Hackers Exploit Palo Alto PAN-OS 0-day Flaw to Gain Root Code Execution on Firewalls

Hackers are exploiting a high-severity flaw in Palo Alto Networks PAN-OS that allows authenticated attackers to run code with root privileges on affected firewalls. Tracked as CVE-2026-0322, the vulnerability affects the management interface, with the company confirming “very limited exploitation” and urging customers to apply fixes as soon as possible.

Palo Alto Networks published its security advisory on October 14, 2026, assigning the flaw a CVSS 4.0 score of 8.6 and its highest remediation urgency. The company credited internal researcher Suraj Siddharudh with discovering and reporting the issue. It has not named the attackers or disclosed how many organizations were targeted.

PAN-OS 0-Day Vulnerability

The flaw is a code injection weakness, classified as CWE-94. An attacker must have authenticated access with high privileges and network access to the management interface. Successful exploitation allows code execution as root, giving the attacker the highest level of control over the affected firewall. No user interaction is required.

This is not an unauthenticated attack path. The requirement for an existing privileged login limits who can exploit it, but internet-facing management interfaces carry the greatest risk. No special configuration is needed for a vulnerable PAN-OS installation to be affected.

Affected products include PA-Series hardware firewalls, VM-Series virtual firewalls, and Panorama deployments running on virtual systems or M-Series appliances. Cloud NGFW and Prisma Access are not affected and require no action for this vulnerability

The management interface has featured in earlier PAN-OS attacks. Cyber Security News previously covered active exploitation of CVE-2025-0108 and attackers chaining PAN-OS vulnerabilities to compromise devices. Those reports concern separate flaws and do not establish a connection to the current activity.

Fixed Versions and Protection Measures

Fixed releases include PAN-OS 12.2.4, 12.1.10-h2, 11.1.16-h3, and 10.2.18-h12, with additional hotfix options for earlier maintenance releases. PAN-OS 11.2 fixes include 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, and 11.2.13-h3. Version 11.2.16 was listed with an expected release date of October 15. Administrators should follow the advisory’s upgrade path for their installed version.

Palo Alto Networks says no known workaround exists. Restricting management access to trusted internal IP addresses, ideally through a dedicated jump box, reduces exposure but does not replace patching. Its management access guidance warns against exposing administrative interfaces to the internet or other untrusted networks.

Palo Alto identified 66[.]42[.]72[.]14, 208[.]83[.]239[.]114, and 149[.]248[.]47[.]234 as addresses linked to threat activity and limited exploit attempts.

Security teams can use these indicators when reviewing management traffic, while prioritizing upgrades and tighter access controls. The advisory warns that attack variations may evade current signatures, making a supported fixed release the recommended protection for affected systems.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.