CISA has expanded its Known Exploited Vulnerabilities (KEV) catalog with four vulnerabilities affecting Microsoft Windows, Ivanti Connect Secure, Cisco Secure Email Gateway, and Palo Alto Networks PAN-OS.
What makes these additions particularly concerning is the nature of the affected technologies. Three of the four vendors provide products that organizations rely on to secure remote access, inspect email traffic, and protect network infrastructure.
The vulnerabilities involve security feature bypass, authentication bypass, arbitrary file writing, and remote code execution. Their inclusion in the KEV catalog indicates that exploitation has been observed in the wild, making remediation a priority rather than a routine patching exercise.
1. Microsoft Windows Shell — CVE-2026-96951
KEV Added: October 13, 2026
Microsoft Windows Shell is affected by a security feature bypass vulnerability that could allow an attacker to circumvent Windows security protections.
The weakness is significant because Windows security mechanisms are designed to prevent potentially malicious content from executing without appropriate checks. Bypassing these protections could make it easier for attackers to execute malicious content as part of a broader attack.
Recommended Actions
- Identify affected Windows systems and confirm the applicable security updates.
- Deploy Microsoft’s recommended fixes.
- Review suspicious file execution and security bypass activity.
- Validate successful remediation across managed endpoints.
Organizations should consult Microsoft’s security advisory for the precise affected builds and fixed versions.
2. Ivanti Connect Secure — CVE-2026-104935
KEV Added: October 13, 2026
CVSS Score: 8.6 — High
Vulnerability Type: Authentication Bypass
Ivanti Connect Secure contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to execute arbitrary commands.
Since Connect Secure appliances provide remote connectivity into enterprise environments, successful exploitation could expose sensitive internal resources and potentially provide attackers with a foothold inside corporate networks.
Unaffected Versions Identified
- 25.1.3.0
- 25.1.3.1
- 22.8R2.5
- 22.7R2.14
Affected versions and remediation requirements differ across release branches. Administrators should verify their deployment against Ivanti’s official advisory.
Recommended Actions
- Identify internet-facing Ivanti Connect Secure appliances.
- Apply the appropriate vendor security fixes.
- Review authentication logs and unexpected administrative activity.
- Investigate suspicious command execution and potential compromise.
3. Cisco Secure Email Gateway — CVE-2026-76519
KEV Added: October 14, 2026
CVSS Score: 9.8 — Critical
Vulnerability Type: Path Traversal / Arbitrary File Write
Cisco Secure Email Gateway is affected by a critical vulnerability involving the Advanced Malware Protection (AMP) functionality.
The vulnerability arises from improper processing of email attachments when the File Reputation service is enabled.
An unauthenticated remote attacker could exploit the weakness by sending a specially crafted email attachment through an affected gateway. Successful exploitation could allow arbitrary files to be written to the underlying operating system and commands to be executed with root privileges.
This is particularly concerning because the affected appliance is designed to inspect incoming email threats. A successful attack could compromise the security infrastructure itself.
Affected Configurations
The vulnerability affects physical and virtual Cisco Secure Email Gateway deployments when:
- AMP File Reputation is enabled and assigned to a mail policy.
- Content Scanner Tools is running a version earlier than 25.3.0.5525.
Fixed Versions
- AsyncOS 15.5 — 15.5.5-014
- AsyncOS 16.5 — 16.5.0-780
- AsyncOS 16.0 — Migration to a fixed release is required.
- Content Scanner Tools — 25.3.0.5525
Cisco has confirmed active exploitation and states that no workaround is available.
Recommended Actions
- Verify AMP File Reputation configuration and Content Scanner Tools versions.
- Upgrade to the applicable fixed release.
- Review appliance and email-processing logs for suspicious activity.
- Investigate possible compromise, particularly on externally exposed gateways.
- Restrict administrative access to trusted management networks.
Reference: Cisco Security Advisory
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp
4. Palo Alto Networks PAN-OS — CVE-2026-0322
KEV Added: October 14, 2026
CVSS Score: 8.6 — High
Vulnerability Type: Authenticated Remote Code Execution
Palo Alto Networks disclosed a vulnerability affecting the management interface of PAN-OS that could allow an authenticated attacker to execute arbitrary code with root privileges.
Although exploitation requires authentication, the risk remains significant in environments where management interfaces are accessible from untrusted networks or administrative credentials have already been compromised.
Successful exploitation could provide an attacker with elevated control over an affected firewall.
Affected Products
- PA-Series firewalls
- VM-Series firewalls
- Panorama appliances
Cloud NGFW and Prisma Access are identified as unaffected.
Recommended Actions
- Identify affected PAN-OS versions and apply the appropriate fixed releases.
- Restrict firewall management interfaces to trusted networks.
- Review administrative authentication and configuration changes.
- Investigate suspicious command execution or unexpected management activity.
- Validate remediation across firewalls and Panorama deployments.
Reference: Palo Alto Networks Security Advisory
https://security.paloaltonetworks.com/CVE-2026-0322
Remediation Priorities
Security teams should prioritize these vulnerabilities based on exposure, exploitation risk, and the criticality of affected systems.
Cisco Secure Email Gateway deserves immediate attention because of its critical severity, unauthenticated exploitation path, and potential for root-level command execution.
Ivanti Connect Secure should be assessed urgently, particularly where appliances are accessible from the internet and provide connectivity to sensitive internal environments.
Palo Alto Networks PAN-OS requires prompt remediation, with particular attention to management-interface exposure and privileged administrative access.
Microsoft Windows Shell should be addressed through the applicable security updates, supported by endpoint monitoring and investigation of suspicious activity.
Organizations should also determine whether affected systems were exposed before patches became available. Installing a security update does not establish whether a device was previously compromised.
CISA Remediation Deadlines
CISA has established the following remediation deadlines for affected US federal civilian executive branch agencies:
- October 16, 2026: Microsoft Windows Shell and Ivanti Connect Secure.
- October 17, 2026: Cisco Secure Email Gateway and Palo Alto Networks PAN-OS.
These deadlines are mandatory for covered federal agencies under applicable CISA directives. Other organizations should use the KEV additions to inform their own risk-based remediation timelines.
Final Thoughts
The latest KEV additions reinforce a familiar challenge in enterprise security. Technologies deployed to protect infrastructure can themselves become attractive targets when vulnerabilities emerge.
For organizations running the affected products, the immediate priority is to establish exposure, apply vendor-recommended fixes, and investigate indicators of compromise.
The presence of a vulnerability in the KEV catalog changes the conversation from what attackers could exploit to what they are already exploiting.
