Firewalls and mail filters under fire: Palo Alto and Cisco patch exploited flaws
Attackers are already exploiting vulnerabilities in Palo Alto Networks firewalls and Cisco email gateways. US federal agencies must fix the Palo Alto flaw by Saturday.
Symbolic image · Photo: Derrick Coetzee / Wikimedia Commons, CC0 (cropped and resized)
Two of the most important network security vendors have released updates for vulnerabilities that are already being used in attacks. On Wednesday, Palo Alto Networks fixed CVE-2026-0322 in the PAN-OS operating system of its PA-Series and VM-Series firewalls and its Panorama management platform. Via the management interface, authenticated attackers with network access can run code with the highest privileges; the severity score is 8.6 out of 10. The vendor said it had observed 'very limited' exploitation. The US cyber agency CISA added the flaw to its catalogue of actively exploited vulnerabilities, and federal agencies must fix it by 17 October.
Even more critical is a flaw in Cisco's Secure Email Gateway (CVE-2026-76519, severity 9.8). An attacker does not need to log in: sending a crafted email with an attachment through the gateway is enough to write files to the system and potentially run commands as root. Affected devices are those with file reputation checks enabled and a scanner component older than version 25.3.0.5525. Cisco has contacted customers showing signs of possible compromise but has not said how many devices are affected or who is behind the attacks.
A scanner update that can be installed without a restart is available for Cisco customers; there is no workaround. According to Cisco, anyone already attacked should preserve evidence before updating, rebuild virtual appliances and renew credentials and keys. Palo Alto recommends tightly restricting access to the management interface. A different, also exploited flaw in the same Cisco product had already come to light in September.