A Firewall, a Backup Server and an Email Gateway Walk Into KEV. Federal Deadline Saturday. Our Edge Saw None of It.
On Wednesday, October 14, CISA added four CVEs to its Known Exploited Vulnerabilities catalog, and none of them sits on a laptop. One is in a Palo Alto Networks firewall's management plane. Two are a chain in AhsayCBS, the backup server a lot of managed service providers run for their clients. The last is in Cisco's Secure Email Gateway, the box whose whole job is to open strangers' attachments. Three vendors, one KEV day, and the same federal due date on all four: Saturday, October 17. That is three days from listing, and as I write this on Thursday, two.
The pattern isn't new, but it keeps getting louder. The appliance you bought to stand at the front door has become the front door. It is reachable from the internet by design, it runs as root or SYSTEM, and nobody puts an EDR agent on it. Here's what each one needs from you, what we put in our feed, and what our own edge saw, which was nothing.
The deadline, read straight from the catalog
We pulled all four entries from our copy of the KEV catalog on October 15. CVE-2026-0322, CVE-2026-105133, CVE-2026-105134 and CVE-2026-76519 all show a dateAdded of 2026-10-14 and a dueDate of 2026-10-17. The required action cites BOD 26-04 and CISA's forensics triage requirements, which is the government's way of saying patch, then check whether you were already had. Ransomware use is listed as unknown on all four. If you're not a federal agency, the date doesn't bind you. It's still the best free priority signal you'll get this week.
Palo Alto PAN-OS: the management interface, again
I spent time at Palo Alto, and the lecture about keeping the management interface off the internet is older than some of the firewalls still running it. CVE-2026-0322 is the reason the lecture exists. Palo Alto's advisory, published October 14, calls it authenticated remote code execution in the management interface: an attacker who can reach that interface and holds an administrator login gets code execution as root. CVSS 4.0 puts it at 8.6, and Palo Alto rates the urgency HIGHEST. PA-Series, VM-Series and Panorama are affected. Cloud NGFW and Prisma Access are not.
The authentication requirement sounds reassuring. It shouldn't. Admin credentials leak, get reused, and get phished, and an attacker who already has them gets root on the box that inspects all your traffic. Palo Alto says it has seen "very limited exploitation" and lists three addresses associated with the threat activity: 66.42.72.14, 208.83.239.114 and 149.248.47.234.
Fixed builds: 12.2.4, 11.2.16 (Palo Alto gave it an ETA of October 15), and per-branch hotfixes on 12.1, 11.1 and 10.2. The advisory lists them all, so match your exact train there. There is no workaround. The mitigation is the old one: restrict management access to trusted internal addresses, ideally a single jump box. Threat IDs 510046 and 510047 give limited coverage, and only if you decrypt the management traffic.
AhsayCBS: when the backup server is the way in
This is the one that should worry MSPs most. On October 8, Huntress researchers Dray Agha, Olly Maxwell, Tyler Bohlmann and Amelia Casley published what they'd been watching since October 7 at 23:20 UTC. Attackers used CVE-2026-105133, an authentication bypass in the checkSysPwd function, to get past the login, then CVE-2026-105134, a command injection in the replication receiver at /rps/api/json/UpdateReceivers.do, to run commands as SYSTEM. Five organizations had been targeted as of October 8.
What came next was a cryptominer wearing a Microsoft costume. The attackers dropped JSP webshells into the web app directory, pulled payloads from an Alibaba Cloud storage bucket with curl and certutil, and installed XMRig as edge.exe. A modified copy of NSSM, renamed msedge.exe, ran the miner as a service called MicrosoftEdgeUpdateSvc. A script called Taskgmr.ps1, which Huntress says looks AI-assisted, paused the miner whenever someone opened Task Manager and started it again when they closed it. In one incident they fetched WinRing0x64.sys, a legitimate but vulnerable kernel driver.
Here is why a miner on a backup server matters more than it sounds. The backup console holds credentials for, and a network path to, every client it backs up. Today's tenant is mining Monero. The next tenant to find the same hole may want the backups.
On the fix, read carefully. Early NVD scoping didn't list 10.3.4 as affected. Huntress found on October 8 that it was. On October 12 Ahsay shipped a hotfix, and Huntress verified that build 10.3.4.45 closes the authentication bypass, which also cuts off the command injection behind it. Earlier v10 builds, including 10.3.4.0, stay exploitable at the entry point. Fixed builds: 10.3.4.45 for v10, and 9.15.2.70 for v7, v8 and v9. If you patched to "10.3.4" in the first days and stopped, you aren't done.
Cisco Secure Email Gateway: the box that opens attachments for a living
Cisco published CVE-2026-76519 on October 14 at 16:00 GMT, CVSS 9.8. When the File Reputation service is turned on and assigned to a mail policy, an unauthenticated attacker can send a crafted email whose attachment writes arbitrary files and leads to commands running as root. Nobody has to click anything. The gateway reads the mail because reading mail is its job. Cisco says PSIRT became aware of active exploitation in October 2026.
