Palo Alto PAN-OS root code execution flaw already exploited (CVE-2026-0322)

Palo Alto Networks published a security advisory on October 14 for the CVE-2026-0322 vulnerability. It affects the management interface of PAN-OS, the operating system of its firewalls. According to the vendor, an authenticated attacker who can reach this interface over the network can run arbitrary code with root privileges. Palo Alto says it has observed "very limited" exploitation. According to BleepingComputer, CISA, the US cybersecurity agency, has added the flaw to its Known Exploited Vulnerabilities (KEV) catalog and requires federal civilian agencies to address it by October 17.

Which devices are affected?

The flaw affects PA-Series physical firewalls, VM-Series virtual firewalls and Panorama consoles, both as virtual appliances and on M-Series hardware. Cloud NGFW and Prisma Access are not affected. The advisory gives a score of 8.6 out of 10 (CVSS 4.0, high severity), and 8.5 if access is restricted to a jump host. The required privileges are high: the attacker needs valid credentials for the management interface. This is a real limitation, but not a guarantee. Stolen, reused or default credentials are enough.

The discovery was internal: it is credited to Suraj Siddharudh, a security researcher at Palo Alto Networks. The vendor did not say how long the flaw has been exploited or who is exploiting it. It also did not say whether attackers have moved laterally into internal networks.

Fixed versions

• PAN-OS 12.2: 12.2.4 and later;
• PAN-OS 12.1: 12.1.4-h12, 12.1.7-h8 or 12.1.10-h2 depending on the branch;
• PAN-OS 11.2: 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, or 11.2.16 (announced for October 15);
• PAN-OS 11.1: from 11.1.4-h37 to 11.1.16-h3 depending on the branch;
• PAN-OS 10.2: from 10.2.7-h38 to 10.2.18-h12 depending on the branch.

Versions that are no longer supported must be upgraded to a supported, patched version. The detailed table is in the vendor's advisory.

What to do

• Check exposure: the management interface should never be reachable from the internet. Palo Alto recommends restricting it to trusted internal addresses, or better, to a single jump host.
• Apply the patch for your branch. The advisory states that there is no workaround.
• Look for traces: the advisory lists three IP addresses linked to the attacks: 66.42.72[.]14, 208.83.239[.]114 and 149.248.47[.]234. Search for them in your management access logs.
• Signatures: Threat Prevention subscribers can enable signatures 510046 and 510047 (content version 9159-10287 or later), provided SSL traffic is decrypted. The vendor warns that variants of the attack could go undetected.
• Review administrator accounts: reset the passwords of administrator accounts and check that no unknown account has been created.