Ethical Hacking News
Palo Alto Networks has addressed a high-severity authenticated RCE flaw in their PAN-OS software, which has been actively exploited by threat actors. The vulnerability allows an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The company has released patches and has acknowledged the discovery and reporting of the vulnerability by senior principal product security researcher Suraj Siddharudh.
Palo Alto Networks has issued security updates for a high-severity flaw in their PAN-OS software. The vulnerability, CVE-2026-0322, allows remote code execution with root privileges on firewalls. Cloud NGFW and Prisma Access are not affected by the vulnerability. Patches are available for PAN-OS software versions >= 12.2.4. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. Cisco has warned about a critical flaw in Cisco Secure Email Gateway (CVE-2026-76519) that could allow an unauthenticated, remote attacker to write arbitrary files.
Palo Alto Networks has issued security updates for a high-severity flaw in their PAN-OS software, which has been actively exploited by threat actors. The vulnerability, tracked as CVE-2026-0322, is a case of remote code execution in the management interface. This means that an authenticated attacker with network access can execute arbitrary code with root privileges on the firewall.
The issue impacts PAN-OS software on PA-Series and VM-Series firewalls, as well as on Panorama (virtual and M-Series). Cloud NGFW and Prisma Access are not affected by the vulnerability. According to Palo Alto Networks, no special configuration is required to exploit the issue, but restricting access to the management interface to only trusted internal IP addresses can minimize the security risk.
Suraj Siddharudh, a senior principal product security researcher at Palo Alto Networks, discovered and reported the vulnerability. The company has acknowledged that it has seen "very limited exploitation" targeting the Palo Alto Networks management interface, but did not elaborate on the nature of the malicious activity involved, who is behind the effort, or when it began.
Threat actors have been attempting to exploit the vulnerability using IP addresses geolocated to the U.S., including 66.42.72[.]14, 208.83.239[.]114, and 149.248.47[.]234. These IP addresses are assessed to be linked to the exploit attempts.
The disclosure comes as Cisco warned that threat actors are exploiting a critical flaw in Cisco Secure Email Gateway (CVE-2026-76519), which could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has since added both CVE-2026-0322 and CVE-2026-76519 to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to prioritize fixes by October 17, 2026.
Palo Alto Networks has released patches in the following versions: PAN-OS >= 12.2.4, PAN-OS >= 12.1.4-h12, >= 12.1.7-h8, >= 12.1.10-h2, PAN-OS >= 11.2.4-h22, >= 11.2.7-h21, >= 11.2.10-h15, >= 11.2.13-h3, >= 11.2.16 (ETA: October 15, 2026), PAN-OS >= 11.1.4-h37, >= 11.1.6-h39, >= 11.1.7-h11, >= 11.1.10-h35, >= 11.1.13-h15, >= 11.1.16-h3, PAN-OS >= 10.2.7-h38, >= 10.2.10-h41, >= 10.2.13-h26, >= 10.2.16-h11, >= 10.2.18-h12.
The company has also acknowledged that Suraj Siddharudh discovered and reported the vulnerability.
The disclosure comes as Cisco warned that threat actors are exploiting a critical flaw in Cisco Secure Email Gateway (CVE-2026-76519), which could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has since added both CVE-2026-0322 and CVE-2026-76519 to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to prioritize fixes by October 17, 2026.
Related Information:
https://www.ethicalhackingnews.com/articles/Palo-Alto-Networks-Addresses-High-Severity-Authenticated-RCE-Flaw-in-PAN-OS-Software-Amid-Active-Exploitation-ehn.shtml
https://thehackernews.com/2026/10/palo-alto-networks-patches-pan-os.html
https://security.paloaltonetworks.com/CVE-2026-0322
https://nvd.nist.gov/vuln/detail/CVE-2026-0322
https://www.cvedetails.com/cve/CVE-2026-0322/
https://nvd.nist.gov/vuln/detail/CVE-2026-76519
https://www.cvedetails.com/cve/CVE-2026-76519/
Published: Thu Oct 15 03:04:56 2026 by llama3.2 3B Q4_K_M
