Palo Alto Networks has released security updates for a high-severity zero-day in PAN-OS that is already being exploited in attacks on firewalls. The flaw, tracked as CVE-2026-0322, carries a severity score of 8.6 and sits in the PAN-OS management interface. An attacker who already has credentials and network access to the interface can execute code as root on the device.
The company confirmed in its advisory on Wednesday that it has seen limited exploitation of the flaw. Admins running PA-Series or VM-Series firewalls should treat this as an emergency patch, since a rooted firewall gives an attacker full control of network traffic.
Which Devices Are Affected
CVE-2026-0322 affects PA-Series firewalls, VM-Series firewalls, and Panorama virtual and M-Series appliances. Cloud NGFW and Prisma Access are not affected. Exploitation needs two things: valid credentials for the management interface and network reachability to it. That second requirement is the one admins can cut off immediately.
Palo Alto Networks has shipped fixes for PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2, with a fix for PAN-OS 11.2.16 expected on October 15. Customers on older unsupported versions must upgrade to a supported release. The company says there are no known workarounds.
Customers with a Threat Prevention subscription can enable signatures that give limited protection against known attack patterns. Palo Alto warns that variations of the exploit may exist that the current Threat ID cannot detect, so upgrading is the only complete fix. The vulnerability was discovered internally by Suraj Siddharudh, a senior principal product security researcher at the company.
Attacker IPs and CISA Deadline
Palo Alto Networks shared three IP addresses seen exploiting the flaw: 66.42.72[.]14, 208.83.239[.]114 and 149.248.47[.]234. Security teams should check firewall logs for any management interface access from these addresses.
The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog. Federal civilian agencies must mitigate the vulnerability by October 17. The practical step for every admin is the same: restrict management interface access to trusted internal IP addresses only, then patch.
FAQ
What is CVE-2026-0322?
It is a high-severity remote code execution flaw in the PAN-OS management interface with a CVSS score of 8.6. Attackers with valid credentials and network access can run code as root on affected firewalls.
Which Palo Alto products are affected by CVE-2026-0322?
PA-Series firewalls, VM-Series firewalls and Panorama virtual and M-Series appliances are affected. Cloud NGFW and Prisma Access are not affected.
How do I protect my firewall from CVE-2026-0322?
Install the fixed PAN-OS version for your release, restrict management interface access to trusted internal IP addresses, and review logs for the three attacker IPs shared by Palo Alto Networks.
Is CVE-2026-0322 in the CISA KEV catalog?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog and requires federal civilian agencies to mitigate it by October 17.
