Palo Alto Networks Fixes Exploited PAN-OS RCE Zero-Day
Palo Alto Networks has released security updates for a high-severity PAN-OS remote code execution vulnerability, tracked as CVE-2026-0322, after confirming that the flaw was exploited in limited attacks targeting firewalls.
The vulnerability affects the PAN-OS management interface and allows an authenticated attacker with network access to execute code as root on a vulnerable device.
Limited exploitation observed
In a security advisory published Wednesday, Palo Alto Networks confirmed limited exploitation of the vulnerability.
“Very limited exploitation targeting Palo Alto Networks management interfaces has been observed,” the company said.
CVE-2026-0322 has a severity score of 8.6 and affects PA-Series and VM-Series firewalls, as well as Panorama virtual appliances and M-Series appliances. Palo Alto Networks says Cloud NGFW and Prisma Access are not affected.
Who is affected by CVE-2026-0322?
Exploitation requires existing credentials and network access to the PAN-OS management interface. Palo Alto Networks recommends restricting management interface access to trusted internal IP addresses only.
The company has released fixes for affected versions of PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2. A fix for PAN-OS 11.2.16 is scheduled for release on October 15.
Customers running older, unsupported PAN-OS versions should upgrade to a supported release.
No known workaround available
Palo Alto Networks says there are no known workarounds for CVE-2026-0322. However, customers with a Threat Prevention subscription can enable signatures that offer limited protection against known attack patterns.
“The limited scope of threat protection means that while known attack patterns can be identified using current threat IDs, variations may exist that are currently undetectable,” Palo Alto Networks warned.
“If the configuration required for this CVE and exposure impacts your environment, we recommend that you upgrade to a non-affected version.”
Exploitation indicators and CISA warning
Palo Alto Networks discovered the vulnerability internally. The discovery was credited to Suraj Siddharudh, a senior principal product security researcher at the company.
The company also shared the following IP addresses associated with exploitation of the flaw:
66.42.72[.]14208.83.239[.]114149.248.47[.]234
BleepingComputer contacted Palo Alto Networks to ask when the exploitation began, who was behind the attacks, and whether the attackers compromised firewalls or used them to access internal networks.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-0322 to its Known Exploited Vulnerabilities Catalog. Federal civilian agencies are required to mitigate the vulnerability by October 17.
Join Mikko Hypponen and security leaders from the NFL, Chanel, and Atlassian for a 2-hour digital summit about what will change with AI speed attacks, what defenders should stop doing, and how to verify, decide, correct, and revalidate at machine speed.
Source: www.bleepingcomputer.com