# KLM Innovation Security Monitor
**Date:** October 14, 2026

> Informational security guidance for awareness and prioritization. Not certification, legal advice, or a guarantee of protection.

## Executive Summary
CISA added four exploited flaws to its KEV catalog on October 14th, all due October 17th: a Cisco Secure Email Gateway zero-day that gives an unauthenticated attacker root through a single crafted attachment, a Palo Alto Networks PAN-OS management-interface flaw that gives root to an authenticated attacker, and the two AhsayCBS backup-server flaws, which finally have hotfixes that actually work. Patch the Cisco mail gateways first and check every cluster member for compromise, then PAN-OS, then AhsayCBS, and don't trust an earlier AhsayCBS patch. Self-managed GitLab needs this week's critical release for a CVSS 10.0 unauthenticated code execution flaw. On the agent side, the theme is guardrails checking the wrong layer: Copilot in Visual Studio and SSMS rewrote its own config with a trailing dot, two Claude Desktop flaws ran code from the preview pane and from a planted git.exe, and new agent consoles and gateways shipped without working authentication or host checks.

## Headline Developments

### 1. Cisco Secure Email Gateway zero-day CVE-2026-76519 exploited for root via a crafted attachment (CRITICAL)
**Source:** [Cisco: Cisco Secure Email Gateway Arbitrary File Write Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp) (October 14th)
- A relative path traversal in the Advanced Malware Protection (AMP) feature lets an unauthenticated, remote attacker send an email with a crafted attachment, write arbitrary files and run commands as root. Cisco scores it 9.8 and says there are no workarounds.
- You're exposed if File Reputation is enabled and assigned to a mail policy and Content Scanner Tools is older than 25.3.0.5525. The fix is Content Scanner Tools 25.3.0.5525 or later (no restart needed), or AsyncOS 15.5.5-014 or 16.5.0-780. Release 16.0 has to migrate.
- Cisco became aware of active exploitation in October 2026. It has contacted Secure Email Cloud customers where it found indicators of possible compromise and is working on remediation and recovery. CISA added the flaw to KEV on October 14th with an October 17th deadline.
- Attackers with root can wipe their tracks, so Cisco says to check firewall and network logs outside the appliance. Cluster members share SSH keys, so one compromised appliance means rebuilding every member of that cluster. Nearly 300 Secure Email Gateway instances are exposed online, based on Shadowserver tracking ([BleepingComputer: Cisco patches new Secure Email Gateway zero-day exploited in attacks](https://www.bleepingcomputer.com/news/security/cisco-patches-actively-exploited-secure-email-gateway-zero-day/), October 14th).

**Why this matters:** It's CRITICAL because it's unauthenticated, it reaches root, it's being exploited, and Cisco has already found signs of compromise on customer cloud devices. A mail gateway sees every inbound message, and stolen cluster keys reach the other appliances. Update Content Scanner Tools today and hunt before you call it closed.

**Pattern callout:** This is the second exploited Secure Email Gateway root-level zero-day in under a month, after CVE-2026-76461 (covered September 20th). It also extends the edge-appliance thread from Ivanti Connect Secure (October 13th).

### 2. PAN-OS CVE-2026-0322: exploited management-interface flaw gives root on the firewall (HIGH)
**Source:** [Palo Alto Networks: CVE-2026-0322 PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface](https://security.paloaltonetworks.com/CVE-2026-0322) (October 14th)
- An authenticated attacker with network access to the management interface can run arbitrary code as root on PA-Series and VM-Series firewalls and on Panorama. Cloud NGFW and Prisma Access aren't affected. CVSS-B is 8.6 (v4.0, high privileges required), CWE-94, and the vendor's urgency rating is HIGHEST.
- Palo Alto Networks has seen very limited exploitation and lists three IP addresses tied to exploit attempts in the advisory. CISA added it to KEV on October 14th, due October 17th.
- Fixed releases include 12.2.4, 12.1.10-h2, 11.1.16-h3 and 10.2.18-h12, with hotfixes for older maintenance lines. 11.2.16 has an October 15th ETA, and earlier 11.2 hotfixes (for example 11.2.13-h3) are out now.
- There's no workaround. Threat Prevention signatures 510046 and 510047 give limited coverage and only work if you decrypt the inbound management traffic.

**Why this matters:** It's HIGH because exploitation is confirmed and it's on KEV, and root on a firewall is a big blast radius. It needs valid credentials and access to the management interface, so it sits below CRITICAL. The risk is highest wherever the management interface is reachable from the internet.

