Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation
Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation.
Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation.
Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls.
The disclosure comes as Cisco warned that threat actors are exploiting a critical flaw in Cisco Secure Email Gateway ( CVE-2026-76519 , CVSS score: 9.8) that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
In January, the company patched a maximum-severity Cisco AsyncOS flaw (CVE-2025-20393) that attackers have exploited in zero-day attacks targeting SEG and Secure Email and Web Manager (SEWM) appliances since November 2025 .
are assessed to be linked to the exploit attempts - It credited Suraj Siddharudh, a senior principal product security researcher at Palo Alto Networks, with discovering and reporting the vulnerability.
Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, Cisco said in an advisory on Wednesday.
Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges.
Palo Alto Networks said that no special configuration is required to exploit the issue, but said the security risk can be minimized by restricting access to the management interface to only trusted internal IP addresses.
Palo Alto Networks confirmed in a security advisory published Wednesday that it has seen limited exploitation of the flaw in attacks.
The same day, Cisco published a hardening release for the gateway and for Secure Email and Web Manager that grouped internally found bugs into five umbrella CVEs by weakness class: CVE-2026-76440, CVE-2026-76441, CVE-2026-20353, and CVE-2026-76443, each scored 9.8, and CVE-2026-76442 at 7.5.
What happened
Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation.
Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls.
What changed
The disclosure comes as Cisco warned that threat actors are exploiting a critical flaw in Cisco Secure Email Gateway ( CVE-2026-76519 , CVSS score: 9.8) that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
In January, the company patched a maximum-severity Cisco AsyncOS flaw (CVE-2025-20393) that attackers have exploited in zero-day attacks targeting SEG and Secure Email and Web Manager (SEWM) appliances since November 2025 .
Who is affected
are assessed to be linked to the exploit attempts - It credited Suraj Siddharudh, a senior principal product security researcher at Palo Alto Networks, with discovering and reporting the vulnerability.
Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, Cisco said in an advisory on Wednesday.
Why it matters
Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges.
Palo Alto Networks said that no special configuration is required to exploit the issue, but said the security risk can be minimized by restricting access to the management interface to only trusted internal IP addresses.
Technical details
Palo Alto Networks confirmed in a security advisory published Wednesday that it has seen limited exploitation of the flaw in attacks.
The same day, Cisco published a hardening release for the gateway and for Secure Email and Web Manager that grouped internally found bugs into five umbrella CVEs by weakness class: CVE-2026-76440, CVE-2026-76441, CVE-2026-20353, and CVE-2026-76443, each scored 9.8, and CVE-2026-76442 at 7.5.
It is also the third root-level flaw in these appliances that Cisco has confirmed exploited since December, when a China-linked group that Cisco Talos tracks as UAT-9686 used a zero-day in the spam quarantine feature , CVE-2025-20393, that Cisco patched in January .
Response
More recently, last month, Cisco warned customers to patch a new actively exploited SEG zero-day (CVE-2026-76461) in the email parsing of Cisco AsyncOS Software that also lets unauthenticated, remote attackers execute arbitrary commands with root privileges on the underlying OS.
The fix has been shipping since September 14 in AsyncOS 15.5.5-014 and 16.5.0-780, the builds Cisco listed as fixed in a hardening release that day, which the company now says covered this flaw.
What security teams should do
Cybersecurity and Infrastructure Security Agency (CISA) has now added CVE-2026-0322 to the Known Exploited Vulnerabilities catalog and requires federal civilian agencies to mitigate the vulnerability by October 17.
Cisco updated that advisory on Wednesday, and it now says "Two of them are known to be actively exploited": the file-write flaw, which sits in the path traversal class, and the September SQL injection flaw, which sits in the improper neutralization class.
Attribution
The Hacker News: Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation.
BleepingComputer: Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls.
The Hacker News: Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, Cisco said in an advisory on Wednesday.
BleepingComputer: Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges.
What to watch next
Watch for new exploitation reports and updated indicators of compromise.
Watch for updated vendor guidance and fixed-version details.