Today’s Field Note

Two internet-facing appliances, two zero-days, one bad Wednesday. Palo Alto Networks confirmed limited exploitation of CVE-2026-0322 (CVSS 8.6), an RCE in the PAN-OS management interface, and has published IoCs. In parallel, Cisco warns that attackers are hitting its Secure Email Gateway with an unauthenticated flaw that writes files to the OS and runs commands as root, no login required, just a crafted attachment through the mail pipe. These are the devices sitting at your perimeter deciding what gets in, which is exactly why they get hit first and why “patch next cycle” is the wrong answer. If your firewall management plane or your SEG is reachable, assume someone is already knocking.

Today’s Action

  • Patch PAN-OS for CVE-2026-0322 now; until then, restrict the management interface to a jump host or internal-only and pull it off the internet entirely.
  • Apply Cisco’s Secure Email Gateway fix immediately and hunt for unexpected files, cron jobs, or processes running as root on the appliance.
  • Run Palo Alto’s published IoCs against firewall logs and check for anomalous admin sessions or config changes on the management plane.
  • On the SEG, inspect recent inbound mail with crafted attachments and review web/app logs for write activity preceding the patch.
  • Confirm no management or admin interfaces (PAN-OS, Cisco SEG, or otherwise) are exposed externally; close what is.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

Your perimeter box is someone else’s entry point. Patch like you believe that.

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.