CISA sets October 17 deadline for exploited PAN-OS root RCE as Qilin and Settra keep hitting GlobalProtect bypass

Federal agencies must patch the exploited PAN-OS root RCE CVE-2026-0322 by October 17 alongside Cisco and Ahsay flaws, while Qilin and Settra ransomware groups continue exploiting the GlobalProtect authentication bypass CVE-2026-0257.

Palo Alto Networks disclosed CVE-2026-0322 on 14 October 2026, an authenticated code-injection flaw (CWE-94) in the PAN-OS management interface that lets an attacker with network access run arbitrary code as root. Most outlets score it CVSS 8.6, with CSO Online and GBHackers specifying CVSS 4.0 (GBHackers: 8.6 when the interface is network-reachable, 8.5 from an adjacent network), and SecurityWeek labels it a zero-day. It affects PA-Series and VM-Series firewalls and Panorama on PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2, requires no special configuration, and has no workaround; Cloud NGFW and Prisma Access are unaffected, and Cyber Security News alone adds M-Series appliances to the affected list. All sources agree exploitation has been very limited, with Palo Alto linking attempts to 66.42.72.14, 208.83.239.114, and 149.248.47.234 (U.S. addresses per The Hacker News) and naming no actor; Threat IDs 510046 and 510047 give only limited coverage and require decryption and data-plane routing, so customers should patch, block internet access to management, rotate administrator credentials, and review logs. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 14 October under BOD 26-04 and ordered federal civilian agencies to mitigate it and check for compromise by 17 October 2026, in the same batch as Cisco Secure Email Gateway CVE-2026-76519 (CVSS 9.8 relative path traversal in the AMP file-reputation feature, exploited via crafted attachments to write arbitrary files and, per Help Net Security, run root commands) and AhsayCBS CVE-2026-105133 and CVE-2026-105134, which Security Affairs says were chained from 7 October for authentication bypass and unauthenticated command injection, deploying JSP webshells and XMRig miners against at least five organizations by 8 October, with Help Net Security noting earlier Ahsay patches were incomplete and describing SYSTEM-level command injection. Separately, ReliaQuest says Qilin, Settra, and initial access brokers continue exploiting CVE-2026-0257, a CVSS 7.8 GlobalProtect and Prisma Access authentication bypass disclosed 13 May 2026 that is exposed only when authentication-override cookies and a specific certificate configuration are enabled, affecting PAN-OS 12.1, 11.2, 11.1, and 10.2 plus Prisma Access 11.2 and 10.2 (Panorama and Cloud NGFW unaffected). Follow-on activity includes Cobalt Strike, BloodHound, SharpHound, credential theft, and ransomware preparation, with traffic that can resemble normal…