Several vendors have released security updates to address actively exploited vulnerabilities across their products.
Palo Alto Networks has addressed a high-severity PAN-OS zero-day vulnerability (CVE-2026-0322), said to have been exploited in limited attacks. The flaw affects the management interface and allows authenticated attackers with network access to execute code as root. Affected products include PA-Series and VM-Series firewalls, and Panorama appliances. Cloud NGFW and Prisma Access are not affected.
Cisco has warned that threat actors are exploiting CVE-2026-76519, a critical vulnerability in Cisco Secure Email Gateway that allows unauthenticated attackers to write files to the system through a crafted email attachment and potentially execute commands with root privileges.
The vulnerability affects systems with File Reputation enabled and Content Scanner Tools versions older than 25.3.0.5525. Cisco recommends updating Content Scanner Tools to version 25.3.0.5525 or later, or installing the fixed AsyncOS releases.
Singapore-based Ahsay Backup has released security updates for two AhsayCBS vulnerabilities (CVE-2026-105133 and CVE-2026-105134) that attackers have exploited to bypass authentication and execute commands remotely. According to Huntress, attackers chained the flaws to deploy web shells and XMRig cryptocurrency miners. The vendor has warned that previous patches in versions 9.15.2.59 and 10.3.4.0 were incomplete and did not fully fix vulnerabilities.
Japanese vendor EG Secure Solutions has patched an exploited OS command injection issue (CVE-2026-106931) in its host-based web application firewall (WAF) SiteGuard Server Edition that allows a remote user to execute arbitrary shell commands on the target system.
Users are strongly advised to update to patched versions of the products as soon as possible.