Two actively exploited zero-days in network security infrastructure landed on the same morning - one in PAN-OS management interfaces, one in Cisco’s email gateway that requires nothing more than sending a crafted email. Meanwhile, Unit 42 published research on PEERSTITCH, a memory-resident implant found on over 500 FortiGate firewalls that persists through the management platform itself. Three stories, three different attack surfaces, one common thread: the security infrastructure is the target.

In the News

PAN-OS Zero-Day CVE-2026-0322 - Authenticated RCE in the Management Interface

Palo Alto Networks confirmed active exploitation of CVE-2026-0322, an authenticated remote code execution vulnerability in the PAN-OS management interface rated CVSS 8.6. An attacker with valid management credentials can execute arbitrary code on the firewall.

The exploitation is described as limited, but the operational reality is straightforward: any environment where firewall management interfaces are reachable from user networks or the internet, and where admin credentials have been stolen through phishing or credential stuffing, is exposed. Emergency patches are available across affected PAN-OS branches.

The primary mitigation is not just the patch - it is management-plane architecture. Firewall management interfaces should be on dedicated out-of-band networks, accessible only from jump hosts with phishing-resistant MFA enforced. The vulnerability is authenticated, which means credential theft is the enabler. Organizations running PAN-OS should also audit admin accounts for stale or shared credentials and verify that TACACS+/RADIUS authentication is enforced rather than local accounts.

What defenders should do: Apply emergency PAN-OS patches immediately. Restrict management interface access to out-of-band management networks. Enforce phishing-resistant MFA on all administrative accounts. Audit admin account inventory for shared or stale credentials.

Cisco Secure Email Gateway Zero-Day - Unauthenticated RCE via Crafted Attachment

Cisco confirmed active exploitation of a critical vulnerability in its Secure Email Gateway. The flaw allows an unauthenticated attacker to write arbitrary files and execute commands as root by sending a crafted email attachment through the gateway. No login, no user interaction, no credentials - the malicious email simply needs to transit the appliance.

This is a particularly dangerous vulnerability class because the affected device sits inline in the mail flow. The appliance that is supposed to inspect and protect email becomes the entry point. Attackers who achieve root-level code execution on the email gateway gain access to all mail transiting the appliance and a pivot point into the internal network.

Cisco has released patches. Organizations running on-premises Cisco Secure Email Gateway appliances should prioritize this patch above routine maintenance. Cloud-native email security layers that provide sandboxing and advanced threat analysis independent of the gateway appliance add defense-in-depth - but they do not substitute for patching the gateway itself.

What defenders should do: Patch Cisco Secure Email Gateway immediately. Review email gateway logs for anomalous file writes or process execution. Ensure email security architecture includes cloud-native sandboxing as a complementary layer. Segment email infrastructure from internal production networks.

PEERSTITCH - Memory-Resident FortiGate Implant Deployed via FortiManager

Palo Alto Unit 42 published detailed research on PEERSTITCH, a stealthy ARM64 implant discovered on over 500 FortiGate firewalls. The attackers exploited CVE-2024-47575, a previously disclosed vulnerability in FortiManager, to push the implant across managed firewall fleets.

PEERSTITCH operates entirely in memory and re-deploys itself through FortiManager’s legitimate device synchronization channel. This means it survives firewall reboots by leveraging the management platform as its persistence mechanism - the same system administrators use to push configuration and firmware updates. Traditional endpoint detection tools do not see it because it never touches disk in a way that triggers file-based scanning, and its command-and-control traffic blends with normal FortiManager-to-FortiGate communication.

This represents a significant evolution in network infrastructure persistence. The implant does not just compromise individual firewalls - it compromises the trust relationship between the management platform and the devices it controls. Organizations using centralized firewall management platforms of any vendor should evaluate whether they have visibility into management-plane traffic anomalies, firmware integrity validation, and the ability to detect unauthorized configuration pushes.

What defenders should do: Verify FortiManager is patched against CVE-2024-47575. Validate firmware integrity on managed FortiGate appliances. Monitor management-plane traffic for anomalous sync patterns. Consider network detection and response capabilities that inspect east-west management traffic. MITRE ATT&CK: T1542 (Pre-OS Boot), T1071.001 (Application Layer Protocol: Web Protocols).

Today’s Deep Dive - AI Infrastructure as Attack Surface: Langflow CVE-2026-105740

The Langflow exploitation story deserves a closer look because it represents a pattern that will only accelerate: AI development platforms inheriting traditional vulnerability classes while being deployed with minimal security controls.

CVE-2026-105740 is a CVSS 9.9 authenticated remote code execution flaw in Langflow, an open-source platform widely used for building AI agent workflows. Researchers observed 1,423 exploit attempts in honeypots, confirming active exploitation. The “authenticated” qualifier sounds like a meaningful barrier - but Langflow instances are frequently deployed with default credentials, API keys committed to repositories, or no network segmentation separating them from the broader environment.

The broader pattern is clear: organizations are deploying AI/ML platforms - Langflow, LangChain, LiteLLM, Ollama - with the same security posture they used for internal dev tools a decade ago. These platforms often run with elevated privileges because they need to interact with multiple data sources, APIs, and infrastructure components. When an RCE vulnerability hits, the blast radius extends well beyond the platform itself.

The immediate action is to patch Langflow. The structural action is to treat AI development infrastructure with the same rigor as any production system: network segmentation, identity governance for service accounts, application security scanning as part of the CI/CD pipeline, and monitoring for authentication anomalies. MITRE ATT&CK: T1190 (Exploit Public-Facing Application), T1078 (Valid Accounts).

Defender Action Items

  • PAN-OS CVE-2026-0322: Apply emergency patches. Move management interfaces to OOB networks. Enforce phishing-resistant MFA on admin accounts. Audit for stale or shared admin credentials.
  • Cisco Secure Email Gateway: Patch immediately. Review logs for anomalous file writes or process execution under root. Segment email infrastructure.
  • FortiManager / PEERSTITCH: Verify CVE-2024-47575 patches. Validate firmware integrity on managed FortiGate devices. Deploy management-plane traffic monitoring.
  • Langflow CVE-2026-105740: Patch. Segment AI dev environments. Rotate service account credentials. Scan for default credentials on AI platforms.
  • Ivanti Connect Secure CVE-2026-104935: Patch per CISA KEV directive. Run Ivanti integrity checker. Review VPN logs from October 1 forward.

Detection Queries

Anomalous process execution on Cisco email gateway appliances - hunt for unexpected child processes spawned by the mail processing service:

index=cisco_email sourcetype="cisco:esa:syslog"
| where match(process_name, "(?i)(sh|bash|python|perl|wget|curl|nc|ncat)")
| where NOT match(parent_process, "(?i)(updater|scheduled_task|cron)")
| stats count by host, process_name, parent_process, user, _time
| where count > 0
| sort -_time

FortiManager sync anomaly detection - identify unexpected configuration pushes or firmware sync events outside maintenance windows:

index=fortimanager sourcetype="fmg:event"
(action="dev_sync" OR action="firmware_push" OR action="config_install")
| eval hour=strftime(_time, "%H")
| where hour < 6 OR hour > 22
| stats count by src_ip, dest_ip, action, device_name, _time
| sort -_time

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) - Daily cybersecurity news, SE angles, and detection queries.