Security Advisory

Patch Before October 17: Exploited Flaws in Palo Alto PAN-OS and Cisco Secure Email Gateway

October 15, 2026 · Cyber One Solutions Security Team

CISA added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog on October 14, 2026, both with an October 17 remediation date: a critical, unauthenticated file-write flaw in Cisco Secure Email Gateway (CVE-2026-76519) and a code injection flaw in Palo Alto Networks PAN-OS firewalls and Panorama (CVE-2026-0322). Here is who is affected, what each vendor confirmed, and what to check this week.

On October 14, 2026, CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, meaning it has evidence that attackers are using them now: CVE-2026-76519 in Cisco Secure Email Gateway, and CVE-2026-0322 in Palo Alto Networks PAN-OS. CISA's catalog lists an October 17, 2026 due date for both. That is the catalog date rather than a single deadline for every system: under Binding Operational Directive 26-04, federal civilian agencies set each affected asset's actual remediation timeline from its exposure, and none of it binds private businesses. Still, a three-day catalog date on two different vendors' products in one day shows how urgently CISA rates both flaws. If you run either product, check your version this week.

Cisco Secure Email Gateway: CVE-2026-76519

What it is. Cisco's security advisory describes CVE-2026-76519 as a relative path traversal flaw, tracked under CWE-23, that lets an unauthenticated remote attacker write arbitrary files to the appliance's underlying operating system. Cisco rates it CVSS v3.1 9.8, critical, with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: reachable over the network, low attack complexity, no privileges and no user interaction needed, and full loss of confidentiality, integrity, and availability. Cisco states its Product Security Incident Response Team "became aware of active exploitation of this vulnerability" in October 2026. Cisco's advisory separately states that the vulnerability itself was found during the company's own internal security scanning; it does not say that same scanning is what detected the exploitation, according to Cisco's security advisory and CISA's Known Exploited Vulnerabilities catalog.

Who is affected. The flaw only applies to a Cisco Secure Email Gateway, physical or virtual, running a vulnerable AsyncOS release when two conditions are both true: File Reputation, part of Cisco's Advanced Malware Protection, is enabled and assigned to a mail policy, and the appliance's Content Scanner Tools component is earlier than version 25.3.0.5525. File Reputation is a standard anti-malware feature that Cisco's platform supports turning on as a matter of course. Cisco's advisory does not list every vulnerable AsyncOS release; it lists only the fixed versions below. Secure Email and Web Manager and Secure Web Appliance are not affected. For Secure Email Cloud Gateway, Cisco has already deployed the fix and states no action is required. Separately, Cisco says it has directly contacted Secure Email Cloud customers whose devices showed indicators of possible compromise; a business that has not heard from Cisco needs no action for this flaw, but a contacted customer should follow Cisco's instructions to restore the device to a secure configuration and renew its credentials and cryptographic material.

Fixed software. Cisco's advisory lists Content Scanner Tools 25.3.0.5525 or later as containing the fix. An appliance with automatic updates enabled receives it without action; an appliance with automatic updates disabled needs the fix applied manually by running contentscannerupdate at the CLI, which Cisco says needs no software upgrade or restart. Separately, Cisco lists fixed AsyncOS releases: 15.5.5-014 for the 15.5 branch, 16.5.0-780 for the 16.5 branch (Cisco "strongly recommends" migrating to this release regardless of which fixed build a customer is already on), and a migration to a fixed release for the 16.0 branch, with no specific build number given. Cisco states there are no workarounds for this vulnerability.

Palo Alto Networks PAN-OS: CVE-2026-0322

What it is. Palo Alto Networks' advisory describes CVE-2026-0322, tracked under CWE-94, as a code injection flaw in the PAN-OS management interface that lets an authenticated attacker with network access to that interface execute arbitrary code with root privileges on the firewall. It carries a CVSS 4.0 score of 8.6 (8.5 when the management interface sits behind a jump box, per Palo Alto's own scoring note), high severity. Unlike the Cisco flaw, this one requires the attacker to already hold credentials and reach the management interface over the network; it is not a fully unauthenticated, internet-facing exploit. Palo Alto's advisory states that "very limited exploitation has been observed targeting the Palo Alto Networks management interface," rating the flaw's exploit maturity as attacked, and lists three IP addresses associated with the limited exploit attempts it has observed, per Palo Alto Networks' security advisory and CISA's Known Exploited Vulnerabilities catalog.

Who is affected. PA-Series and VM-Series firewalls and Panorama, both the virtual appliance and the M-Series hardware appliance, are affected across a range of PAN-OS branches and hotfix levels, from 10.2 through 12.2. Cloud NGFW and Prisma Access are not affected. No special configuration is required beyond having a management interface reachable by an authenticated attacker.

