CISA Adds Five Exploited Vulnerabilities to KEV Catalog Including AhsayCBS Authentication and Command Injection Flaws
The US Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding the confirmed exploitation of five vulnerabilities affecting Atlassian products, AhsayCBS, and several other network security solutions from multiple vendors.
On October 14, 2026, CISA added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, followed by one additional entry on October 15. The agency emphasized that these flaws are already being actively exploited and urged organizations to apply mitigations immediately.
Two of the October 14 entries concern the backup management server AhsayCBS. CVE-2026-105133 is an authentication bypass vulnerability in the product’s API, while CVE-2026-105134 is a command injection flaw in the replication functionality. When exploited together, the vulnerabilities allow an attacker to execute arbitrary operating system commands without requiring any authentication.
Ahsay stated that conventional patches are insufficient to remediate the issues and has therefore released dedicated hotfixes: AhsayCBS 10.3.4.45 and AhsayCBS 9.15.2.70.
The remaining vulnerabilities added to the KEV list involve Atlassian products and multiple network security appliances from other vendors, although specific technical details for those entries were not expanded in the current advisory.
Related articles
Google Issues Chrome Security Update Fixing Critical Vulnerability Two Days After Previous Patch
Google has released a new set of security updates for its Chrome browser that address ten vulnerabilities, including one rated critical. The update arrives just two days after a larger patch that fixed 37 issues on October 13. The most severe flaw, tracked as CVE-2026-110922, is a use-after-free vulnerability in the Prerender feature that could allow remote code execution. The company released Chrome 155.0.8059.85 and 155.0.8059.84 for Windows and macOS, along with Chrome 155.0.8059.84 for Linux on October 15. The critical issue was reported by an external researcher on October 2. Deployment will occur gradually over the next several days to weeks.
543 Vulnerabilities in FFmpeg: Hunting Flaws in the Industry Standard
FFmpeg, the open-source library serving as the de facto standard for audio and video processing in mobile apps, carries approximately 543 registered CVEs that frequently appear in bug bounty programs. A Quokka report on over 150,000 applications found critical third-party CVEs in 11% of Android and 13% of iOS apps, with high-severity issues in 65% of Android applications. The article examines three notable vulnerabilities including PixelSmash (CVE-2026-8461), HTTP chunked overflow (CVE-2016-10190), and an AV1 RTP depacketizer flaw (DFVULN-127), each enabling remote code execution through memory corruption. It provides practical guidance on locating FFmpeg binaries inside APKs, identifying integration patterns, determining versions via strings and NDK timestamps, and extracting build configurations to confirm enabled components. Analysts are shown how to locate protocol handlers that serve as entry points without requiring malicious media files. The material targets reverse engineers experienced with ELF libraries and memory corruption issues.
Anthropic OSS Scanner Uncovers 29,439 Vulnerability Candidates in Open Source Projects, Delivering 6,157 Reports and 516 Fixes
Anthropic has published detailed metrics from its six-month coordinated vulnerability disclosure program that preceded the launch of its automated OSS Scanner service. The company’s models identified 29,439 potential vulnerabilities, of which external firms verified 6,123 candidates and confirmed 5,674 as genuine issues. From the 6,157 reports sent to maintainers across 591 projects, only 516 fixes have been merged so far, representing an 8.4 percent remediation rate among delivered reports. Anthropic emphasizes that 78 percent of reports were sent without independent human triage, and the new OSS Scanner now delivers fully model-generated findings directly to approved projects. Maintainers from PostgreSQL, curl, OpenSSL, wolfSSL and HotCRP have praised the quality of recent reports while noting that earlier AI-generated submissions were largely noise. The dashboard snapshot dated 2 October 2026 shows that 584 identifiers (219 CVE and 365 GHSA) have been issued, yet many confirmed issues remain in the triage queue due to limited human resources.
Palo Alto Networks Discloses Seven PAN-OS Vulnerabilities Including One Already Exploited in the Wild
Palo Alto Networks has published seven security advisories addressing vulnerabilities in its PAN-OS operating system used on PA-series and VM-series firewalls as well as the Panorama management platform. One flaw tracked as CVE-2026-0322 allows authenticated remote code execution with root privileges through the management interface and has already been observed in limited exploitation attempts. The company rated the issue with a CVSS v4.0 base score of 8.6 and assigned it the highest remediation priority. Four additional medium-severity issues and two low-severity issues were also fixed in the same set of advisories. Products such as Cloud NGFW and Prisma Access are confirmed to be unaffected. Palo Alto Networks urges immediate patching for all impacted PAN-OS deployments.