The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, covering flaws in Palo Alto Networks' PAN-OS, Ahsay's AhsayCBS backup software, and Cisco Secure Email Gateway. According to Security Affairs, which reported the additions, Cisco has separately confirmed that threat actors are actively exploiting at least one of the flaws in the batch.
For most organizations, the interesting entry is the one that will not show up on a typical asset inventory: AhsayCBS, from a Hong Kong-headquartered backup vendor whose products are widely distributed through managed service providers and mid-market resellers rather than sold directly to large enterprises.
AhsayCBS is the outlier
Ahsay's position on the KEV list is unusual. PAN-OS and Cisco Secure Email Gateway appear routinely in enterprise security monitoring, vulnerability management platforms, and vendor-specific patching workflows. AhsayCBS does not. The product's distribution model — supplied largely through MSPs and mid-market backup partners — means it frequently sits inside customer environments without appearing in internal asset registers or automated discovery scans.
That creates a blind spot with real consequences. Backup infrastructure is an attractive target: compromising a backup server exposes stored archives, cached credentials, and, critically, the source networks from which those backups were collected. An attacker who controls the backup layer can often pivot into production systems and simultaneously remove the victim's ability to recover.
Practitioners should not assume that a clean discovery scan means they are unaffected. A further complication is that regional and niche vendors rarely automate patching to the same degree as the large platform vendors, so remediation may require manual coordination with a service provider rather than an in-house patch cycle — which makes the remediation window longer, not shorter.
PAN-OS and Cisco Secure Email Gateway
For organizations running Palo Alto Networks firewalls, the vendor's advisory should be the reference point for confirming affected versions. Internet-facing PAN-OS devices deserve priority in any patching queue, since exposure to the public internet materially shortens the window between disclosure and exploitation.
Cisco Secure Email Gateway carries the highest urgency of the three. Cisco's confirmation of active exploitation argues for bypassing normal maintenance windows on affected email appliances. Email gateways sit on the perimeter of organizational communications infrastructure, and a compromise carries implications for both data exposure and follow-on phishing or business email compromise campaigns.
What to do now
The practical sequence for security teams is straightforward:
- Inventory in both your environment and your providers'. Include third-party and MSP-supplied software — this is where Ahsay-class products hide. For many readers, this means sending a written enquiry to your backup or disaster-recovery provider asking whether AhsayCBS or any other third-party agent is deployed on your behalf.
- Patch against vendor advisories, prioritizing internet-facing instances of PAN-OS and Cisco Secure Email Gateway, and treating Cisco Secure Email Gateway as out-of-band if exploitation is observed in your sector.
- Verify after patching, particularly for devices reachable from the public internet.
- Subscribe to CISA's KEV notifications so future additions reach your team without relying on secondary reporting.
The Binding Operational Directive behind the KEV catalog obligates U.S. federal agencies to remediate listed flaws within set deadlines, but the catalog functions as a global prioritization benchmark. For teams outside the U.S. federal scope, it remains the fastest available signal of which vulnerabilities have moved from theoretical risk to observed exploitation.
Specific CVE identifiers and remediation deadlines for this batch are published in the CISA KEV catalog and the corresponding vendor advisories from Palo Alto Networks, Cisco, and Ahsay.
Source: Security Affairs
美國網絡安全及基礎設施安全局（CISA）已將三個漏洞加入其已知遭利用漏洞（Known Exploited Vulnerabilities，KEV）名錄，涉及 Palo Alto Networks 的 PAN-OS、Ahsay 的 AhsayCBS 備份軟件，以及 Cisco Secure Email Gateway。據率先報道是次更新的 Security Affairs 指出，Cisco 另行確認，威脅行為者正積極利用該批漏洞中至少一個。
對大多數機構而言，最值得注意的是那一項不會出現在典型資產清單上的條目：AhsayCBS。其母公司是一家總部設於香港的備份軟件供應商，產品主要透過託管服務供應商（MSP）及中型市場分銷商發放，而非直接售予大型企業。
AhsayCBS 是例外情況
Ahsay 出現在 KEV 名錄上並不尋常。PAN-OS 和 Cisco Secure Email Gateway 經常見於企業安全監控、漏洞管理平台及各廠商專屬的補丁流程之中，AhsayCBS 則不然。該產品的分銷模式——主要透過 MSP 及中型備份合作夥伴提供——意味著它經常部署在客戶環境內部，卻不會出現在內部資產登記冊或自動發現掃描之中。
這會造成一個有實際後果的盲點。備份基礎設施是極具吸引力的攻擊目標：攻陷備份伺服器即可暴露已儲存的存檔、快取的登入憑證，以及最關鍵的——那些備份所來自的來源網絡。控制了備份層的攻擊者，往往可以橫向移入生產系統，並同時剝除受害者的還原能力。
從業人員不應假設一次乾淨的發現掃描就代表自己未受影響。另一個複雜因素是，地區性及小眾供應商很少具備大型平台級供應商同等程度的自動化補丁能力，因此修補往往需要與服務供應商進行人手協調，而非依賴內部補丁周期——這只會令修補窗口更長，而非更短。
PAN-OS 與 Cisco Secure Email Gateway
對於使用 Palo Alto Networks 防火牆的機構，應以該廠商的安全公告作為確認受影響版本的依據。任何補丁排程中，對外網（Internet-facing）的 PAN-OS 裝置都應獲優先處理，因為暴露於公網會大幅縮短漏洞從披露到遭利用之間的時間窗口。
在三者之中，Cisco Secure Email Gateway 的緊急程度最高。Cisco 確認漏洞已遭實際利用，意味著受影響的電郵設備應繞過正常維護窗口即時處理。電郵閘道處於機構通訊基礎設施的邊界，一旦被攻陷，不僅涉及資料外洩，亦可能引發後續的釣魚攻擊或商業電郵詐騙（BEC）行動。
現在應採取的行動
安全團隊的實際處理步驟如下：
- 盤點自身環境及服務供應商環境內的資產。 包括第三方及 MSP 提供的軟件——Ahsay 一類產品正是藏身於此。對不少讀者而言，這意味著須以書面向備份或災難復原服務供應商查詢，是否有 AhsayCBS 或任何其他第三方 agent 代為部署在自己的環境中。
- 按廠商公告進行修補，優先處理對外網的 PAN-OS 及 Cisco Secure Email Gateway 實例；如發現在你所屬行業內已出現實際利用，應將 Cisco Secure Email Gateway 列為帶外（out-of-band）即時處理項目。
- 修補後加以驗證，尤其是可從公網到達的裝置。
- 訂閱 CISA 的 KEV 通知，使日後新增條目可直接送達團隊，毋須依賴二手報道。
支持 KEV 名錄的具有約束力的操作指令（Binding Operational Directive）強制美國聯邦機構在指定期限內修補名錄所列漏洞，但該名錄實際上已成為全球通用的優先處理基準。對於不在美國聯邦管轄範圍內的團隊而言，它仍然是判斷哪些漏洞已由理論風險演變為已觀察到的實際利用的最快訊號。
本批漏洞的具體 CVE 編號及修補期限，已刊載於 CISA KEV 名錄，以及 Palo Alto Networks、Cisco 和 Ahsay 的相應廠商安全公告中。