Multiple security vulnerabilities have been identified in PAN-OS, a secure email gateway product, and AhsayCBS. The flaws include code injection, path traversal, improper authentication, and command injection, and they have been added to a public catalog of known exploited vulnerabilities based on evidence of active exploitation. These issues can allow attackers to gain unauthorized access or execute code on affected systems, creating significant risk to exposed environments.
CVE-2026-0322: A code injection vulnerability in PAN-OS can allow an attacker to inject and execute code on affected systems. The flaw affects the PAN-OS product and may be exploited by an attacker with access to the vulnerable component.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in PAN-OS, a secure email gateway product, and AhsayCBS. The flaws include code injection, path traversal, improper authentication, and command injection, and they have been added to a public catalog of known exploited vulnerabilities based on evidence of active exploitation. These issues can allow attackers to gain unauthorized access or execute code on affected systems, creating significant risk to exposed environments.
CVE-2026-0322: A code injection vulnerability in PAN-OS can allow an attacker to inject and execute code on affected systems. The flaw affects the PAN-OS product and may be exploited by an attacker with access to the vulnerable component.[emaillocker id="1283"]
CVE-2026-76519: A relative path traversal vulnerability in a secure email gateway product can allow an attacker to access files or resources outside the intended directory. The flaw affects the email gateway component and may be exploited by an attacker able to submit crafted requests.
CVE-2026-105133: An improper authentication vulnerability in AhsayCBS can allow an attacker to bypass authentication controls and gain unauthorized access. The flaw affects the AhsayCBS product and may be exploited by an attacker able to reach the vulnerable authentication logic.
CVE-2026-105134: A command injection vulnerability in AhsayCBS can allow an attacker to inject and execute system commands. The flaw affects the AhsayCBS product and may be exploited by an attacker able to reach the vulnerable input handling.
These vulnerabilities collectively present a significant risk to organizations with exposed assets, particularly those running affected software. Because active exploitation has been reported, environments with internet-facing or otherwise reachable instances are most at risk. Organizations should prioritize risk-based vulnerability management and monitor for signs of compromise.
The following reports contain further technical details:
[/emaillocker]