Attackers exploit Palo Alto PAN-OS flaw for root access as CISA orders three-day fix

Attackers are exploiting a newly disclosed flaw in Palo Alto Networks’ PAN-OS firewall software to run code with root privileges, and US federal agencies have been ordered to fix it and check for compromise by October 17.

Palo Alto Networks disclosed the vulnerability, tracked as CVE-2026-0322, in a security advisory published October 14. The flaw “enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall,” the advisory said.

“Very limited exploitation has been observed targeting the Palo Alto Networks management interface,” the company said. It rated the flaw 8.6 on the CVSS 4.0 scale, which is high severity, and assigned it its highest urgency rating. The company classified it as CWE-94, a code injection weakness.

The US Cybersecurity and Infrastructure Security Agency added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog the same day, citing evidence of active exploitation.

Forensic triage required

The catalog entry marks the flaw as requiring forensic triage under Binding Operational Directive 26-04. The directive “establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied,” CISA said in its alert announcing the addition.

The entry directs agencies to apply the vendor’s mitigations or discontinue use of the product if mitigations are unavailable. It lists the flaw’s use in ransomware campaigns as unknown.

Yih Khai Wong, senior research manager for security services at IDC Asia/Pacific, said security teams should trace who can reach the management interface from outside a trusted network and review admin login history for unusual activity. “They should also check firewall configurations for unexpected changes, since a compromised device can be quietly reconfigured to remain compromised,” he said.

“Patching is only part of the response,” said Vibhum Dubey, a cybersecurity researcher and red teamer. He said teams should check Panorama and every managed firewall and preserve evidence before making changes.

Affected products and fixes

The vulnerability affects PAN-OS on PA-Series and VM-Series firewalls and on Panorama, in both virtual and M-Series form, according to the advisory. Cloud NGFW and Prisma Access are not affected.

“No special configuration is required to be affected by this issue,” the advisory said.

Palo Alto Networks has released fixed versions for PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2, with hotfix releases listed for each maintenance line. The advisory gave an estimated release date of Oct. 15 for PAN-OS 11.2.16, the upgrade path for customers on 11.2.14 and 11.2.15. Customers on unsupported versions should move to a supported fixed release, the company advisory said.

Wong said management access to any device still awaiting a fix should be locked down, or compensating controls should be applied on the device.

How attackers get in

The advisory does not say how attackers obtained that access, when exploitation began, or how many customers were affected.

“The entry point probably isn’t the bug itself, but weak management-access hygiene,” Wong said. He cited admin credentials stolen through phishing or reuse, management interfaces left reachable from the internet, or an earlier compromise that gave an attacker valid logins.

“Once they can execute code as root on a firewall, they have control over a device that enforces security across the network,” Dubey said.

Palo Alto Networks said the flaw was discovered internally.

No workarounds yet

“No known workarounds exist for this issue,” the advisory said.

Customers with a Threat Prevention subscription can enable Threat IDs 510046 and 510047, which the company said provide limited coverage and require SSL decryption. “Variations may exist that cannot currently be detected,” the advisory’s FAQ said.

The company said risk “is highest when you allow access to the management interface from external IP addresses on the internet” and recommended restricting access to trusted internal IP addresses.

Wong said the narrow gap is a warning because a jump box only limits or slows access and does not reduce the damage from an intruder holding valid credentials. “The real risks are credential security and detecting misuse after login, not simply restricting the front door,” he said.

Wong said enterprises should ask vendors why management interfaces keep emerging as the weak point instead of being locked down by default, how they detect misuse of valid admin credentials, and how quickly patches reach every supported version. “Until every affected release is covered, production systems remain exposed,” he said.

“If an attacker gains control of a firewall, organizations need a clear way to determine whether the device can still be trusted,” Dubey said. Palo Alto Networks did not immediately respond to a request for comment.