Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution
Palo Alto patched PAN-OS zero-day CVE-2026-0322 after limited exploitation for root remote code execution.
Palo Alto Networks patched CVE-2026-0322, a high-severity PAN-OS zero-day in the management interface that lets an authenticated attacker with network access run arbitrary code as root. It affects PAN-OS on PA-Series and VM-Series firewalls and Panorama, with no special configuration required. The company said very limited exploitation was observed, released related IP indicators, and did not name an actor. CISA added the flaw to the Known Exploited Vulnerabilities catalog and ordered federal agencies to remediate by October 17.
- CVE-2026-0322 allows authenticated remote code execution as root on PAN-OS management interfaces.
- Palo Alto observed very limited exploitation and released indicators of compromise.
- PA-Series, VM-Series firewalls, and Panorama are affected without special configuration.
- CISA added the flaw to KEV and set a federal deadline of October 17.
- The same day Palo Alto published a dozen medium or low advisories.
Vulnerabilities mentionedAll →
- CVE-2026-03228.61%Authenticated root RCE in Palo Alto PAN-OS managementpublished · Palo Alto Networks PAN-OS on PA-Series firewalls KEV
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-0322 | Authenticated root RCE in Palo Alto PAN-OS management CVE-2026-0322 is a code-injection flaw (CWE-94) in the management interface of Palo Alto Networks PAN-OS that allows remote code execution. An authenticated attacker who can reach the management interface over the network can run arbitrary code with root privileges on the device. It affects PAN-OS on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series); Cloud NGFW and Prisma Access are not affected. Palo Alto notes that risk is reduced when management access is limited to trusted internal addresses, consistent with its deployment guidance. CISA added the issue to the Known Exploited Vulnerabilities catalog on 2026-10-14, and reporting describes active exploitation including as a zero-day; ransomware use is listed as unknown and no public proof-of-concept is known. CVSS 4.0 is 8.6 (high), with high privileges required but low attack complexity and full impact on the vulnerable system. |
Full article280 words · extracted from securityweek.com · click to collapse
Palo Alto Networks on Wednesday informed customers that it has released patches for a PAN-OS zero-day vulnerability exploited in malicious attacks.
The high-severity flaw is tracked as CVE-2026-0322 and it allows remote code execution. It affects the management interface of PAN-OS and it can be exploited by an authenticated attacker with network access to execute arbitrary code with root privileges on the targeted firewall.
“Very limited exploitation has been observed targeting the Palo Alto Networks management interface,” Palo Alto Networks noted in its advisory.
The zero-day was discovered internally. It affects PAN-OS software on PA-Series and VM-Series firewalls and on Panorama. The security firm noted that no special configuration is needed to exploit CVE-2026-0322.
The cybersecurity giant has released indicators of compromise (IoCs) associated with the observed activity, specifically a few IP addresses.
No information has been shared on the attacks exploiting this new zero-day or the threat actor responsible.
Advertisement. Scroll to continue reading.
CISA added CVE-2026-0322 to its KEV catalog on Wednesday, instructing federal agencies to address it by October 17.
CISA’s KEV catalog currently includes 16 Palo Alto Networks product vulnerabilities, including three added this year.
On Wednesday, Palo Alto published a dozen other advisories to inform customers about vulnerabilities found and fixed in PAN-OS, GlobalProtect, and Prisma Cloud products, including DoS, command injection, identity hijacking, local privilege escalation, XSS, and path traversal issues. All of these vulnerabilities have been rated medium or low severity.
In addition, the company updated its Prisma Browser to include the latest Chromium updates.
Related: Cisco Warns of Exploited Secure Email Gateway Vulnerability
Related: Palo Alto Networks Patches 13 Vulnerabilities
Related: Splunk, Palo Alto Networks Patch Severe Vulnerabilities