Fixed software. Palo Alto has published fixed builds for every affected branch, including 12.2.4, 12.1.10-h2, 11.2.16, 11.1.16-h3, and 10.2.18-h12, each with earlier hotfix-level fixes available for organizations that cannot move to the latest minor version immediately. Palo Alto's advisory states there are "no known workarounds," but it recommends restricting management-interface access to trusted internal IP addresses or a jump box, which is the vendor's long-standing best-practice guidance for every PAN-OS deployment regardless of this specific flaw; an organization already following it has meaningfully reduced its exposure. Palo Alto also offers limited coverage through Threat Prevention signatures 510046 and 510047, available to customers with a Threat Prevention subscription on Applications and Threats content version 9159-10287 or later, the minimum release that includes these signatures at all. Beyond having that content version, the advisory ties the coverage to four conditions that all have to be in place together: management traffic routed through a data-plane interface, the inbound management certificate replaced, that traffic decrypted so the firewall can inspect it (the advisory notes this requires SSL Decryption to be configured), and threat prevention enabled on it.

What to Do Now

• Check whether your organization or your managed provider runs a Cisco Secure Email Gateway with File Reputation enabled; if so, confirm the appliance's Content Scanner Tools version and get it to 25.3.0.5525 or later: automatic updates apply it without action, and if automatic updates are disabled, run contentscannerupdate at the CLI, which needs no restart. Treat this as the higher-priority item: it is unauthenticated, critical severity, and Cisco has confirmed active exploitation.
• Separately confirm your AsyncOS release against Cisco's fixed builds (15.5.5-014, or migrate to 16.5.0-780) so the appliance is current beyond just the Content Scanner Tools update.
• Check whether your organization runs PA-Series or VM-Series firewalls or Panorama, and whether the management interface is reachable only from trusted internal addresses or a jump box, as Palo Alto's standing guidance recommends; if it is reachable more broadly, restrict it now regardless of patch timing.
• Apply the fixed PAN-OS build for your branch on your normal emergency-change basis. Because exploitation requires valid credentials, also treat this as a prompt to review who holds administrative access to the management interface and rotate any credentials you cannot account for.
• If a Cisco Secure Email Gateway was reachable with File Reputation enabled on a vulnerable Content Scanner Tools version, treat compromise as possible before you upgrade. Cisco documents a log check, searching system_logs for a "System Security" entry, that can surface a suspected-compromise indicator, and recommends cross-referencing network and firewall logs as well. For a virtual appliance showing signs of compromise, Cisco's advisory warns that upgrading in place destroys forensic data, so record forensics information first, deploy a new virtual machine on a fixed release, rebuild its configuration without importing the old configuration files, renew the credentials and cryptographic material installed on it, and keep monitoring afterward; if any member of a cluster is compromised, restore every member, since cluster SSH keys may have been exposed. For a physical appliance, contact Cisco TAC instead.
• If a PAN-OS management interface was reachable by an authenticated attacker on a vulnerable version, review administrative-session logs for activity you cannot account for before assuming the patch alone resolved the risk.

Why This Belongs on Your Radar

Both flaws sit on infrastructure that many small and mid-size businesses run without thinking of it as a single point of risk: the appliance that filters inbound email, and the firewall that sits at the network edge. Neither depends on an unusual configuration: File Reputation is a standard anti-malware feature on Cisco's platform, and every PAN-OS deployment has a management interface, though Palo Alto's own best-practice guidance has long recommended restricting that interface to trusted internal addresses rather than exposing it broadly. Keep a dated record of when each fix was applied and what you checked; if a customer, auditor, or insurer later asks how you handle actively exploited vulnerabilities, that record is the answer.

For businesses subject to the FTC Safeguards Rule or the HIPAA Security Rule, the same obligations we have flagged for earlier advisories apply here. The FTC Safeguards Rule requires nonbanking financial institutions to maintain a documented information security program that includes vulnerability monitoring under 16 CFR 314.4(d)(2), though institutions maintaining customer information on fewer than 5,000 consumers are exempt from that paragraph. HHS Office for Civil Rights guidance is explicit that identifying and remediating known, actively exploited vulnerabilities in network infrastructure that handles protected health information falls within the ongoing risk analysis and risk management obligations at 45 CFR 164.308(a)(1)(ii)(A) and (B), and both an email gateway and a perimeter firewall are squarely the kind of infrastructure that guidance covers.

If your organization runs a Cisco Secure Email Gateway or Palo Alto Networks firewalls, confirm your version and patch status today. Cyber One Solutions tracks CISA's Known Exploited Vulnerabilities catalog and vendor advisories as part of our managed cybersecurity service, which keeps perimeter and email security appliances patched and monitored on a documented schedule. Our IT and security assessments can confirm your current exposure across both your email security and network infrastructure as a standalone engagement.

Sources

• Cisco Security Advisory: Cisco Secure Email Gateway Arbitrary File Write Vulnerability
• CISA: Known Exploited Vulnerabilities Catalog, CVE-2026-76519
• Palo Alto Networks Security Advisory: CVE-2026-0322, PAN-OS Authenticated Code Injection
• CISA: Known Exploited Vulnerabilities Catalog, CVE-2026-0322
• CISA: Binding Operational Directive 26-04, Prioritizing Security Updates Based on Risk
• Federal Trade Commission: FTC Safeguards Rule, What Your Business Needs to Know
• HHS OCR: January 2026 Cybersecurity Newsletter