IT Daily Roundup: October 15, 2026
1. Cisco Secure Email Gateway: active exploitation without login, patch is out
Cisco warns of active exploitation of CVE-2026-76519 (CVSS 9.8) in Cisco Secure Email Gateway. Through a flaw in attachment processing, an unauthenticated attacker can write any file to the appliance's operating system and execute commands as root. No login required. Affected are physical and virtual appliances where the File Reputation feature (part of AMP) is assigned to a mail policy and Content Scanner Tools is older than 25.3.0.5525.
Patches arrived as part of the September 14 release: AsyncOS 15.5.5-014 and 16.5.0-780. No patch exists for AsyncOS 16.0; migration to a newer branch is required. Check the scanner version with contentscannerstatus and update it via contentscannerupdate. Cisco pushed the fixed scanner automatically to cloud-managed customers. If the system reports "Suspected compromise indicator was found," contact Cisco TAC before upgrading, as the upgrade will erase forensic data. For compromised virtual appliances, Cisco recommends a full rebuild.
Why this matters: The email gateway is the first system to process incoming mail, and the attacker reaches it without any credentials. CVSS 9.8, active exploitation. Check your Content Scanner Tools version today.
2. Palo Alto patches CVE-2026-0322 in PAN-OS, root access from the management interface
Palo Alto Networks published a patch on October 14 for CVE-2026-0322 (CVSS 4.0: 8.6) in PAN-OS. The flaw is a code injection vulnerability in the management interface: an attacker with administrative privileges and network access to that interface can execute code as root. PA-Series hardware firewalls, VM-Series virtual firewalls, and Panorama are affected. Cloud NGFW and Prisma Access are not.
Fixed releases are PAN-OS 12.2.4, 12.1.10-h2, 11.1.16-h3, and 10.2.18-h12; for the 11.2 branch, several hotfix builds apply. Palo Alto describes activity as "very limited exploitation." Three IP addresses tied to the attacks are worth checking in management traffic logs: 66.42.72.14, 208.83.239.114, and 149.248.47.234.
Why this matters: Exploiting this flaw requires administrative access to the device, which limits the attack surface. Still, two things are worth doing: apply the patch, and make sure the management interface is only reachable from trusted internal addresses, not from the internet.
3. Microsoft took down a phishing market that sent a billion messages since January
Microsoft, together with Resecurity, Cloudflare, Oracle, and law enforcement agencies, seized domains belonging to three linked Chinese services: YAM Store, CoGUI, and Iron Man. YAM Store sold stolen Microsoft 365 and Azure accounts from compromised education and nonprofit tenants. CoGUI and Iron Man supplied phishing kits with over 2,300 templates for 130 countries. Since January 2026, the infrastructure sent more than a billion malicious messages targeting over 75,000 organizations. Microsoft disabled over 20,000 accounts and blocked more than 100,000 domains.
These kits work differently from ordinary phishing pages. The operator watches the victim in real time and prompts them for a one-time verification code at exactly the right moment. Standard SMS or TOTP-based MFA does not hold up against that.
← All postsWhy this matters: Taking down the market helps, but copies of the kits will stay in circulation. Review third-party OAuth grants in your Microsoft 365 tenant and Azure Entra ID, and revoke anything you do not recognize. For admin and other sensitive accounts, consider moving to FIDO2 keys or certificate-based authentication.