securitytabs

LiveUpdated

CISA lists exploited PAN-OS CVE-2026-0322 and Cisco Secure Email Gateway flaw

CISA added an exploited PAN-OS remote code execution flaw and a Cisco Secure Email Gateway file-write flaw to its KEV catalogue on October 14. Palo Alto Networks has issued security updates.

Written and kept up to date by the SecurityTabs AI newsroom from 3 outlets, and published automatically. Each paragraph cites its sources. CVSS, EPSS and KEV status below come directly from NVD, FIRST and CISA, not from the AI.

Vulnerabilities

What happened

CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalogue on October 14, citing evidence of active exploitation. Two are CVE-2026-0322, a Palo Alto Networks PAN-OS code injection flaw, and CVE-2026-76519, a Cisco Secure Email Gateway relative path traversal flaw. The other two affect Ahsay AhsayCBS. [1]

The SANS Internet Storm Center described the PAN-OS and Cisco flaws as exploited zero-days in its October 16 StormCast, which also mentioned Ivanti Connect Secure. [2]

PAN-OS CVE-2026-0322

The Hacker News reports that Palo Alto Networks issued security updates for the flaw, a remote code execution vulnerability in the PAN-OS management interface rated CVSS 8.6, which it says is under active exploitation. The advisory title on file says the flaw requires authentication. [3]

Cisco CVE-2026-76519

The facts on file describe CVE-2026-76519 as an arbitrary file write vulnerability in Cisco Secure Email Gateway, rated CVSS 9.8. The excerpts available do not say who is exploiting it or how many systems are affected. [1][2]

What is not yet known

The sources reviewed do not identify the attackers, the number of victims or any indicators of compromise. The KEV entries list known ransomware use as unknown for both flaws. [1][3]

Business Action

What this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

CISA says both flaws are being exploited, and Palo Alto Networks has released updates for the PAN-OS one. Businesses that rely on providers for firewalls or email security should confirm those products are updated. [1][3]

What to do

  1. Ask your IT provider or MSP whether you use Palo Alto PAN-OS firewalls or Cisco Secure Email Gateway. [1]
  2. If you do, ask whether the vendor updates have been installed. [3]

Mid-size company

A small IT or security team

What to know

CISA set a federal due date of October 17 for both flaws, which signals urgency for other organizations. [1]

What to do

  1. Find PAN-OS and Cisco Secure Email Gateway devices in your asset inventory. [1]
  2. Apply the Palo Alto Networks security updates for CVE-2026-0322 and check Cisco's advisory for CVE-2026-76519. [3][1]

Large enterprise

A security operations team

What to know

Both vulnerabilities are in the KEV catalogue. The sources give no indicators of compromise yet. [1][3]

What to do

  1. Inventory all PAN-OS and Cisco Secure Email Gateway instances, including those managed by third parties. [1]
  2. Patch CVE-2026-0322 using the Palo Alto Networks updates and apply Cisco's guidance for CVE-2026-76519. [3][1]
  3. Review management interface and email gateway logs for signs of compromise. [2]

Timeline

  1. SANS Internet Storm Center described the PAN-OS and Cisco flaws as exploited zero-days. [2]

  2. The Hacker News reported that Palo Alto Networks had issued updates for CVE-2026-0322 amid active exploitation. [3]

  3. CISA added CVE-2026-0322 and CVE-2026-76519, along with two Ahsay flaws, to its KEV catalogue. [1]

  4. · CISA KEV

    CISA added CVE-2026-76519 to its Known Exploited Vulnerabilities catalog.

  5. · CISA KEV

    CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog.

  6. · coverage

    Earliest coverage cited in this report: CISA Advisories. [1]

Sources

  1. [1]CISA Advisories · Oct 14, 12:00 UTC
    CISA Adds Four Known Exploited Vulnerabilities to Catalogcontext
  2. [2]SANS Internet Storm Center StormCast · Oct 16, 02:00 UTC
    SANS Stormcast Friday, October 16th, 2026: Panchan Crypto Mining Worm; Exploited 0-Days in Cisco Secure Email Gateway (CVE-2026-76519), Palo Alto PAN-OS (CVE-2026-0322) and Ivanti Connect Securecontext
  3. [3]The Hacker News · Oct 15, 11:46 UTC
    Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitationcontext