Firewall, mail gateway and backup server flaws under active attack

On 14 October 2026 the US Cybersecurity and Infrastructure Security Agency added four vulnerabilities at once to its Known Exploited Vulnerabilities catalogue. The products involved sit at three of the most exposed points in any corporate network: the firewall, the email gateway and the backup server. Federal agencies were given until 17 October 2026 to remediate.

What is affected

• Palo Alto Networks PAN-OS - CVE-2026-0322 (CVSS 8.6): A flaw in the management interface lets an authenticated attacker with network access execute arbitrary code with root privileges on the firewall. PA-Series and VM-Series firewalls and Panorama are affected; Cloud NGFW and Prisma Access are not. The vendor reports "very limited" exploitation. No workaround is available.
• Cisco Secure Email Gateway - CVE-2026-76519 (CVSS 9.8): Improper handling of email attachments allows a path traversal that writes arbitrary files to the underlying operating system and runs commands as root. It applies where the file reputation service is enabled and Content Scanner Tools is older than 25.3.0.5525.
• Ahsay AhsayCBS - CVE-2026-105133 and CVE-2026-105134: An authentication bypass and a command injection flaw in backup server software, chained together in the wild. Versions v7 through v10 are affected, and attackers are planting web shells and cryptominers on internet-facing servers.

Why it matters

What these four have in common is their position: all of them live on the outer shell of the network. The firewall management interface, the email gateway and the backup server can be targeted directly, without the classic "someone opened a bad attachment" step. Two of them reach root, which puts an attacker in a position to erase the device's own logs. That is why Cisco advises administrators to look at external network and firewall records rather than the appliance's logs when hunting for unexpected uploads to outside addresses.

The backup server deserves particular attention. Disabling backups has been the opening move of ransomware operations for years; an actively exploited flaw in the backup software itself fits that pattern uncomfortably well.

What it means for SMEs

The 17 October deadline binds only US federal agencies and creates no legal obligation elsewhere. The KEV catalogue is still useful as a practical priority list, because inclusion means one thing: this is not theoretical, it is being used in real attacks.

The common picture in smaller companies looks like this: a firewall installed years ago whose firmware has never been updated, a management interface left reachable from the internet for convenience, and a backup server sitting on the same network with the same level of neglect. Where all three conditions meet, any one of these flaws can be enough to take the whole network.

What we recommend at Kamer Bilişim

• Take management interfaces off the internet. Firewalls, server management panels and backup consoles should not be reachable from outside. Where remote administration is needed, route it through a VPN or a jump box with trusted-IP restrictions - which is exactly the mitigation Palo Alto recommends for this flaw.
• Build a firmware and version inventory. Write down the model and running version of every firewall, mail gateway and backup server you operate, then compare it against vendor advisories. A company that does not know which version runs where cannot tell whether an advisory applies to it.
• Isolate backups and rehearse restores. At least one copy should sit somewhere the production network cannot reach, ideally immutable. More importantly: a backup whose restore has never been tested is not a backup.

We can review where your firewall, email security and backup setup stands against current vulnerabilities - on site across Istanbul's Anatolian side and remotely elsewhere. Reach us through the contact page.

Source: Help Net Security (15 October 2026), CISA Known Exploited Vulnerabilities catalogue, Palo Alto Networks and Cisco security advisories