Science & Tech · Cybersecurity · 1 hr ago
Palo Alto Networks patches exploited PAN-OS flaw that allows remote code execution
Palo Alto Networks has patched a high-severity PAN-OS flaw after observing limited exploitation in attacks.
The vulnerability affects the management interface on PA-Series and VM-Series firewalls and Panorama products.
Attackers need valid credentials and network access to use it, but can then run code with root privileges on affected devices.
PAN-OS is the software that runs Palo Alto Networks firewalls, and the flaw has no known workaround.
The company recommends restricting access to the management interface to trusted internal networks and installing a fixed software version.
CISA added the flaw to its exploited-vulnerabilities list, requiring US federal civilian agencies to address it by October 17.
Palo Alto Networks has not identified who is behind the attacks or shared details about whether firewalls were compromised or used to reach internal networks.
Palo Alto Networks released security updates for a high-severity PAN-OS vulnerability exploited in attacks targeting firewalls.
Tracked as CVE-2026-0322, the flaw allows an authenticated attacker with network access to the management interface to execute code with root privileges.
The company said it had observed very limited exploitation and shared IP addresses linked to the activity.
The vulnerability affects PA-Series and VM-Series firewalls and Panorama; Palo Alto Networks said Cloud NGFW and Prisma Access are not affected.
CISA added the flaw to its Known Exploited Vulnerabilities catalog and set an October 17 mitigation deadline for federal agencies.
- Who
- Palo Alto Networks disclosed the flaw and released updates. Attackers exploiting it have not been identified.
- What
- CVE-2026-0322 is a high-severity PAN-OS flaw that allows remote code execution with root privileges.
- When
- Palo Alto Networks disclosed the vulnerability on Wednesday, October 14, 2026. CISA set an October 17 mitigation deadline for federal agencies.
- Where
- The flaw affects the PAN-OS management interface on PA-Series and VM-Series firewalls and Panorama.
- Why
- The vulnerability allows authenticated attackers with network access to execute code as root. The sources do not state the attackers’ motive.
This story does not have two clearly opposing sides.
Palo Alto Networks disclosed the flaw and said it had observed limited exploitation.
CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog.
A fix for PAN-OS 11.2.16 was expected to be released.
Federal civilian agencies must mitigate the vulnerability.
- Vulnerability
- CVE-2026-0322
- Severity score
- 8.6
- Affected products
- PA-Series and VM-Series firewalls; Panorama virtual and M-Series appliances
- Exploitation
- Three IP addresses were shared: 66.42.72[.]14, 208.83.239[.]114, and 149.248.47[.]234
- Deadline
- October 17 for federal civilian agencies to mitigate the flaw
3 sources
What people are saying
Very limited exploitation has been observed targeting the Palo Alto Networks management interface
Limited coverage in Threat Prevention means that while known attack patterns can be identified using the current Threat ID, variations may exist that cannot currently be detected