgrade too. Cisco lists 15.5.5-014 and 16.5.0-780 as first fixed releases, says 16.0 should migrate to a fixed release, and recommends 16.5.0-780 for anything older than 16.5.
• Check for signs of attack with grep "System Security" system_logs on each appliance, including every member of a cluster. "Suspected compromise indicator was found" means follow Cisco's recovery steps and contact Cisco TAC.
• Because an attacker with root access can hide evidence, Cisco also recommends reviewing firewall and network logs outside the appliance for unexpected uploads from it.

How to prevent it

Email security appliances get trusted because their job is security. They still need the same patch tracking as any server. Turn on automatic Content Scanner Tools updates if they are off, and make sure someone gets Cisco's security advisories for the products you own. More on why that matters in the importance of regular software updates.

Ahsay backup servers need a second hotfix because the first one fell short

What happened

AhsayCBS is the server side of Ahsay's backup software, often run by backup service providers and IT firms that store their customers' backups. Two bugs, CVE-2026-105133 and CVE-2026-105134, can be chained. CISA describes the first as an authentication bypass in the API component and the second as a command injection in the Replication Receiver component that "could allow a remote attacker to execute operating system commands." CISA added both to its Known Exploited Vulnerabilities catalog on October 14. (CISA KEV)

On October 12, Ahsay posted an updated alert saying its "previous patches v9.15.2.59 and v10.3.4.0 did not fully address" the two bugs. So a server that was patched earlier this month may still be exposed. (Ahsay announcement)

Who is affected

Anyone running an AhsayCBS server on versions 7 through 10 without the newest hotfix. Offices that only run the Ahsay backup client on their PCs should ask whoever runs the backup server, usually their backup or IT provider, whether it has been fixed.

What to check or fix now

• Ask your backup provider directly: "Is our AhsayCBS server on the v10.3.4.45 or v9.15.2.70 hotfix?" A yes on the earlier patch is not enough.
• If you run AhsayCBS yourself, apply the hotfix Ahsay lists for your version line: v10.3.4.45 for v10, or v9.15.2.70 for v7, v8, and v9. The downloads are on Ahsay's partner portal.
• Reboot the server after the hotfix. Ahsay's announcement says to.
• CISA flags CVE-2026-105134 for forensic triage. Review the backup server for accounts, scheduled tasks, or programs nobody recognizes.
• Confirm you still have a recent backup copy the backup server cannot change or delete, such as an offline or immutable copy.

How to prevent it

A backup server is one of the first things ransomware crews look for, because deleting backups is how they make an attack hurt more (see what a ransomware attack would cost you). Keep the backup server's admin and replication ports off the open internet where you can, and include it in the same patch checks as your firewalls and VPNs.

Palo Alto firewalls need a fix if the admin page is reachable

What happened

On October 14, Palo Alto Networks published CVE-2026-0322, a remote code execution bug in the PAN-OS management interface. It "enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall." Palo Alto rates it High severity with its highest suggested urgency, and says "Very limited exploitation has been observed targeting the Palo Alto Networks management interface." CISA added it to the Known Exploited Vulnerabilities catalog the same day. (Palo Alto advisory)

The attacker needs valid admin credentials, so this is not a drive-by attack. But it turns a stolen or reused firewall admin password into full control of the firewall.

Who is affected

PAN-OS on PA-Series and VM-Series firewalls and on Panorama, across the 10.2, 11.1, 11.2, 12.1, and 12.2 lines below the fixed builds. Palo Alto says Cloud NGFW and Prisma Access are not affected. It also says "The risk is highest when you allow access to the management interface from external IP addresses on the internet."

What to check or fix now

• Check the PAN-OS version on each firewall and Panorama, and upgrade to the fixed build for your line. Examples from the advisory: 12.2.4, 11.2.16, 11.1.16-h3, and 10.2.18-h12 or later. Older hotfix trains have their own fixed builds listed in the advisory.
• Confirm the management interface is only reachable from trusted internal IP addresses, as Palo Alto recommends. Palo Alto says a jump box that is the only system allowed to reach it lowers the risk further.
• Review firewall admin accounts. Remove ones nobody uses and change any shared or reused passwords.
• Look for management logins from the IP addresses Palo Alto lists as tied to this activity: 66.42.72.14, 208.83.239.114, and 149.248.47.234.
• Unsupported PAN-OS versions get no fix. Palo Alto's guidance is to upgrade to a supported fixed version.

How to prevent it

A firewall's admin page should never be open to the whole internet, whatever the brand. Restrict it to the office network or a VPN, give each admin their own account, and turn on multi-factor sign-in where the firewall supports it. Our guide on why your business needs a strong firewall covers the basics.

What to do this week

1. Check Cisco Secure Email Gateways for Content Scanner Tools 25.3.0.5525 or later and run the log check.
2. Confirm your AhsayCBS backup server is on the v10.3.4.45 or v9.15.2.70 hotfix.
3. Make sure you have a backup copy the backup server cannot delete.
4. Upgrade Palo Alto firewalls and Panorama to a fixed PAN-OS build.
5. Lock every firewall admin page to trusted internal addresses.

If you need someone who can handle these checks for you, reach out to us. We would be happy to help.

Sources

• Cisco Security Advisory cisco-sa-esa-afw-zqYJkjxp (CVE-2026-76519)
• CISA Known Exploited Vulnerabilities catalog, CVE-2026-76519
• NVD, CVE-2026-76519
• Ahsay security announcement (October 12, 2026)
• CISA Known Exploited Vulnerabilities catalog, CVE-2026-105133
• CISA Known Exploited Vulnerabilities catalog, CVE-2026-105134
• NVD, CVE-2026-105133
• NVD, CVE-2026-105134
• Palo Alto Networks security advisory CVE-2026-0322
• CISA Known Exploited Vulnerabilities catalog, CVE-2026-0322
• NVD, CVE-2026-0322