Vulnerabilities
Cisco and Palo Alto Networks Urge Immediate Patching as Email and Firewall Flaws Are Exploited
Critical vulnerabilities in Cisco Secure Email Gateway and Palo Alto Networks PAN-OS are being exploited. Both companies urge customers to patch and check for signs of compromise.
Ross GrantUpdated 4 min read
The short version
Critical security flaws in Cisco's email gateway and Palo Alto Networks' firewall software are being exploited by attackers. Both companies have released patches and are urging customers to update their systems and check for signs of compromise. These flaws could let attackers take control of key security systems if left unpatched.
What happened?
CISA added four new vulnerabilities to its Known Exploited Vulnerabilities catalogue on 14 October 2026, including critical flaws in Cisco Secure Email Gateway and Palo Alto Networks PAN-OS. Both companies have confirmed active exploitation and urged customers to patch and check for compromise.
Multiple Critical Flaws Added to CISA’s Exploited List
On 14 October 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue. These include serious flaws in Cisco Secure Email Gateway (CVE-2026-76519), Palo Alto Networks PAN-OS (CVE-2026-0322), and AhsayCBS backup software (CVE-2026-105133 and CVE-2026-105134) [CISA (opens in a new tab)]. The KEV catalogue lists vulnerabilities that are confirmed to be actively exploited. CISA requires federal agencies to patch these flaws quickly, and strongly encourages all organisations to do the same.
Cisco Secure Email Gateway: What’s at Risk
Cisco’s Secure Email Gateway is widely used to filter and protect email traffic. The flaw (CVE-2026-76519) is a relative path traversal vulnerability. According to CISA, it allows an unauthenticated, remote attacker to write files anywhere on the underlying operating system [CISA (opens in a new tab)]. If exploited, an attacker could gain root access, which means full control over the system. Cisco confirmed that attackers are actively exploiting this bug and has urged customers to update their systems and check for signs of compromise [Security Affairs (opens in a new tab)].
CISA’s guidance requires not only patching but also forensic triage. This means organisations should check whether attackers accessed or tampered with their systems before the patch was applied. If mitigations are not available, CISA recommends discontinuing use of the product.
Palo Alto Networks PAN-OS: Remote Code Execution in Firewalls
Palo Alto Networks disclosed a high-severity flaw (CVE-2026-0322) in its PAN-OS firewall software. This vulnerability allows an attacker with valid credentials and network access to the management interface to execute code as root, giving them full control over the firewall [BleepingComputer (opens in a new tab); The Hacker News (opens in a new tab)].
The company has seen limited exploitation so far, but urges customers to patch immediately. Patches are available for supported versions, and fixes for some versions are scheduled within days. Palo Alto Networks also recommends restricting management interface access to trusted internal IP addresses. There are no known workarounds, though some protection is possible for customers with Threat Prevention subscriptions. The company shared three IP addresses linked to exploit attempts, but did not provide details on the attackers or the impact.
AhsayCBS: Backup Software Under Attack
Two vulnerabilities in AhsayCBS backup software (CVE-2026-105133 and CVE-2026-105134) have also been exploited. Attackers have used these flaws to deploy web shells and cryptocurrency miners on affected systems [The Hacker News (opens in a new tab)]. The vendor has released new fixes after earlier patches were found to be incomplete.
What Organisations Should Do Now
CISA’s Binding Operational Directive 26-04 requires federal agencies to prioritise patching these vulnerabilities and to check for evidence of compromise. While this is mandatory for US federal agencies, CISA strongly recommends all organisations adopt a risk-based approach and prioritise remediation of vulnerabilities listed in the KEV catalogue. For cloud services, organisations should follow the same guidance or discontinue use if mitigations are not available.
For defenders, this means:
- Patch affected Cisco, Palo Alto Networks, and AhsayCBS products immediately.
- Restrict access to management interfaces to trusted networks.
- Review logs and systems for signs of compromise, especially before the patch was applied.
- Monitor for new updates and advisories from vendors and CISA.
Broader Context: Why These Flaws Matter
Vulnerabilities in email gateways and firewall management interfaces are especially dangerous because they are often exposed to the internet and can provide attackers with a foothold inside an organisation. The addition of these flaws to CISA’s KEV catalogue signals that they are being used in real-world attacks. Organisations that delay patching or fail to check for compromise could face serious risks, including data breaches, system takeover, and regulatory penalties.
Next Steps and Practical Advice
If you use any of the affected products, check vendor advisories and apply patches without delay. Limit access to management interfaces and monitor your systems for unusual activity. If you suspect compromise, follow your incident response plan and consider engaging forensic experts. Regulators in many countries can impose heavy fines for breaches involving personal data, so timely action is not just good practice but may be legally required.
Claimed vs confirmed
- Confirmed
Attackers are actively exploiting the Cisco Secure Email Gateway flaw (CVE-2026-76519).
Cisco and CISA have confirmed active exploitation of this vulnerability.
- Confirmed
Palo Alto Networks PAN-OS flaw (CVE-2026-0322) is being exploited in the wild.
Palo Alto Networks and CISA have confirmed limited exploitation.
The impact
- Money
- No direct financial losses are reported, but organisations could face costs for incident response, system recovery, and possible regulatory fines. Under GDPR, fines can reach €20 million or 4% of global turnover.
- Reputation
- Organisations using unpatched systems risk reputational damage if attackers gain control or cause a breach. Prompt patching and transparency can help maintain trust.
- Customers
- Customers may be at risk if attackers use these flaws to access sensitive data or disrupt services. Users should watch for notifications from affected organisations and follow security advice.
Why it matters
These vulnerabilities affect core security products used by many organisations. If exploited, attackers could gain full control over email or firewall systems, leading to data breaches or further attacks. Quick action is needed to protect networks and sensitive data.
How does it work?
The Cisco Secure Email Gateway flaw (CVE-2026-76519) is a relative path traversal vulnerability. It allows a remote, unauthenticated attacker to write files anywhere on the system, potentially gaining root access. The Palo Alto Networks PAN-OS flaw (CVE-2026-0322) allows an attacker with valid credentials and network access to the management interface to execute code as root. The AhsayCBS flaws can be chained to bypass authentication and run arbitrary commands.
Key points
- CISA added four actively exploited vulnerabilities to its KEV catalogue.
- Cisco and Palo Alto Networks confirmed attacks on their products and urge immediate patching.
- The flaws can give attackers full control over email gateways or firewalls.
- Forensic checks are advised to detect compromise before patching.
- Restricting access to management interfaces reduces risk.
Sources
CISA
Government
BleepingComputer
Reference
The Hacker News
Reference
Security Affairs
Reference
