Palo Alto Networks patches PAN-OS zero-day already exploited in attacks

CISA orders federal agencies to mitigate CVE-2026-0322 by October 17

By LineZotpaper

Published15 October 2026

Read Time2 min

Palo Alto Networks has released security updates for a high-severity zero-day vulnerability in PAN-OS, the operating system that runs its firewalls, after confirming the flaw is being exploited in attacks targeting the management interface.

The vulnerability, tracked as CVE-2026-0322, affects the PAN-OS management interface and allows authenticated attackers with network access to execute code as root on vulnerable devices. It carries a severity score of 8.6.

Affected products include PA-Series and VM-Series firewalls, as well as Panorama virtual and M-Series appliances. The company said Cloud NGFW and Prisma Access are not affected.

In a security advisory published Wednesday, Palo Alto Networks said it had observed limited exploitation of the flaw. "Very limited exploitation has been observed targeting the Palo Alto Networks management interface," the company said.

Exploitation requires existing credentials and network access to the management interface, so Palo Alto Networks recommends restricting access to the interface to trusted internal IP addresses only. The company has released fixes for PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 versions, with a fix for PAN-OS 11.2.16 expected on October 15. Customers running older, unsupported versions must upgrade to a supported release.

There are no known workarounds, although customers with Threat Prevention subscriptions can enable signatures that provide limited protection. "Limited coverage in Threat Prevention means that while known attack patterns can be identified using the current Threat ID, variations may exist that cannot currently be detected," Palo Alto Networks warned. "If this CVE and Required Configuration for Exposure impact your environment, we recommend upgrading to an unaffected version."

The vulnerability was discovered internally by Suraj Siddharudh, a senior principal product security researcher at the company. Palo Alto Networks also shared three IP addresses observed exploiting the flaw: 66.42.72[.]14, 208.83.239[.]114 and 149.248.47[.]234.

The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog and requires federal civilian agencies to mitigate the vulnerability by October 17.

Analysis

Why This Matters

Firewalls sit at the boundary of corporate networks, and a root-level code execution bug in a firewall's management interface can give attackers control of a core security device.
The flaw is already being exploited in the wild, and CISA has set an October 17 deadline for US federal civilian agencies to mitigate it.
Because exploitation is limited to authenticated attackers, the practical risk depends on how exposed management interfaces are and how well credentials are protected.

Background

PAN-OS is the operating system used across Palo Alto Networks' firewall product lines. A zero-day is a vulnerability exploited before a vendor patch is available. Palo Alto Networks said exploitation so far has been "very limited" and that the flaw was found by its own researchers. The company's guidance emphasises that attackers need valid credentials and network access to the management interface, which narrows but does not eliminate the threat.

Key Perspectives

Palo Alto Networks: Describes the exploitation as very limited, stresses that credentials and network access to the management interface are required, and recommends restricting that interface to trusted internal IP addresses. It warns that Threat Prevention signatures provide only partial coverage and that there are no workarounds. CISA: Has added the vulnerability to its Known Exploited Vulnerabilities catalog, a signal that it considers the flaw a serious and actively used threat, and has ordered federal civilian agencies to mitigate by October 17. Critics and skeptics: The lack of a workaround and the partial nature of Threat Prevention coverage leave patching as the only complete remedy, which is difficult for organisations running unsupported PAN-OS versions. Because the attack requires valid credentials, the vulnerability also raises questions about credential security on management interfaces.

What to Watch

The release of the PAN-OS 11.2.16 fix, expected on October 15.
Whether federal agencies meet the October 17 mitigation deadline set by CISA.
Whether the three published attacker IP addresses lead to further indicators or attribution of the campaign.

Sources

Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks — BleepingComputer