CISA adds four vulnerabilities to catalog as Microsoft patches record issues

The Cybersecurity and Infrastructure Security Agency added four new vulnerabilities to its Known Exploited Vulnerabilities catalog on October 14, 2026, due to evidence of active exploitation. CISA Alerts reported that the additions include a PAN-OS code injection vulnerability tracked as CVE-2026-0322, a Cisco Secure Email Gateway relative path traversal vulnerability tracked as CVE-2026-76519, and an Ahsay AhsayCBS flaw tracked as CVE-2026-105133. [1]

The agency stated that these vulnerability types serve as frequent attack vectors for malicious cyber actors and create significant risks for federal infrastructure. Federal Civilian Executive Branch agencies must prioritize rapid remediation under Binding Operational Directive 26-04, which establishes risk-based vulnerability management rules. [1]

In related patching developments, SecurityWeek and Cyber Press both reported that Microsoft fixed a record 1,413 vulnerabilities in its October 2026 Patch Tuesday update. SecurityWeek noted that the fixes include an actively exploited Windows zero-day security feature bypass flaw, tracked as CVE-2026-96951. According to SecurityWeek, the releases resolve 1,102 security flaws in Windows, 134 in Office, 61 in developer tools, 36 in SharePoint Server, and additional flaws across Azure, Exchange Server, and Defender. [2][5]

CyberSecurityNews also reported that CISA issued a warning regarding an Apache Struts command injection vulnerability being exploited in active attacks. Additionally, Security Affairs reported that CISA added a Microsoft Windows Shell flaw to its Known Exploited Vulnerabilities catalog. [4][6]

As FTMQ Security reported earlier, CISA previously added a Citrix NetScaler ADC and Gateway memory overflow zero-day flaw, tracked as CVE-2026-88779, to its catalog after targeted attacks caused denial of service conditions. [9]