Palo Alto Networks has disclosed a serious flaw in PAN-OS, the software that runs its firewalls, and says attackers have already used it in a small number of cases. The flaw, CVE-2026-0322, sits in the firewall’s management interface and “enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall,” the company said in an advisory published on 14 October 2026.
Root privileges mean full control of the device. The attacker must already be logged in to the management interface, however.
“Very limited exploitation has been observed targeting the Palo Alto Networks management interface,” the advisory says.
CISA’s deadline
The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalogue on 14 October. That catalogue lists flaws known to be used in attacks. CISA gave US federal civilian agencies until 17 October to act.
Who is affected
The flaw affects PAN-OS on PA-Series and VM-Series firewalls and on Panorama management appliances. “Cloud NGFW and Prisma® Access are not impacted by this vulnerability,” the advisory says.
Palo Alto rates the flaw 8.6 out of 10 (High) with a suggested urgency of “HIGHEST”. It says the risk is highest when the management interface can be reached from the internet.
What to do
- Update. Fixes are available in PAN-OS 12.2.4 and a list of hotfix releases for older versions. The advisory lists version 11.2.16 as expected on 15 October.
- Lock down the management interface. Palo Alto says the risk is “minimized by restricting access to the management interface to only trusted internal IP addresses”. There are “no known workarounds”.
- Threat signatures help only partly. Customers with a Threat Prevention subscription can enable Threat IDs 510046 and 510047, which the company says give “limited coverage” and require SSL decryption.
What this means
- Firewalls are a prime target. Taking over a firewall can give attackers a foothold in a company’s network.
- Exposure matters most. Firewalls whose management pages face the internet are at highest risk.
- Patch quickly. US agencies have three days, and others should move fast too.
Sources
- Palo Alto Networks, “CVE-2026-0322 PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface”, 14 October 2026. https://security.paloaltonetworks.com/CVE-2026-0322
- CISA, Known Exploited Vulnerabilities Catalog (CVE-2026-0322 added 14 October 2026). https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- NIST National Vulnerability Database, CVE-2026-0322. https://nvd.nist.gov/vuln/detail/CVE-2026-0322
