Cybersecurity

Palo Alto Networks patches PAN-OS flaw under exploitation

Palo Alto Networks released fixes for a PAN-OS management-interface flaw after limited exploitation, while Cisco separately warned of an exploited Secure Email Gateway bug and CISA added both to KEV.

The Hacker News 15 October 2026

Palo Alto Networks said on Wednesday that it had issued updates for CVE-2026-0322 after seeing limited exploitation.
The company said the flaw sat in the PAN-OS management interface and could let an authenticated network user run code with root privileges on a firewall.
It said the issue affected PA-Series and VM-Series firewalls and Panorama, while Cloud NGFW and Prisma Access were not affected.
Cisco said attackers were exploiting CVE-2026-76519 in Cisco Secure Email Gateway, which could let a remote attacker write files and run commands as root.
CISA added both CVE-2026-0322 and CVE-2026-76519 to its Known Exploited Vulnerabilities catalogue and set 17 October 2026 for Federal Civilian Executive Branch agencies to prioritise fixes.

Palo Alto Networks said on Wednesday that it had issued updates for CVE-2026-0322 after seeing limited exploitation. The company said the flaw was in the PAN-OS management interface and could let an authenticated network user run code with root privileges on a firewall.

The issue applied to PAN-OS on PA-Series and VM-Series firewalls and on Panorama, including the virtual and M-Series editions. Palo Alto Networks said Cloud NGFW and Prisma Access were not affected, and that no special configuration was needed to exploit the bug.

The company said access to the management interface should be limited to trusted internal IP addresses, or to a jump box that alone could reach it. It listed fixes for PAN-OS 12.2.4; 12.1.4-h12, 12.1.7-h8 and 12.1.10-h2; 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3 and 11.2.16; 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15 and 11.1.16-h3; and 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11 and 10.2.18-h12.

Palo Alto Networks said it linked three U.S.-based IP addresses to the exploit attempts and credited Suraj Siddharudh for finding the issue. It did not say who was behind the activity or when it began. Cisco separately said attackers were exploiting CVE-2026-76519 in Cisco Secure Email Gateway, and CISA added both CVEs to its Known Exploited Vulnerabilities catalogue for Federal Civilian Executive Branch agencies to fix by 17 October 2026.

Named in this story

People

Suraj Siddharudh: was credited with finding and reporting the vulnerability

Companies

Palo Alto Networks: issued the patches and described the exploitation
Cisco: warned that attackers were exploiting a separate flaw

Governments and agencies

U.S. Cybersecurity and Infrastructure Security Agency: added both vulnerabilities to its Known Exploited Vulnerabilities catalogue
Federal Civilian Executive Branch: agencies were told to prioritise fixes by 17 October 2026

Products and systems

PAN-OS: the firewall software affected by the flaw
PA-Series: one affected firewall line
VM-Series: another affected firewall line
Panorama: the management platform affected by the flaw
Cloud NGFW: was said not to be affected
Prisma Access: was said not to be affected
Cisco Secure Email Gateway: the Cisco product with the exploited flaw

How the source tells it

The piece read as a routine security advisory, with restrained urgency supplied by active-exploitation claims and the fix deadline.

urgency active exploitation and the KEV remediation date were used to press prompt patching