Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks
Palo Alto says attackers are exploiting PAN-OS RCE CVE-2026-0322, which CISA added to KEV.
Palo Alto Networks patched CVE-2026-0322, a high-severity PAN-OS remote code execution flaw in the management interface that lets authenticated attackers with network access run code as root. The company said exploitation has been very limited and listed source IPs 66.42.72.14, 208.83.239.114, and 149.248.47.234. Affected products include PA-Series and VM-Series firewalls and Panorama appliances on PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2; Cloud NGFW and Prisma Access are not affected. CISA added the CVE to the Known Exploited Vulnerabilities catalog and ordered federal civilian agencies to mitigate it by October 17.
- CVE-2026-0322 is an authenticated PAN-OS management RCE scored 8.6.
- Palo Alto observed very limited exploitation and published three attacker IPs.
- Fixes cover PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2.
- CISA added the flaw to KEV with a federal deadline of October 17.
- Cloud NGFW and Prisma Access are not affected.
Vulnerabilities mentionedAll →
- CVE-2026-03228.61%Authenticated root RCE in Palo Alto PAN-OS managementpublished · Palo Alto Networks PAN-OS on PA-Series firewalls KEV
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-0322 | Authenticated root RCE in Palo Alto PAN-OS management CVE-2026-0322 is a code-injection flaw (CWE-94) in the management interface of Palo Alto Networks PAN-OS that allows remote code execution. An authenticated attacker who can reach the management interface over the network can run arbitrary code with root privileges on the device. It affects PAN-OS on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series); Cloud NGFW and Prisma Access are not affected. Palo Alto notes that risk is reduced when management access is limited to trusted internal addresses, consistent with its deployment guidance. CISA added the issue to the Known Exploited Vulnerabilities catalog on 2026-10-14, and reporting describes active exploitation including as a zero-day; ransomware use is listed as unknown and no public proof-of-concept is known. CVSS 4.0 is 8.6 (high), with high privileges required but low attack complexity and full impact on the vulnerable system. |
Full article400 words · extracted from bleepingcomputer.com · click to collapse
Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls.
The vulnerability affects the PAN-OS management interface and lets authenticated attackers with network access execute code as root on vulnerable devices.
Palo Alto Networks confirmed in a security advisory published Wednesday that it has seen limited exploitation of the flaw in attacks.
"Very limited exploitation has been observed targeting the Palo Alto Networks management interface," the company said.
The vulnerability has a severity score of 8.6 and affects PA-Series and VM-Series firewalls, as well as Panorama virtual and M-Series appliances. Palo Alto says Cloud NGFW and Prisma Access are not affected.
To exploit the vulnerability, attackers need existing credentials and network access to the PAN-OS management interface.
Therefore, Palo Alto Networks recommends restricting access to the management interface to trusted internal IP addresses only.
The company has released fixes for affected PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 versions, with a fix for PAN-OS 11.2.16 expected on October 15.
Customers running older, unsupported versions must upgrade to a supported release.
Palo Alto says there are no known workarounds for the vulnerability, but customers with Threat Prevention subscriptions can enable signatures that provide limited protection against known attack patterns.
"Limited coverage in Threat Prevention means that while known attack patterns can be identified using the current Threat ID, variations may exist that cannot currently be detected," warns Palo Alto.
"If this CVE and Required Configuration for Exposure impact your environment, we recommend upgrading to an unaffected version."
The vulnerability was discovered internally by Suraj Siddharudh, a senior principal product security researcher at Palo Alto Networks.
The company also shared three IP addresses that have been exploiting the flaw: 66.42.72[.]14, 208.83.239[.]114, and 149.248.47[.]234.
BleepingComputer contacted Palo Alto Networks to learn when exploitation began, who is behind the attacks, and whether attackers compromised firewalls or used them to access internal networks.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has now added CVE-2026-0322 to the Known Exploited Vulnerabilities catalog and requires federal civilian agencies to mitigate the vulnerability by October 17.
Build your security blueprint for AI-powered attacks
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.