Why Active Directory weaknesses stay open for years in teams with one or two admins
2026-10-16T08:51:40Z•65e06cbd3b1e9cd5c5fd3d7544ef0f400a251cb47007474537b0b14c21205720
CVE-2026-0322CVE-2026-105133CVE-2026-105134CVE-2026-76519active-directoryactive-exploitationahsays-cbsai-api-key-theftcisco-secure-email-gatewaycommand-injectionddosfake-captchaimproper-authenticationkgb-ratknown-exploited-vulnerabilitiesmalware-deliverypalo-alto-pan-ospath-traversalphishingremote-access-trojanremote-code-execution
What happened
Help Net Security coverage highlights active exploitation of four vulnerabilities added to CISA's KEV catalog: Palo Alto PAN-OS remote code execution, Cisco Secure Email Gateway path traversal, and Ahsay authentication and command-injection flaws. Other reports describe KGB RAT capabilities, fake CAPTCHA-driven malware delivery, rising DDoS activity, stolen AI API keys enabling autonomous scans, and persistent Active Directory hardening challenges.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- helpnetsecurity
- Record identifier
- 65e06cbd3b1e9cd5c5fd3d7544ef0f400a251cb47007474537b0b14c21205720
- Enrichment time
- 2026-10-16T08:51:40Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.