Threat actors install crypto miners via AhsayCBS flaw as CISA lists six exploited vulnerabilities

Threat actors are gaining direct control over backup servers, firewalls, and email gateways by exploiting flaws that CISA has now flagged as actively used. The agency added six vulnerabilities to its Known Exploited Vulnerabilities catalog, signaling that these weaknesses are no longer theoretical risks but immediate threats to infrastructure integrity and data availability.

In plain English

The Cisco Secure Email Gateway flaw lets attackers send a specially crafted email attachment. If the gateway processes it, the attacker can write arbitrary files to the underlying operating system. This bypasses normal email filtering controls and grants direct access to the server’s core functions.

The background

Palo Alto Networks confirmed limited exploitation of a high-severity code injection flaw in its PAN-OS management interface. An attacker with high-level privileges and network access can execute code with root rights. The flaw affects PA-Series and VM-Series firewalls, as well as Panorama appliances.

What changes now

AhsayCBS vulnerabilities allow remote attackers to bypass login checks and then run commands on servers. Starting October 7, 2026, attackers chained an authentication bypass with a command injection flaw. Huntress reported that at least five organizations were targeted by October 8.

What made it possible

Teams usually face these risks when external-facing services lack strict input validation or when authentication logic can be manipulated. Attackers exploit these gaps to gain initial access without valid credentials. Once inside, they often escalate privileges by abusing trust relationships or misconfigured administrative interfaces. Monitoring for unusual file writes or command executions helps detect these intrusions early.

Background: Firewalls

Start with a strict deny-all baseline. Define only the traffic you explicitly need. Apply rules in small batches during maintenance windows. Verify connectivity after each change. Monitor logs for denied packets to refine your policy and catch misconfigurations early.

Read the full guide: Implement Firewalls: A Step-by-Step Guide for Network Security

What to do and how to stay safe: CISA

• Review CISA’s Known Exploited Vulnerabilities catalog to identify if your infrastructure contains the listed CVEs.
• Restrict access to management interfaces of firewalls and backup systems to trusted internal IP addresses only.
• Monitor logs for unauthorized file writes or unexpected command executions on email gateways and backup servers.
• Verify that all supported software versions are updated once vendors release security patches for these specific flaws.

Step-by-step guide: Implement Email Filtering: A Step-by-Step Guide for Secure Delivery

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific products are affected by the new CISA catalog additions?

The catalog updates include Cisco Secure Email Gateway, Palo Alto Networks PAN-OS, Ahsay AhsayCBS, Fortinet Multiple Products, and BeyondTrust Remote Support.

Is there a confirmed fix for the AhsayCBS authentication bypass?

The source material does not confirm a specific patch or update has been released for the AhsayCBS vulnerabilities listed.

How severe is the Cisco Secure Email Gateway vulnerability?

Cisco confirmed the flaw, tracked as CVE-2026-76519, has a CVSS score of 9.8, which is rated as critical severity.