Affected: physical and virtual Secure Email Gateways where File Reputation is on and Content Scanner Tools is older than 25.3.0.5525. Fixed: AsyncOS 15.5.5-014 or 16.5.0-780, or Content Scanner Tools 25.3.0.5525 or later, which can be updated without a restart. There's no workaround. This is the second Secure Email Gateway entry in KEV in thirty days, after the unauthenticated SQL injection CVE-2026-76461 on September 14, and the third since December 2025 counting CVE-2025-20393.
Cisco published no IP addresses or hashes. It did publish an on-box check: grep the system logs for "System Security" on every cluster member. "Suspected compromise indicator was found" or "Security scan did not complete" means call TAC. Cisco also says to check your firewall logs for unexpected uploads from the gateway, because root on the box means local evidence can be erased.
What we put in the feed, and whose work it is
On October 15 we ingested every hard indicator the vendors published, credited to them, under campaign sources you can query. From Palo Alto: the three IPs, under manual-batch-panos-0322. From Huntress: six attacker IPs, the SHA-256 hashes of msedge.exe, edge.exe and Taskgmr.ps1, and the five staging URLs, under manual-batch-ahsaycbs-huntress. Every record was written, read back by its primary key, and checked in the downloaded CSVs. The IPs are at confidence 80, in the free ips.csv. The hashes are in hashes.csv. One address, 177.4.12.11, was ingested a few minutes later than the rest, so if your CSV pull caches, it may show up one refresh behind.
We left the mining pools out on purpose. Huntress names a pool on xmr.kryptex.network and the address 51.195.127.124. Pools are shared infrastructure that legitimate miners use too, so blocking them by address would be noise. We didn't score them low. We didn't ingest them. We didn't ingest anything for the Cisco bug either, because there's nothing public to ingest.
None of this is our detection. Palo Alto and Huntress found these indicators, and we redistribute them so a shop that can't afford a commercial feed gets the same list for free. One footnote: 177.4.12.11 was already in our corpus before Huntress published, because ThreatFox listed it on port 8080 as a payload host on October 3. That's ThreatFox's catch, carried in our feed as a ThreatFox record. It isn't ours, and it isn't a lead.
What our edge saw: nothing, because it couldn't
We ran our edge check across every instrument from August 1 to today: 43,699 edge blocks, 70,851 canary hits and 4,997 origin honeypot captures. None of the nine attacker IPs appears in any of them. Neither does any AhsayCBS path: no UpdateReceivers.do, no /rps/api, no checkSysPwd.
For PAN-OS, the only thing close was eleven requests for /php/login.php, blocked at the edge, nearly all from LeakIX's l9scan crawler on DigitalOcean. That's inventory scanning on a path plenty of products share, not this bug. CVE-2026-0322 needs an admin login, so there's no unauthenticated request we could have caught in the first place. Cisco's bug arrives as an email, which a web honeypot will never see.
So say it plainly: a zero here isn't evidence that nobody is attacking these products. We run none of them, and our honeypots don't pretend to be any of them. We closed the same kind of blind spot for NetScaler, FortiGate and SonicWall SMA1000 by putting decoys at the edge shaped like those appliances. Palo Alto and Ahsay consoles are candidates for the same treatment. Until then, our zero means we weren't looking, not that it isn't happening.
If you have an hour: the cash-poor checklist
Palo Alto: find every PA-Series, VM-Series and Panorama you own and check whether its management interface answers from the internet. If it does, close that today, before you patch, because closing it is free and works in minutes. Then move to the fixed build for your branch, and rotate admin passwords and API keys on any box whose management interface was exposed. Search your logs for the three addresses.
AhsayCBS: if you're an MSP running CBS, check the build number, not the major version. You want 10.3.4.45 or 9.15.2.70. Until then, put the console behind a VPN or an allowlist. Then hunt: look for child processes of cbssvcX64.exe, a service named MicrosoftEdgeUpdateSvc, edge.exe or msedge.exe outside Program Files, JSP files you didn't put in the web directory, and replication receivers you didn't configure. If you find any of it, Huntress's advice is to re-image from a trusted backup, because the attackers left secondary backdoors. Their four Sigma rules are in their threat-intel repository.
Cisco Secure Email Gateway: check whether File Reputation is enabled and run contentscannerstatus. If you're under 25.3.0.5525, update Content Scanner Tools, which doesn't need a restart, then plan the AsyncOS upgrade. Run the "System Security" grep on every cluster member and keep the output. If it says anything other than "No compromise indicator was found," call TAC before you do anything else.
All three: pull our ips.csv and hashes.csv and block or alert on what's there. Then ask the uncomfortable question. How many other boxes on your perimeter run as root, take traffic from the internet, and have never had an agent on them? That list is your real attack surface.
Primary sources: CISA's KEV catalog (entries dated October 14, 2026), Palo Alto Networks' advisory for CVE-2026-0322, Huntress's October 8 report "Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer" (updated October 12), Ahsay's patch announcement for CVE-2026-105133 and 105134, and Cisco advisory cisco-sa-esa-afw-zqYJkjxp.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
How do AI models see YOUR brand?
AIPM has audited 250+ domains. 15 seconds. Free while still in beta.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=a-firewall-a-backup-server-and-an-email-gateway-walk-into-kev-federal-deadline-friday-our-edge-sa
Comments