Palo Alto patches exploited PAN-OS remote code execution flaw
Palo Alto Networks issued patches for a high-severity PAN-OS remote code execution zero-day, CVE-2026-0322, after limited exploitation against firewalls. The flaw affects the management interface and lets authenticated attackers with network access run code as root on PA-Series, VM-Series, Panorama, and M-Series systems. Fixes cover multiple PAN-OS branches, no workaround exists, and CISA added the CVE to its known exploited vulnerabilities list.
Palo Alto Networks traced CVE-2026-0322 to its PAN-OS management interface. Exploitation requires valid credentials plus network reachability, and successful attacks can run commands with root privileges. PA-Series, VM-Series, Panorama virtual appliances, and M-Series hardware are listed as affected; Cloud NGFW and Prisma Access are not.
Fixes exist for PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2, with 11.2.16 due October 15. Unsupported releases need upgrading. No workaround is available, though Threat Prevention signatures offer limited detection. CISA added the CVE to its exploited-vulnerability catalog, setting an October 17 federal mitigation deadline.
Organizations using affected PAN-OS firewalls could face elevated risk if management interfaces are reachable and credentials are compromised. Because successful exploitation may yield root access, attackers could potentially disrupt security controls, reach internal systems, or expose sensitive data. Federal civilian agencies may need to act quickly under CISA's deadline, while security teams may prioritize restricting management access, applying fixes, and monitoring for the listed IPs. The broader public could be indirectly affected if compromised network defenses enable downstream intrusions.