CISA Flags Actively Exploited Vulnerabilities in Palo Alto PAN-OS, Cisco Secure Email Gateway, and Microsoft Windows Shell

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added multiple critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to patch them. These include a high-severity remote code execution (RCE) flaw (CVE-2026-0322) in Palo Alto Networks PAN-OS management interface, a critical relative path traversal vulnerability (CVE-2026-76519) in Cisco Secure Email Gateway, and a Windows Shell security feature bypass (CVE-2026-96951) that allows malicious files to circumvent Mark of the Web warnings. The Microsoft Patch Tuesday for October 2026 also addressed a record 1,413 CVEs.