Cisco Secure Email and PAN-OS Zero-Days Exploited; Fixes Available

Summary

Cisco and Palo Alto Networks patched actively exploited flaws that can enable root-level code execution on security appliances. CISA added both to its KEV catalog; the article outlines exposure conditions, fixes, and defensive steps.

Key points

CVE-2026-76519 affects Cisco Secure Email Gateway. An unauthenticated attacker can exploit crafted email attachments to write files and execute commands as root when specified AMP and Content Scanner Tools conditions are met.
Cisco remediation includes updating Content Scanner Tools to 25.3.0.5525 or later, or installing an applicable fixed AsyncOS release; Cisco says there is no workaround.
Cisco warns a root compromise may expose SSH keys shared among cluster members and recommends restoring all cluster members if one is compromised.
CVE-2026-0322 affects the PAN-OS management interface. Exploitation requires network access and valid high-privilege credentials; Palo Alto Networks reported very limited exploitation.
Palo Alto Networks provides fixed releases or hotfixes for supported PAN-OS branches and advises restricting management-interface access to trusted internal IP addresses.
CISA added both flaws to its Known Exploited Vulnerabilities catalog on October 14, 2026; covered U.S. federal agencies must remediate by October 17, 2026.
The article recommends reviewing authentication, configuration, network, and administrative activity from before patching; Palo Alto's Threat Prevention coverage does not replace upgrading.

Article Details

Vulnerability Types: Relative path traversal in the AMP File Reputation attachment-processing path (CWE-23)
Code injection in the PAN-OS management interface (CWE-94)
Severity: CVE-2026-76519: Critical (CVSS 3.1 score 9.8); CVE-2026-0322: High (CVSS 4.0 score 8.6).
Affected Versions: Cisco Secure Email Gateway with Content Scanner Tools earlier than 25.3.0.5525
Cisco AsyncOS 15.5
Cisco AsyncOS 16.0
Cisco AsyncOS 16.5
PAN-OS 12.2
PAN-OS 12.1
PAN-OS 11.2
PAN-OS 11.1
PAN-OS 10.2
Exploitation Status: active
Exploit Availability: unknown
Patch Status: available
Workarounds: For CVE-2026-0322, restrict management-interface access to trusted internal IP addresses, preferably through a controlled jump box.
For CVE-2026-76519, Cisco states that no workaround addresses the vulnerability.

Indicators of compromise

Type	Indicator	Context
IPV4	`149[.]248[.]47[.]234`	Palo Alto Networks-associated hunting lead for reported PAN-OS exploitation; the article cautions that connections do not prove successful exploitation.
IPV4	`208[.]83[.]239[.]114`	Palo Alto Networks-associated hunting lead for reported PAN-OS exploitation; the article cautions that connections do not prove successful exploitation.
IPV4	`66[.]42[.]72[.]14`	Palo Alto Networks-associated hunting lead for reported PAN-OS exploitation; the article cautions that connections do not prove successful exploitation.