Active Exploits in Palo Alto PAN-OS and Cisco Secure Email Gateway: What to Do Now

Two high-severity vulnerabilities in widely deployed enterprise security products are being actively exploited, and both require prompt attention from affected organisations. The Hacker News reports that Palo Alto Networks has issued patches for CVE-2026-0322, a remote code execution vulnerability in the management interface of PAN-OS software with a CVSS score of 8.6. The company has confirmed limited exploitation against customers' firewalls and has published indicators of compromise to assist defenders. Separately, Cisco has warned of active attacks targeting CVE-2026-76519, a critical flaw in its Secure Email Gateway product that allows an unauthenticated remote attacker to write arbitrary files to the appliance's operating system and execute commands with root privileges by sending a specially crafted email attachment.

Why this matters for UK organisations

Both products are commonly found in UK enterprise environments. Palo Alto firewalls are a standard component of network perimeter security for organisations of all sizes, and Cisco's Secure Email Gateway is widely used to protect inbound email flows from spam, phishing and malware. The Cisco vulnerability is particularly notable because it requires no authentication and can be triggered through the normal email delivery process — an attacker does not need to have any existing access or credentials to attempt exploitation. This means that organisations do not need to have misconfigured the product to be at risk; simply receiving a crafted email through the gateway is sufficient to trigger the vulnerability. The fact that both vulnerabilities are confirmed as actively exploited means the window for applying patches before encountering an attack is already narrowing. Organisations that have not yet applied available fixes should treat this as a priority, not a routine patching task.

What to review

Confirm whether your organisation runs Palo Alto PAN-OS firewalls or Cisco Secure Email Gateway appliances and identify the current software versions in use. Check vendor advisory pages for both products to confirm whether patches are available and applicable to your deployment. Review the indicators of compromise published by Palo Alto Networks and check your security monitoring tools for any matching activity. For the Cisco vulnerability, consider whether any temporary mitigations are available while patching is arranged. Ensure that the relevant asset owners and security operations contacts are aware of both vulnerabilities and that a clear remediation timeline has been agreed.

Source: The Hacker News