CISCO and Palo Alto Networks have issued patches for two actively exploited zero-day vulnerabilities that can enable root-level code execution on security appliances. The flaws, CVE-2026-76519 and CVE-2026-0322, have been added to the US CISA Known Exploited Vulnerabilities (KEV) catalog, with federal agencies given a remediation deadline of 17 October 2026 after the KEV inclusion on 14 October 2026.
CVE-2026-76519 affects Cisco Secure Email Gateway and is an unauthenticated relative path traversal (CWE-23) in the AMP File Reputation attachment-processing path. Cisco’s advisory states that an unauthenticated attacker can deliver a crafted attachment via an affected gateway, write arbitrary files to the underlying OS and execute commands with root privileges.
The vulnerability is exposed when AMP File Reputation is enabled for an incoming or outgoing mail policy and Content Scanner Tools is earlier than 25.3.0.5525. Fixed releases listed are 15.5.5-014 for 15.5, 16.0, and 16.5 with 16.5.0-780; upgrading Content Scanner Tools to 25.3.0.5525 or later also fixes the issue without a restart. Cisco notes that root compromise may expose private SSH keys used between cluster members, potentially jeopardising other appliances in the same cluster.
CVE-2026-0322 affects Palo Alto Networks’ PAN-OS management interface (CWE-94). An authenticated attacker with management-interface access and sufficiently high privileges can execute arbitrary code with root privileges. PAN-OS fixes are available for several branches: 12.2.4+; 12.1 hotfix; 11.2 hotfix; 11.1 hotfix; and 10.2 hotfix, with Cloud NGFW and Prisma Access not affected.
Palo Alto Networks reports very limited exploitation and provides a small set of hunting IP addresses as indicators but cautions that these are not proof of widespread compromise. The article also notes that Threat Prevention customers can use Threat IDs 510046 and 510047 for limited coverage, though this does not substitute for upgrading. Defenders are advised to prioritise upgrading and to assess historical activity around the exposed period.