CISA Adds Four Actively Exploited Vulnerabilities to KEV Catalog (CVE‑2026‑0322, CVE‑2026‑76519, CVE‑2026‑105133, CVE‑2026‑105134)
What It Is – The Cybersecurity and Infrastructure Security Agency (CISA) announced that four CVEs have been added to its Known Exploited Vulnerabilities (KEV) catalog after confirming active, real‑world exploitation.
Exploitability – All four flaws are confirmed to be weaponised in the wild; CISA’s inclusion in the KEV catalog signals a high likelihood of successful compromise if unpatched.
Affected Products –
- CVE‑2026‑0322 – Palo Alto Networks PAN‑OS code‑injection flaw
- CVE‑2026‑76519 – Cisco Secure Email Gateway relative‑path traversal
- CVE‑2026‑105133 – AhsayCBS improper authentication
- CVE‑2026‑105134 – AhsayCBS command injection
Why It Matters for Trust & Control Assurance
- Demonstrates the need for a continuous vulnerability‑management program that can surface and prioritize KEV‑listed flaws across heterogeneous assets.
- Provides a concrete audit point: evidence that high‑risk CVEs were identified, assessed, and remediated in line with BOD 26‑04 requirements.
- Shows that enterprises must maintain defensible evidence of patch status to satisfy regulators and demanding customers who request proof of a robust control environment.
Recommended Actions
- Cross‑reference the four CVEs against your asset inventory; flag any PAN‑OS, Cisco Secure Email Gateway, or AhsayCBS instances.
- Apply vendor‑supplied patches or mitigations immediately; document the change in your configuration‑management system.
- Capture remediation evidence (patch tickets, configuration snapshots) and map it to the “vulnerability management” control objective in your chosen framework.
- Update your risk register to reflect the residual risk if any asset cannot be patched promptly.
Source: CISA Advisory – Four Known Exploited Vulnerabilities