Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks

CVE-2026-0322 is a remote code execution zero-day vulnerability affecting the PAN-OS management interface on PA-Series, VM-Series firewalls, Panorama virtual, and M-Series appliances. Authenticated attackers with network access can execute arbitrary code as root. Palo Alto Networks confirmed limited exploitation in attacks and released security updates for PAN-OS versions 10.2, 11.1, 11.2, 12.1, and 12.2, with an additional fix for 11.2.16 pending. Cloud NGFW and Prisma Access are not affected. The vulnerability requires existing credentials and network access, and no full workaround exists. Threat Prevention signatures provide limited protection against known attack patterns. The U.S. CISA has added this CVE to its Known Exploited Vulnerabilities catalog, mandating mitigation by October 17, 2026.

Successful exploitation allows authenticated attackers with network access to the PAN-OS management interface to execute arbitrary code with root privileges on affected devices. This can lead to full compromise of firewall devices, potentially impacting network security and control. Limited exploitation has been observed in the wild, indicating active threat. The vulnerability affects multiple PAN-OS versions and device types, increasing the potential attack surface.

Palo Alto Networks has released official security updates for affected PAN-OS versions 10.2, 11.1, 11.2, 12.1, and 12.2. Customers should apply these updates promptly. A fix for PAN-OS 11.2.16 is expected imminently. Access to the PAN-OS management interface should be restricted to trusted internal IP addresses only. There are no known full workarounds. Enabling Threat Prevention signatures can provide limited detection of known attack patterns but does not guarantee full protection. Customers running unsupported versions must upgrade to supported releases. Follow the vendor advisory for the latest remediation guidance.