Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution

CVE-2026-0322 is a high-severity zero-day vulnerability in the management interface of Palo Alto Networks PAN-OS software affecting PA-Series, VM-Series firewalls, and Panorama. It allows remote code execution by an authenticated attacker with network access, granting root privileges on the targeted firewall. The vulnerability requires no special configuration to exploit. Palo Alto Networks discovered the flaw internally and has released patches and IoCs. Limited exploitation has been observed in the wild. CISA included this vulnerability in its Known Exploited Vulnerabilities catalog with a directive for federal agencies to remediate by October 17, 2026.

Successful exploitation of CVE-2026-0322 enables an authenticated attacker with network access to the PAN-OS management interface to execute arbitrary code with root privileges on the firewall. This could lead to full compromise of the affected firewall device, potentially impacting network security controls and visibility. Limited exploitation has been observed, indicating active threat but not widespread attacks at this time.

Palo Alto Networks has released official patches addressing CVE-2026-0322. Customers should apply these patches immediately to remediate the vulnerability. Indicators of compromise (IoCs) have been published to assist in detection of related malicious activity. No special configuration changes are required to mitigate the vulnerability beyond patching. CISA recommends federal agencies remediate this vulnerability by October 17, 2026.