Palo Alto Networks Patches Firewall Flaw Already Being Exploited in the Wild

Palo Alto Networks has issued security updates for a high-severity flaw in its PAN-OS software, tracked as CVE-2026-0322 (CVSS score: 8.6). The bug is a remote code execution issue in the management interface. It lets an authenticated attacker with network access run arbitrary code with root privileges on the firewall. It affects PA-Series and VM-Series firewalls and Panorama (virtual and M-Series). Cloud NGFW and Prisma Access are not affected.

The company said no special configuration is needed to exploit the issue. It has seen "very limited exploitation" targeting the management interface, but has not said what the malicious activity involved, who is behind it, or when it began. It has published IP addresses geolocated to the U.S. that are linked to the exploit attempts. To reduce risk, it advises limiting management interface access to trusted internal IP addresses, such as a single jump box that is the only system allowed to reach it. Patches are available.

The disclosure comes as Cisco warned that attackers are exploiting a critical flaw in Cisco Secure Email Gateway (CVE-2026-76519, CVSS score: 9.8). Cisco says an unauthenticated, remote attacker could write arbitrary files and run commands with root privileges by sending an email with a crafted attachment through an affected device, when the file reputation service is enabled.