**Pattern callout:** That's the third perimeter appliance in two days with exploitation reported by the vendor, after Ivanti Connect Secure (October 13th) and Cisco Secure Email Gateway (Story 1).

### 3. AhsayCBS CVE-2026-105133 and CVE-2026-105134 land on KEV, and the working fix is a new hotfix (HIGH)
**Source:** [Ahsay: (Update) Critical Security Alert: Immediate Action Required for CVE-2026-105133 and CVE-2026-105134](https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update) (October 12th)
- Ahsay says its earlier patches, v9.15.2.59 and v10.3.4.0, didn't fully fix either flaw.
- v10 customers should apply the AhsayCBS v10.3.4.45 hotfix. v7, v8 and v9 customers should apply v9.15.2.70. Both need a partner portal login, and the server needs a reboot afterward.
- CISA added both to KEV on October 14th, due October 17th ([CISA: CISA Adds Four Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog)). The catalog notes that the authentication bypass in `checkSysPwd` chains with the command injection in `/rps/api/json/UpdateReceivers.do`.
- The NVD descriptions still say upgrading to 10.3.4 fixes the issue. The vendor says 10.3.4.0 was incomplete, so go by the hotfix numbers.

**Why this matters:** It's HIGH because exploitation was already confirmed and it's now on KEV. What's new is that there's finally a fix to deploy, and anyone who patched to 10.3.4.0 may think they're done when they aren't.

**Pattern callout:** Covered October 10th as exploited with no patch, and on October 11th and 12th with no fix yet. New today: working hotfixes and the KEV listing.

### 4. GitLab critical release fixes a CVSS 10.0 unauthenticated code execution flaw and a Duo Agent Platform prompt injection (MEDIUM)
**Source:** [GitLab: GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/) (October 12th)
- CVE-2026-97229 is an integer overflow in the CI/CD regular expression compiler. It could let an unauthenticated user run arbitrary code on the GitLab server through a crafted regex in CI/CD configuration. It's CVSS 10.0 and affects CE and EE 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2.
- CVE-2026-96893 (CVSS 7.3, EE) let an authenticated user inject crafted content into Duo Agent Platform agent instructions, which could cause command execution attributed to other users. A second Duo Agent Platform flaw, CVE-2026-105458 (CVSS 4.3), could hand out a token that bypasses governance controls.
- The release carries 24 security fixes. GitLab.com is already patched and Dedicated customers don't need to act. It includes database migrations, so single-node instances will have downtime during the upgrade.

**Why this matters:** It's MEDIUM because there's no reported exploitation and nothing's on KEV, but a 10.0 unauthenticated code execution flaw on a self-managed source server is worth an upgrade this week. The Duo flaw is a reminder that agent actions can be pinned on the wrong person, which makes audit trails less trustworthy.

**Pattern callout:** It's the second GitLab AI-component fix in two weeks, after the AI Gateway flaw CVE-2026-90970 (covered October 2nd).

### 5. Coding-agent desktops: Copilot in Visual Studio and SSMS rewrote its own config, and two Claude Desktop flaws are fixed (MEDIUM)
**Source:** [Embrace The Red: Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)](https://embracethered.com/blog/posts/2026/visual-studio-copilot-remote-code-execution/) (October 13th)
- CVE-2026-103572: Copilot in Visual Studio and SQL Server Management Studio could get past a protected-filename check by adding a trailing dot (`.mcp.json.` or `settings.VisualStudio.json.`). Windows drops the dot when it writes the file, so Copilot could rewrite its own MCP and settings files and launch arbitrary commands. The researcher showed it working through indirect prompt injection. The flaw sits in a shared Copilot DLL, so Visual Studio 2022 is affected too.
- Microsoft rated it Important remote code execution, CVSS 8.8, and fixed it in the October 13th Patch Tuesday. The researcher's review of the patch shows it now normalizes the path before the check. Microsoft awarded a $0 bounty.
- Claude Desktop "SneakPeek": HTML files over 256KB in the preview pane loaded as `file://` without the Content Security Policy, and the request filter wasn't active for static files. A poisoned coverage report in a public repo could read SSH keys, cloud credentials and OAuth tokens and send them out when a user asked Claude to review it. Anthropic scored it 8.7. Its first patch was bypassed with a Web Worker, and the full fix shipped in Claude Desktop 1.30096.1 and later by auto-update. A CVE is pending ([Noma Security: SneakPeek: How the Preview Pane in Claude Code Desktop Can Exfiltrate Your Data](https://noma.security/noma-labs/sneakpeek-how-the-preview-pane-in-claude-code-desktop-can-exfiltrate-your-data), October 14th).
- Claude Desktop on Windows also ran `git.exe` without an absolute path, so a malicious `git.exe` dropped into a project folder ran when the folder was opened. It's fixed in 1.8089.0 (CVSS 7.5), and auto-update users already have it ([GitHub: Uncontrolled Search Path Enables Arbitrary Code Execution via Malicious Git Executable](https://github.com/anthropics/claude-code/security/advisories/GHSA-4p2j-qj3c-6x84), October 13th).

