CVE Watch: 15 October 2026, an exploited file write on a mail gateway and five KEV additions

Four CVE records reached the Known Exploited Vulnerabilities catalog on 14 October with a 17 October due date, and CVE-2026-21589, an arbitrary file access flaw across Atlassian’s Data Center products, joined them on 15 October with a due date of 18 October ¹². Five of today’s records came out of Adobe’s October updates at a 10.0 base score ³⁴. I would open the mail gateway first, because there the exploitation path is an attachment and the fix may not be a software upgrade at all.

A file write that ends in root on a mail gateway

Cisco published an advisory on 14 October for CVE-2026-76519, a relative path traversal in the Advanced Malware Protection feature of Cisco Secure Email Gateway, and CISA added it to the catalog with a 17 October due date ⁵¹. Cisco scored it 9.8, and that is the number NVD carries, listed in the record as a vendor-supplied secondary metric ⁵⁶. The record’s vulnerable ranges run from 15.0 up to 15.5.5-014 and from 16.0 up to 16.5.0-780 ⁶.

The mechanism sits in attachment handling. With the file reputation service enabled, a crafted attachment arriving by email lets an unauthenticated sender write arbitrary files on the underlying operating system, then run commands as root ⁵. Two conditions put an appliance in scope: you have the file reputation service enabled and assigned to a mail policy, and your Content Scanner Tools package is older than 25.3.0.5525 ⁵. Mail gateways sit in my coverage area, so those two questions, plus the log check Cisco prints for its “System Security” messages, go into a relay today ⁵.

Updating the Content Scanner Tools does most of the work. Cisco pushes the fix through that package at 25.3.0.5525 and later, and applying it needs no software upgrade and no reboot, so an appliance that takes the automatic updates already has it ⁵. The AsyncOS releases that carry the fix are 15.5.5-014 and 16.5.0-780, and Cisco recommends moving anything older than 16.5 onto 16.5.0-780 ⁵. One caveat stays with me: root access lets an attacker erase local evidence, so the logs from outside the appliance are the check that assumes the least ⁵.

A root route through the firewall management plane

CVE-2026-0322 is code injection in the PAN-OS management interface, and it needs a valid credential before anything else happens ⁷. An authenticated attacker with network access at management runs code as root, and the flaw reaches PA-Series and VM-Series firewalls and Panorama, though not Cloud NGFW or Prisma Access ⁷. Palo Alto Networks scored it 8.6 under CVSS v4.0 and published no v3.1 score, and CISA added it with the same 17 October due date ⁷¹.

Exposure here comes down to routing. The vendor’s exploitation note reports very limited activity against management interfaces, and the mitigation it names first is restricting management access to trusted addresses or a jump box, because the flaw needs no special configuration to be reachable ⁷. I want to know what can reach the management interface before I care about the branch build. The fixed build depends on the branch: 12.2.4 on 12.2, 11.2.16 on 11.2 (published on 15 October), down to 10.2.18-h12 on 10.2 ⁷.

Two more AhsayCBS flaws reach the catalog

Neither Ahsay flaw is new. NVD published CVE-2026-105133 and CVE-2026-105134 on 4 October, so the change on 14 October is the catalog listing and the clock it starts ⁸⁹¹. CVE-2026-105134 is the one to read twice: unauthenticated OS command injection through the Replication Receiver’s UpdateReceivers.do endpoint, reachable over the network, with a published exploit ⁸. CVE-2026-105133 is the quieter of the pair, an improper authentication flaw in the API ⁹.

Anyone running a backup server with the replication API reachable from a network they do not control has the exposure. NVD lists 10.3.2 and earlier as affected and 10.3.4 as the release that resolves both, so the check I would run first is whether that API answers from anywhere it should not ⁸⁹.

ColdFusion’s two 10.0 records

Adobe’s ColdFusion bulletin, APSB26-144, went out on 13 October at priority 2, and two of its records carry a 10.0 base score with no user interaction and a changed scope ³. CVE-2026-105899 is an unrestricted upload of a file with a dangerous type, and CVE-2026-106622 is server-side request forgery that escalates privilege ³. Two of the critical records below that score are CVE-2026-105903 at 9.9 for code injection and CVE-2026-106624 at 9.8 for improper input validation ³. Adobe fixes all of them in ColdFusion 2025.0.14 and 2023.0.26, the releases that follow the affected 2025.0.13 and 2023.0.25, and the bulletin reports no exploitation in the wild ³.

I read the changed scope on the two 10.0 records as a sign that the impact does not stay inside the ColdFusion process, which matters where the runtime can reach a database or a file share. The upload path on an internet-facing instance is the part I would want someone to walk through rather than assume.

One hotfix for Experience Manager’s three

The AEM bulletin, APSB26-152, went out the same day at priority 2 with CVE-2026-48382, CVE-2026-48383, and CVE-2026-90532, all incorrect authorization leading to arbitrary code execution at 10.0 and no user interaction ⁴¹⁰. Affected: AEM Cloud Service 2026.9.28187 and earlier, AEM 6.5 Service Pack 25 and earlier, and AEM 6.5 LTS Service Pack 3 and earlier ⁴. Adobe lists no known exploitation, and the on-premises fix is a hotfix for GRANITE-72352 rather than a service pack ⁴.

Three records sharing one authorization flaw and one hotfix simplifies the planning: the change is a file drop on each author and publish instance, and the first question becomes which instances answer from outside the trusted network.

Five due dates land across two days, four of them on 17 October and the last on 18 October, and one of the five may be a package update instead of a build, so the relay I write today names systems, owners, and the order to work in.