CVE-2026-0322: Palo Alto Networks PAN-OS Code Injection Vulnerability | Cyberiack

Skip to content

Actively exploited: added to CISA’s KEV catalog on October 14, 2026.
Use by ransomware: not established so far.
Remediation deadline for US federal agencies: October 17, 2026.

Description from CISA’s KEV catalog.

Our analyses

Palo Alto firewall flaw already exploited gives full device control to anyone with an admin account

Palo Alto fixed the flaw on October 14 and says there is no workaround. Here are the versions to install, and what to do right now if the management interface is reachable from the Internet.

Oct 15, 20262 min read

What to do

Check whether your estate includes Palo Alto Networks PAN-OS, including internet-facing devices.
Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.

References

Vendor advisory or reference cited by CISA (security.paloaltonetworks.com)
NVD entry (NIST)
CISA KEV catalog

Other Palo Alto Networks vulnerabilities

CVE-2026-0257Used by ransomwareMay 29

Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
CVE-2026-0300May 6

Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability

All exploited Palo Alto Networks vulnerabilities