The Cybersecurity and Infrastructure Security Agency (CISA) said Wednesday that attackers are exploiting flaws in Palo Alto Networks firewalls and Cisco email security gateways, and gave federal civilian agencies until Saturday, Oct. 17, to deal with them. Both products sit at the edge of corporate and government networks, and both vendors say a successful attack gives the intruder root, or full administrative, control of the device.

What Happened

CISA added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, its list of flaws with evidence of real-world attacks. The batch also includes two flaws in Ahsay’s AhsayCBS backup server software, with the same deadline.

Palo Alto’s advisory describes CVE-2026-0322 as a code-injection flaw in the PAN-OS management interface, the console administrators use to configure the firewall. An attacker who already has credentials and network access to that interface can run code as root. The company rates the bug high severity, 8.6 on the 10-point Common Vulnerability Scoring System, but gives it its “highest” urgency, reports “very limited exploitation” and lists three IP addresses tied to the activity. PA-Series and VM-Series firewalls and Panorama management appliances are affected; the Cloud NGFW and Prisma Access services are not. Fixes cover the 10.2, 11.1, 11.2, 12.1 and 12.2 release lines, with one 11.2 build due Oct. 15. Palo Alto says no workaround exists and that its threat-prevention signatures offer only limited coverage.

RelatedFrance Widens Fridge-Hack Alert to More Controllers as Store Count Passes 350

Cisco’s advisory, first published Oct. 14, covers CVE-2026-76519, rated critical at 9.8. An attacker with no account can write files and run commands as root by sending an email with a crafted attachment through a vulnerable Secure Email Gateway. Devices are exposed when the File Reputation service, part of Cisco’s Advanced Malware Protection, is enabled on a mail policy and the Content Scanner Tools package is older than version 25.3.0.5525. Cisco says its product security team learned of active exploitation in October and that there are no workarounds. Updating Content Scanner Tools fixes the flaw without a restart; fixed AsyncOS releases are also available.

SecurityWeek reported that those fixed releases first shipped Sept. 14, when Cisco grouped the bug under a different identifier, and that the company updated its guidance Wednesday to report attacks.

Why It Matters

Firewalls and mail gateways inspect what enters an organization, so an attacker who controls one sits at a choke point for traffic or email. Cisco’s guidance shows why patching alone may not close the matter. It warns that attackers with root access may remove or hide evidence and advises checking network and firewall logs for unexpected uploads to outside addresses. For virtual appliances suspected of compromise, it says to preserve forensic data before upgrading, rebuild on a fixed release and renew credentials and cryptographic keys. In clusters, it recommends restoring every member, because shared SSH keys could let an intruder move between appliances.

Both KEV entries state that forensic triage is required under Binding Operational Directive 26-04, so agencies must look for signs of a breach as well as fix the flaw. The directive binds only federal civilian agencies, but CISA urges all organizations to prioritize catalog entries.

The Palo Alto flaw requires valid credentials, and the company says risk is highest when the management interface is reachable from the internet. It recommends restricting that interface to trusted internal addresses or a single jump box. For boards, the practical questions are whether management access to perimeter devices is exposed and whether the security team has checked for compromise rather than only patched.

Context

This is the second exploited Secure Email Gateway flaw in about a month, after CVE-2026-76461 in September, BleepingComputer reported. The Shadowserver Foundation, a nonprofit that scans the internet, tracks nearly 300 exposed gateways, according to BleepingComputer, though it is unclear how many are vulnerable.

The listing comes a day after CISA gave agencies until Oct. 16 to fix an exploited Ivanti Connect Secure flaw, leaving security teams with back-to-back emergency deadlines for edge devices.

What to Watch

No attribution has been made. BleepingComputer said Palo Alto did not answer questions about when exploitation began, who is responsible or whether compromised firewalls were used to reach internal networks, and The Register reported that a Cisco spokesperson declined to say how many appliances were compromised. Watch for incident-response reports naming the attackers, additional indicators of compromise from either vendor, and any disclosures by agencies or companies that find breached devices after the Oct. 17 deadline.