Cisco Secure Email & PAN-OS Zero-Days Exploited

Cisco and Palo Alto Networks have patched two actively exploited zero-day vulnerabilities that can lead to root-level code execution on security appliances. CISA has flagged both vulnerabilities as known exploited flaws, adding them to its Known Exploited Vulnerabilities (KEV) catalog.

CVE-2026-76519 affects Cisco Secure Email Gateway and can be exploited remotely without authentication through malicious email attachments. CVE-2026-0322 affects the PAN-OS management interface and requires network access plus valid high-privilege credentials.

Both flaws require urgent remediation, but their attack paths and exposure conditions differ significantly.

CVE-2026-76519: Cisco Secure Email Gateway Zero-Day

CVE-2026-76519 is a relative path traversal vulnerability (CWE-23) in the Advanced Malware Protection (AMP) File Reputation attachment-processing path. Cisco rates it Critical with a CVSS 3.1 score of 9.8.

According to Cisco’s CVE-2026-76519 security advisory, an unauthenticated attacker can send a crafted attachment through an affected gateway, write arbitrary files to the underlying operating system, and execute commands with root privileges.

A Secure Email Gateway is vulnerable when:

• AMP File Reputation is enabled for an incoming or outgoing mail policy.
• Content Scanner Tools is earlier than 25.3.0.5525.

Updating Content Scanner Tools to 25.3.0.5525 or later also fixes the issue without requiring a restart. Administrators can verify the package with contentscannerstatus.

Secure Email and Web Manager and Secure Web Appliance are not affected. Cisco Secure Email Cloud already has the corrected package deployed.

Cisco also warns that root compromise may expose private SSH keys used between cluster members, potentially putting other Secure Email Gateway appliances in the same cluster at risk.

CVE-2026-0322: Palo Alto PAN-OS Zero-Day

CVE-2026-0322 is a code injection vulnerability (CWE-94) in the PAN-OS management interface.

Palo Alto Networks’ CVE-2026-0322 advisory states that an authenticated attacker with management-interface access and sufficiently high privileges can execute arbitrary code with root privileges.

Palo Alto Networks rates the flaw High with a CVSS 4.0 score of 8.6 and labels its exploit maturity ATTACKED.

Unsupported releases should move to a supported fixed branch. Cloud NGFW and Prisma Access are not affected.

Palo Alto Networks reported very limited exploitation and associated activity with:

• 66.42.72[.]14
• 208.83.239[.]114
• 149.248.47[.]234

These addresses are hunting leads, not proof that every connection represents successful exploitation.

How Do the Two Zero-Days Differ?

The Cisco vulnerability is unauthenticated and email-delivered when vulnerable File Reputation processing is enabled.

The PAN-OS flaw requires high-privilege credentials and access to the management interface. This reduces opportunistic exposure but remains serious where administrative credentials have been stolen or management interfaces are externally reachable.

Both can ultimately provide root-level execution on infrastructure responsible for email or network security.

CISA Adds Both Zero-Days to KEV

CISA added CVE-2026-76519 and CVE-2026-0322 to its Known Exploited Vulnerabilities catalog on October 14, 2026.

Covered U.S. federal agencies must remediate both vulnerabilities by October 17, 2026. The short deadline reflects the confirmed exploitation and potential impact of compromise.

Organizations outside the federal government should also treat KEV inclusion as a strong prioritization signal.

Track the Exploited Zero-Days with SOCRadar

Because both vulnerabilities are already being exploited, remediation should focus first on which affected security appliances are exposed and still vulnerable.

SOCRadar’s Cyber Threat Intelligence module can help teams follow CVE-2026-76519 and CVE-2026-0322 for exploitation updates, CISA KEV status, indicators, and remediation changes. Vulnerability Intelligence adds technical and risk context as new information emerges.

Combined with Attack Surface Management, organizations can identify externally exposed Cisco Secure Email Gateway and PAN-OS assets and prioritize systems where vulnerable software, risky configurations, and network exposure overlap.

What Should Defenders Do?

For Cisco Secure Email Gateway, update Content Scanner Tools to 25.3.0.5525 or later or install the applicable fixed AsyncOS release. Cisco states that no workaround addresses the vulnerability.

Review system_logs for System Security messages and correlate them with external firewall and network telemetry. If one cluster member is compromised, Cisco recommends restoring every cluster member because shared SSH keys may have been exposed.

For PAN-OS, install the appropriate fixed release and restrict management interface access to trusted internal IP addresses, preferably through a controlled jump box.

Threat Prevention customers can use Threat IDs 510046 and 510047 for limited coverage, but Palo Alto Networks states that this does not replace upgrading.

For both zero-days, review historical authentication, configuration, network, and administrative activity from the pre-patch exposure period rather than assuming that installing the update proves the appliance was never compromised.