Good morning. Two new entries hit the CISA Known Exploited Vulnerabilities catalog yesterday, and both carry an unusually short three-day federal remediation deadline of October 17 under CISA's new BOD 26-04 schedule. If you run Cisco or Palo Alto gear, today is the day.
Cisco Secure Email Gateway: one attachment to root (CVE-2026-76519)
Cisco disclosed this zero-day on October 14: a relative path traversal in the Advanced Malware Protection feature that mishandles email attachments. An unauthenticated attacker sends one crafted attachment through an unpatched appliance and gets arbitrary file writes plus root command execution. This is the second SEG zero-day in a month (after CVE-2026-76461 in September), and attackers can wipe on-box evidence, so your firewall and network logs are the real hunt surface.
What to do: run the contentscannerstatus CLI on every appliance. Content Scanner Tools below 25.3.0.5525 with File Reputation enabled on your mail policies means exposed. Hunt for Cisco's self-check alerts ("Suspected compromise indicator was found"), and if Cisco contacted you about a potential compromise, rotate credentials and crypto material.
Palo Alto PAN-OS: root from the management plane (CVE-2026-0322)
A code injection flaw in the PAN-OS management interface lets an authenticated attacker with network access execute arbitrary code as root on the firewall. Palo Alto reports "very limited exploitation" already observed. Affected: PA-Series and VM-Series firewalls and Panorama. Cloud NGFW and Prisma Access are not impacted.
What to do: restrict the management interface to trusted internal IPs per Palo Alto's own deployment guidance, patch now, and enable Threat IDs 510046 and 510047 on Threat Prevention subscriptions for interim coverage (they need SSL decryption). Audit management-plane logs for sessions you cannot explain.
Full entries with huntable indicators of compromise: kevinthecyberguy.com/vuln-watch
Principal Cybersecurity Engineer with 17+ years across banking, payments, and consulting. Writing about AI security, identity, and the fundamentals that stop most incidents. kevintswaney.com