**Why this matters:** It's MEDIUM because there are patches and no reported exploitation. The Claude fixes went out by auto-update, so the real gap is machines updated by hand. All three bugs sat outside the model's own guardrails: in a string comparison, in the preview renderer and in the executable search path. Prompt-level controls didn't help.

**Pattern callout:** Extends the October 13th research thread (ToFu MCP tool bugs, Vercel and Mistral sandbox leaks): the boundary around the agent breaks where two components read the same input differently.

### 6. Agent consoles and gateways ship open: NullHub missing auth and Portkey SSRF, no fixes listed (MEDIUM)
**Source:** [VulnCheck: NullHub through 2026.5.29 Missing Authentication for /api Management API](https://www.vulncheck.com/advisories/nullhub-through-2026.5.29-missing-authentication-for-api-management-api) (October 14th)
- CVE-2026-110616 (CVSS 9.2): NullHub's `auth_token` defaults to null and is never set, so its `/api/*` management API takes unauthenticated requests on any non-loopback listener. An attacker can control agent instances, rewrite configuration including provider credentials, and manage cron jobs and MCP servers. Versions through 2026.5.29 are affected.
- NullHub listens on 127.0.0.1 by default and is only remotely reachable when someone binds it to another address with `--host`. The finding came from source review, and the software wasn't built or run. The same campaign has produced at least 18 MCP and agent CVEs published October 10th to 14th, and none of the advisories lists a patched version ([The Injection: MCP source review: at least 18 unpatched CVEs in five days](https://theinjection.dev/items/vulncheck-mcp-source-review-cves/), October 14th).
- CVE-2026-110719 (CVSS 6.9): Portkey AI Gateway 1.14.0 through 1.15.2 trusts localhost-style hosts in the `x-portkey-custom-host` header when `TRUSTED_CUSTOM_HOSTS` is unset. That lets unauthenticated `/v1` requests make the gateway call loopback and Docker host services and return what they send back. No fixed version is listed ([VulnCheck: Portkey AI Gateway 1.14.0 through 1.15.2 SSRF via x-portkey-custom-host Header](https://www.vulncheck.com/advisories/portkey-ai-gateway-1.14.0-through-1.15.2-ssrf-via-x-portkey-custom-host-header), October 14th).
- Version 1.14.0 is the release that added an allowlist for this same header after an earlier SSRF advisory ([GitHub: Security Advisory: Server-Side Request Forgery (SSRF) in Custom Host](https://github.com/Portkey-AI/gateway/security/advisories/GHSA-hhh5-2cvx-vmfp)).

**Why this matters:** It's MEDIUM because neither has been exploited and neither has a patch, but there's something you can do today: keep these control planes on loopback or behind authentication. Agent consoles and gateways hold every provider key, so an open one gives away all of them.

**Pattern callout:** It's the second AI-gateway SSRF in two days, after LiteLLM CVE-2026-59823 (October 13th), and it extends the MCP input-validation findings from ToFu (October 13th).

### 7. Ahold Delhaize takes systems offline, and Arcadia's municipal alert platform may have leaked 3 million+ records (MEDIUM)
**Source:** [Ahold Delhaize: Update on Ahold Delhaize's cybersecurity incident](https://newsroom.aholddelhaize.com/update-on-ahold-delhaizes-cybersecurity-incident/) (updated October 14th)
- Ahold Delhaize first disclosed a cybersecurity issue in its network on October 12th. It took some systems offline as a precaution and has started a controlled relaunch of some of them, working with outside experts and the authorities.
- The company says it has no evidence at this point that customer, associate or partner data was taken, and the investigation is ongoing. Stores in Europe and the US are open, with impact varying by brand. It hasn't published any count of affected records.
- Separately, Osaka-based Arcadia, whose disaster information system is used by nearly 800 entities including municipalities, says more than 3 million email addresses and other records may have leaked, including registered names and over 100,000 phone numbers. It detected suspected unauthorized access on Sunday and blocked it on Monday. Oita, Shizuoka and Shiga prefectures have paused the system and warned residents about suspicious emails ([NHK World-Japan: Data breaches continue: latest at Osaka IT firm](https://www3.nhk.or.jp/nhkworld/news/20261014de59153/), October 14th).

