When the Edge Appliance Is Exploited, the DFARS Reporting Clock May Start

Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012 sets a hard reporting rule. Contractors must rapidly report a cyber incident to the Department of Defense (DoD). Rapidly means within 72 hours of discovery under that clause.

Four new exploited flaws make that rule practical this week. The Cybersecurity and Infrastructure Security Agency (CISA) added them on October 14, 2026. They sit in the Known Exploited Vulnerabilities (KEV) catalog now. A patch alone does not answer the reporting question.

The flaws that could start a clock

CVE-2026-0322 gives root code execution in the PAN-OS management interface. Palo Alto Networks reports very limited exploitation already. The Common Vulnerability Scoring System (CVSS) score is 8.6.

CVE-2026-76519 scores 9.8 in Cisco Secure Email Gateway. An unauthenticated sender can write files and run root commands. One crafted attachment through the gateway is enough.

CVE-2026-105133 and CVE-2026-105134 chain inside Ahsay AhsayCBS. Attackers gained SYSTEM access on backup servers that way. Observed activity included web shells and cryptocurrency miners.

Discovery is the trigger, not the headline

A catalog listing by itself is not your incident. Discovery means your team finds signs on your system. Signs include odd logins, new files, or vendor compromise notices. Cisco contacted some cloud customers about possible compromise directly.

The reporting question turns on what the appliance touched. Did the firewall guard systems holding covered defense information? Did the mail gateway carry that information in messages? Did the backup server store copies of it? Each yes raises the reporting stakes sharply.

Do not wait for perfect proof before deciding. The clause also expects evidence preservation after discovery. Save logs, images, and records before upgrades erase them. Cisco gives the same warning for virtual appliances.

A practical order of work

Check the three product families against your inventory first. Hunt for compromise signs on any exposed appliance. Preserve what you find before you patch or rebuild. Then make the reporting call with counsel and your contracting contacts.

PolicyCortex does not patch these appliances. It also does not file incident reports for you. Your team owns the fix, the hunt, and the report decision.

Sources

• CISA alert, CISA Adds Four Known Exploited Vulnerabilities to Catalog, October 14, 2026. https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog
• CVE-2026-0322 record, CVE Program. Palo Alto Networks advisory at https://security.paloaltonetworks.com/CVE-2026-0322
• CVE-2026-76519 record, CVE Program. Cisco advisory cisco-sa-esa-afw-zqYJkjxp.
• CVE-2026-105133 and CVE-2026-105134 records, CVE Program.
• DFARS clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting.
• Original diagram by PolicyCortex.

Next step

Want an inventory that shows which appliances touch covered information? See how PolicyCortex maps systems to their evidence.