An administrator waiting for a vendor fix and an administrator waiting to install one have different reasons for remaining exposed. Cisco has released software updates for an actively exploited Secure Email Gateway vulnerability. It says no workaround addresses the flaw. The wait now belongs to the installation schedule.

That changes the decision attached to tonight’s maintenance window. Leaving the gateway running until a more convenient slot means continuing with a vulnerability under active exploitation and no vendor workaround to cover the interval. The update is available. The exposure continues until it is installed.

In September, this paper reported exploitation of a Cisco email gateway flaw without a patch timeline. The current report supplies an update and an explicit limit on alternatives. It does not establish that the two reports concern the same vulnerability.

There is another maintenance demand alongside it: Palo Alto Networks has released updates for CVE-2026-0322, a PAN-OS flaw that allows remote code execution and has been exploited against firewalls. For an administrator responsible for both products, both updates address exploitation already happening.

Installing the gateway update addresses the vulnerability. Establishing whether someone used it beforehand requires examining evidence of earlier access. A completed maintenance ticket records when the fix went in; the incident review still has to account for what happened before it.