**Why this matters:** It's MEDIUM because both incidents are confirmed but there's no CVE, no patch and no published root cause. The action today is phishing awareness for anyone tied to these brands or systems, and a check of any supplier connections to Ahold Delhaize.

**Pattern callout:** It follows the large Japanese records exposure covered October 11th. Platforms shared by many organizations keep turning one intrusion into many notifications.

## Continuity Footnotes
- Ivanti Connect Secure CVE-2026-104935: covered October 13th. The KEV deadline is October 16th, and nothing in today's sources changes the guidance.
- Windows Shell CVE-2026-96951: covered October 13th. The KEV deadline is October 16th, with no new primary information.
- LiteLLM CVE-2026-35029 and CVE-2026-59823: covered October 13th, with no new primary information. The fix is still 1.83.9 or later.

## Pattern Analysis
1. **Edge appliances under steady fire (October 13th to 14th):** Ivanti Connect Secure (October 13th), then Cisco Secure Email Gateway (Story 1), PAN-OS (Story 2) and AhsayCBS (Story 3). That's six KEV entries in two days with deadlines of October 16th and 17th. Patch, then hunt off-box, because root-level attackers clean up after themselves.
2. **Guardrails checking the wrong layer (October 13th to 14th):** Copilot compared strings while Windows normalized paths (Story 5), Claude's preview renderer sat outside the model's controls (Story 5), and Vercel's allowlist trusted what approved hosts would fetch (October 13th). Controls have to check what will actually execute, not what the request says.
3. **Agent control planes with missing auth (October 10th to 14th):** NullHub's never-set token and Portkey's open host check (Story 6), the GitLab Duo instruction injection (Story 4) and the LiteLLM admin bypass (October 13th). A console that manages agents is a credential vault, and it needs the same protection.
4. **First patches that didn't hold (October 12th to 14th):** AhsayCBS 10.3.4.0 and 9.15.2.59 were incomplete (Story 3), Claude's first preview fix was bypassed (Story 5), and the Portkey flaw affects the release that added the original allowlist (Story 6). Check the exact fixed build, not just "patched."

## Recommended Actions
**Immediate (this week):**
1. **Cisco Secure Email Gateway (CVE-2026-76519, KEV due October 17th):** run `contentscannerstatus`, get Content Scanner Tools to 25.3.0.5525 or later (`contentscannerupdate`, no restart) or move to AsyncOS 15.5.5-014 or 16.5.0-780, then run `grep "System Security" system_logs` on every cluster member. If you find a compromise, keep forensics, rebuild, and renew credentials and keys on every member of the cluster.
2. **PAN-OS (CVE-2026-0322, KEV due October 17th):** upgrade to the fixed hotfix for your release line, restrict the management interface to trusted internal IPs or a jump box, and check logs for the IP addresses listed in the advisory.
3. **AhsayCBS (CVE-2026-105133 and CVE-2026-105134, KEV due October 17th):** apply v10.3.4.45 or v9.15.2.70 and reboot, even if you already installed 10.3.4.0 or 9.15.2.59.
4. **GitLab self-managed:** upgrade to 19.4.2, 19.3.5 or 19.2.8 for CVE-2026-97229 and the Duo Agent Platform fixes, and plan for downtime on single-node instances.
5. **Visual Studio and SSMS:** install the October 13th updates for CVE-2026-103572 on both, because they share the vulnerable Copilot DLL.

**This month:**
6. **NullHub (CVE-2026-110616):** keep it on 127.0.0.1, remove any `--host` bind to a routable address, and rotate stored provider credentials if it was ever reachable. **Portkey AI Gateway 1.14.0 to 1.15.2 (CVE-2026-110719):** check `TRUSTED_CUSTOM_HOSTS` and don't expose the gateway without authentication.
7. **Claude Desktop:** on machines updated by hand, confirm 1.30096.1 or later (preview pane) and 1.8089.0 or later on Windows (git.exe). Until then, don't open untrusted repositories.
8. **Phishing watch:** warn staff and customers tied to Ahold Delhaize brands or Japanese municipal alert systems about lures that reference these incidents.

