Palo Alto Networks Fixes Actively Exploited PAN-OS Vulnerability
The CVE-2026-0322 vulnerability allows an authenticated attacker to execute code with root privileges on affected Palo Alto Networks firewalls.
CVE-2026-0322 is a remote code execution vulnerability in the PAN-OS system management interface for which the vendor has released fixes. Palo Alto Networks also reports very limited observed exploitation targeting the management interface. The U.S. agency CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, which tracks vulnerabilities exploited in real-world attacks.
An attacker needs valid authentication and network access to the management interface. If successfully exploited, the vulnerability can allow code execution with root privileges directly on the firewall. This is therefore not confirmed unauthenticated takeover of an internet-accessible device.
CVE-2026-0322 Affects Firewalls and Panorama
According to the security advisory, the issue affects PA-Series devices, VM-Series virtual firewalls, and the Panorama platform. Cloud NGFW and Prisma Access are not affected, according to Palo Alto Networks.
Root privileges on a security device give an attacker extensive options for interference. They could use them, for example, to change the firewall configuration or weaken the network’s protective mechanisms. The vendor therefore recommends promptly updating affected PAN-OS branches to fixed releases.
In an advisory published on October 14, Palo Alto Networks stated that PAN-OS version 11.2.16 would be available on October 15, 2026. The current availability of this version should be verified directly in the release notes and the current version of the advisory.
Restricting Access Is Not a Substitute for a Fix
No full workaround is known for CVE-2026-0322. Restricting access to the management interface to trusted internal IP addresses only may reduce the risk. However, this measure does not replace deploying the security update.
According to the vendor, Threat Prevention provides only limited detection and only when specific conditions are met. Organizations should therefore first determine whether they operate affected products and PAN-OS versions, assess the exposure of their management interfaces, and plan a prioritized upgrade.
CISA Confirms Documented Exploitation
The addition of CVE-2026-0322 to the CISA KEV catalog confirms that the vulnerability was documented as being exploited in real-world attacks. However, the record itself does not state the scope of the attacks or confirm the success of individual compromise attempts.
It has not been publicly confirmed who is carrying out the attacks, how many devices were targeted, or whether the incidents led to the compromise of internal networks. Further updates may provide technical information about the campaign, indicators of compromise, or changes to the list of fixed versions.
Sources
- Palo Alto Networks Security Advisory – CVE-2026-0322 – Confirms the nature of the flaw, the authentication and network-access requirements, root privileges, affected products, limited exploitation, fixes, and mitigations.
- CISA Known Exploited Vulnerabilities Catalog – Confirms the addition of CVE-2026-0322 to the catalog of actively exploited vulnerabilities and the recommendation to follow the vendor’s guidance.
- BleepingComputer – Independently summarizes the disclosure of the flaw, the availability of fixes, and its addition to the CISA KEV catalog.
Verified and updated: October 15, 2026 06:20
