Exploited PAN-OS and Cisco Gateway Flaws Have No Workarounds

CISA added two flaws to its Known Exploited Vulnerabilities catalog on Oct. 14: CVE-2026-0322 in Palo Alto Networks PAN-OS, which needs an authenticated attacker with network access to the management interface, and CVE-2026-76519 in Cisco Secure Email Gateway, which needs no login if File Reputation is enabled. Both vendors say they have seen exploitation. Neither offers a workaround.

The alert, which also listed two AhsayCBS flaws, names all four as exploited and points agencies to Binding Operational Directive 26-04. It gives no due date.

PAN-OS: root on the firewall, if you can reach the management port

Palo Alto's advisory describes a code injection flaw, CWE-94, that lets an authenticated attacker run arbitrary code as root. It affects PA-Series and VM-Series firewalls and Panorama, virtual and M-Series. Cloud NGFW and Prisma Access are not affected. The company says "very limited exploitation has been observed targeting the Palo Alto Networks management interface."

The CVSS 4.0 score is 8.6, with a vector marking high privileges required. The score tracks the credentials requirement honestly, but the advisory warns that "the risk is highest when you allow access to the management interface from external IP addresses on the internet." If the interface faces the internet, a stolen or sprayed administrator password becomes root on the perimeter device. Palo Alto lists three indicator addresses and credits Suraj Siddharudh, an internal reporter, with finding it.

Fixes depend on the train. The advisory lists 12.2.4 and later, 12.1.4-h12, 12.1.7-h8 or 12.1.10-h2 and later, 11.2.16 and later, and hotfix builds on 11.1 and 10.2. It updated Oct. 15 to add 11.2.16. Threat Prevention IDs 510046 and 510047 give partial coverage but need SSL decryption and may miss variants.

Cisco: a 9.8 with two conditions attached

Cisco's advisory, published Oct. 14, describes improper handling of email attachments in Advanced Malware Protection. An unauthenticated remote attacker can send a crafted attachment to write arbitrary files, and can then execute commands as root. The score is 9.8 on CVSS 3.1, and Cisco PSIRT says it became aware of exploitation in October 2026.

The score overstates the exposure for some owners. A gateway is vulnerable only when File Reputation is enabled and assigned to a mail policy, and Content Scanner Tools is earlier than 25.3.0.5525. Cisco found the bug in internal scanning. The fix is 15.5.5-014 on the 15.5 train, 16.5.0-780 on 16.5, or a Content Scanner Tools update to 25.3.0.5525 or later, which applies without a restart.

It is not the product's first exploited flaw. CISA catalogued CVE-2026-76461, a separate critical flaw in AsyncOS email parsing, in September, with a Sept. 17 federal deadline, according to The Hacker News. Cisco's guidance on that one said root access may let attackers remove evidence, so administrators should check firewall logs for unexpected uploads.

Side by side

	PAN-OS CVE-2026-0322	Cisco CVE-2026-76519
Login needed	Yes, administrator	No
Score	8.6 (CVSS 4.0)	9.8 (CVSS 3.1)
Preconditions	Management interface reachable	File Reputation on, scanner older than 25.3.0.5525

The two scores come from different CVSS versions, so they should not be ranked against each other.

Operators of either product should patch first, then check for compromise, since both flaws give root and Cisco's earlier guidance warns that logs may be altered. The FortiMail and NetScaler case shows what happens when exploitation runs ahead of a fix. Palo Alto's advisory records no workaround, and the fastest control it names is restricting management access to trusted internal IP addresses.