Businesses running Cisco Secure Email Gateway, the box that filters incoming company mail, should update it today. Cisco said Wednesday that attackers are already exploiting a critical flaw (CVE-2026-76519) in on-premises and virtual gateways, and that a malicious email passing through an affected gateway can give an attacker full control of it, with no login needed. Only gateways with the File Reputation feature turned on and assigned to a mail policy, and running Content Scanner Tools older than 25.3.0.5525, are affected. There’s no workaround. CISA added the flaw to its exploited list Wednesday and gave federal agencies until Saturday, Oct 17. Cisco’s cloud-hosted Secure Email Cloud Gateway needs no customer action, because Cisco already deployed the fix, per Beazley Security.

IT managers: check your Content Scanner Tools version and update to 25.3.0.5525 or later, or move to AsyncOS 15.5.5-014 or 16.5.0-780; gateways on 16.0 must migrate to a fixed release. Confirm whether File Reputation is enabled under Mail Policies > Advanced Malware Protection. Then check the box for tampering: per BleepingComputer, Cisco advises reviewing firewall and network logs for unusual traffic to or from the gateway, because attackers may remove evidence on the box itself. If anything looks off, rotate credentials and certificates on the gateway and call Cisco TAC. If you also run Secure Email and Web Manager, the Canadian Centre for Cyber Security lists fixed releases 15.5.5-006 and 16.5.0-429. Cloud Gateway customers should watch for a Cisco notice.

Palo Alto Networks firewall owners: update PAN-OS and make sure the management interface isn’t reachable from the internet. Palo Alto said Wednesday it has seen “very limited exploitation” of a flaw (CVE-2026-0322) targeting the firewall management interface. It requires an attacker who already has or steals admin logins and can reach that interface, but it can then hand over full control of the firewall. PA-Series, VM-Series and Panorama are affected; Cloud NGFW and Prisma Access are not. Fixed builds include 12.2.4, 12.1.10-h2, 11.2.13-h3, 11.1.16-h3 and 10.2.18-h12; see Palo Alto’s advisory for your branch. Palo Alto lists the 11.2.16 build as due today, so check the advisory before planning around it. Today, limit management access to a jump box or trusted internal IPs, review admin accounts, and rotate admin passwords if management was ever exposed. CISA added this one Wednesday too, also due Oct 17. BleepingComputer has more coverage.

Nothing to do at home: both of these are business equipment. As always, be wary of unexpected work emails asking you to log in or open files.