Loading story…
Cisco disclosed a critical vulnerability in Secure Email Gateway appliances running affected AsyncOS versions when inbound mail rules use File Analysis (Cisco AMP) or Content Filter features and the bundled Content Scanner Tools are older than 23.3.0.4823. Successful exploitation can let an attacker overwrite files at the operating-system level, enabling root-level account creation, configuration changes, arbitrary code execution, and denial of service. Cisco released software updates and said no alternative mitigations are available.
Palo Alto Networks also issued fixes for a serious PAN-OS management interface flaw that allows an unauthenticated attacker to execute certain PHP scripts and affect the integrity and confidentiality of the firewall, though the vendor said it does not permit arbitrary remote code execution. Exploitation attempts have already been observed and proof-of-concept code is public, increasing urgency for exposed management interfaces. Palo Alto said Cloud NGFW and Prisma Access are not affected, while PAN-OS 11.0 is out of support and will not receive a patch.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
By the time of disclosure, exploitation attempts against the PAN-OS vulnerability had already been observed and proof-of-concept code had been published. Organizations were urged to update immediately and apply Palo Alto's mitigation guidance.
Palo Alto Networks released security updates for a serious PAN-OS vulnerability affecting firewall management interfaces. The flaw allows an unauthenticated attacker to execute certain PHP scripts and could impact the integrity and confidentiality of PAN-OS; PAN-OS 11.0 is out of support and will not receive a fix.
Cisco released a software update for a critical vulnerability in Cisco Secure Email Gateway affecting vulnerable Cisco AsyncOS deployments with specific email-processing features enabled and outdated Content Scanner Tools. Successful exploitation could allow arbitrary file overwrite, root-level user creation, configuration changes, code execution, or denial of service.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
kyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks disclosed and patched multiple vulnerabilities in **PAN-OS** affecting **PA-Series**, **VM-Series**, and **Panorama**, including `CVE-2026-0273`, an authenticated administrator command injection flaw in the **CLI** and **web management interface** that can allow arbitrary commands to run as **root**. The vendor also fixed `CVE-2026-0272`, an authenticated **CLI privilege escalation** issue, and `CVE-2026-0266`, a **stored XSS** vulnerability in the web interface. A separate issue, `CVE-2026-0269`, can trigger a **denial of service** through crafted tunnel traffic and repeatedly reboot affected firewalls, potentially forcing them into maintenance mode. Affected versions span supported **PAN-OS 12.1, 11.2, 11.1, and 10.2** release trains, while **Cloud NGFW** and **Prisma Access** were reported as unaffected. Palo Alto Networks said it was not aware of active exploitation at disclosure time and urged customers to upgrade promptly, restrict management access to trusted internal IPs, limit CLI exposure, and use hardened jump boxes; for `CVE-2026-0273`, organizations with **Threat Prevention** can also enable dedicated **Threat IDs** to help block exploit attempts when management traffic is inspectable and decrypted.
Jun 29, 2026
Palo Alto Networks disclosed and patched **13 vulnerabilities** across its products, led by **`CVE-2026-0288`**, a high-severity flaw in **PAN-OS** that can let an unauthenticated attacker with network access trigger memory corruption through specially crafted traffic. The bug stems from multiple buffer overflows in the **User-ID Terminal Server Agent (TSA)** component and can lead to **denial of service** and potentially **arbitrary code execution** on affected firewalls. Palo Alto said the issue affects PAN-OS devices only when at least one TSA entry is configured, while **Panorama** and **Cloud NGFW on AWS** are not affected. The company assigned the flaw a **CVSS-B score of 9.2** for exposed deployments and said it has **no evidence of active exploitation**, but urged customers to patch immediately or restrict TSA access to trusted internal IP addresses as a mitigation. The broader advisory batch also addressed medium- and low-severity issues in **PAN-OS** and **Prisma Access Agent**, including vulnerabilities that could enable **root command execution, unauthorized internal requests, authentication bypass, VPN interception via MitM, DLP policy bypass, privilege escalation, XSS-driven code execution, file deletion, and information disclosure**.
Jul 10, 2026
Palo Alto Networks disclosed **CVE-2026-0310**, a high-severity XML-processing buffer overflow in PAN-OS that can allow an unauthenticated remote attacker to execute arbitrary code as `root` on affected PA-Series hardware firewalls. The flaw, scored 9.2 CVSS-B, is reachable through vulnerable management-web or dataplane interfaces using specially crafted XML; exploitation is considered high complexity. On VM-Series appliances, the impact is limited to denial of service, while Prisma Access and Cloud NGFW deployments face more restricted exposure because exploitation requires authentication and their external interfaces are less accessible. Palo Alto Networks released fixed PAN-OS versions and states that no workaround is available; administrators should immediately apply the vendor updates and restrict management access to trusted networks. Canadian and Italian government advisories also identify affected PAN-OS, Prisma Access, and Cloud NGFW on AWS and Azure products, and flag **PAN-SA-2026-0012** for Chromium vulnerabilities affecting Prisma Browser versions before `151.26.5.170`. Palo Alto reported no known exploitation of CVE-2026-0310 in the wild as of September 9, 2026.
Sep 11, 2026