**Ongoing:**
9. Canonicalize paths before any allow or deny check in agent tooling, and treat any MCP config an agent can edit as a list of programs it can launch.
10. Keep long-lived credentials off developer machines, and use scoped, short-lived tokens so a hijacked coding tool can grab less.
11. Track KEV daily. Every KEV deadline this week lands three days after the listing.

## Relevant Risk Summary
| Risk | Severity | Recommended Actions |
|---|---|---|
| Cisco Secure Email Gateway CVE-2026-76519, exploited, unauthenticated root, KEV (due October 17th) | CRITICAL | Content Scanner Tools 25.3.0.5525+; hunt all cluster members |
| PAN-OS CVE-2026-0322, exploited, KEV (due October 17th) | HIGH | Fixed hotfix; lock down management interface |
| AhsayCBS CVE-2026-105133 / CVE-2026-105134, exploited, KEV (due October 17th), earlier patches incomplete | HIGH | Hotfix v10.3.4.45 or v9.15.2.70; reboot |
| GitLab CVE-2026-97229 (10.0) and Duo Agent Platform CVE-2026-96893 | MEDIUM | Upgrade to 19.4.2 / 19.3.5 / 19.2.8 |
| Visual Studio and SSMS Copilot CVE-2026-103572; Claude Desktop preview pane and git.exe fixes | MEDIUM | October 13th updates; verify Claude Desktop versions |
| NullHub CVE-2026-110616 and Portkey CVE-2026-110719, no fixes listed | MEDIUM | Loopback only; authentication in front; rotate keys |
| Ahold Delhaize incident; Arcadia records exposure | MEDIUM | Phishing awareness; review supplier connections |

## Sources
- [Cisco: Cisco Secure Email Gateway Arbitrary File Write Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp)
- [BleepingComputer: Cisco patches new Secure Email Gateway zero-day exploited in attacks](https://www.bleepingcomputer.com/news/security/cisco-patches-actively-exploited-secure-email-gateway-zero-day/)
- [CISA: CISA Adds Four Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog)
- [Palo Alto Networks: CVE-2026-0322 PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface](https://security.paloaltonetworks.com/CVE-2026-0322)
- [Ahsay: (Update) Critical Security Alert: Immediate Action Required for CVE-2026-105133 and CVE-2026-105134](https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update)
- [GitLab: GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/)
- [Embrace The Red: Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)](https://embracethered.com/blog/posts/2026/visual-studio-copilot-remote-code-execution/)
- [Noma Security: SneakPeek: How the Preview Pane in Claude Code Desktop Can Exfiltrate Your Data](https://noma.security/noma-labs/sneakpeek-how-the-preview-pane-in-claude-code-desktop-can-exfiltrate-your-data)
- [CSO Online: How Claude Code's 256KB blind spot put developers' secrets in the preview pane](https://www.csoonline.com/article/4235139/how-claude-codes-256kb-blind-spot-put-developers-secrets-in-the-preview-pane.html)
- [GitHub: Uncontrolled Search Path Enables Arbitrary Code Execution via Malicious Git Executable](https://github.com/anthropics/claude-code/security/advisories/GHSA-4p2j-qj3c-6x84)
- [VulnCheck: NullHub through 2026.5.29 Missing Authentication for /api Management API](https://www.vulncheck.com/advisories/nullhub-through-2026.5.29-missing-authentication-for-api-management-api)
- [VulnCheck: Portkey AI Gateway 1.14.0 through 1.15.2 SSRF via x-portkey-custom-host Header](https://www.vulncheck.com/advisories/portkey-ai-gateway-1.14.0-through-1.15.2-ssrf-via-x-portkey-custom-host-header)
- [GitHub: Security Advisory: Server-Side Request Forgery (SSRF) in Custom Host](https://github.com/Portkey-AI/gateway/security/advisories/GHSA-hhh5-2cvx-vmfp)
- [The Injection: MCP source review: at least 18 unpatched CVEs in five days](https://theinjection.dev/items/vulncheck-mcp-source-review-cves/)
- [Ahold Delhaize: Update on Ahold Delhaize's cybersecurity incident](https://newsroom.aholddelhaize.com/update-on-ahold-delhaizes-cybersecurity-incident/)
- [NHK World-Japan: Data breaches continue: latest at Osaka IT firm](https://www3.nhk.or.jp/nhkworld/news/20261014de59153/)

*Informational security guidance. Not certification.*