Palo Alto Networks has patched an actively exploited zero-day in its PAN-OS firewall software. The flaw, tracked as CVE-2026-0322, lets an authenticated attacker with access to the management interface run code as root on the firewall. Here is the short version: if you run PA-Series, VM-Series, or Panorama appliances, patch to the fixed PAN-OS release immediately and make sure your management interface is not reachable from the internet. CISA has added the flaw to its Known Exploited Vulnerabilities catalog, giving US federal agencies until October 17, 2026 to fix it.
What Happened
On Wednesday, October 14, 2026, Palo Alto Networks published a security advisory for a high-severity remote code execution vulnerability in the PAN-OS management interface. The company confirmed it had already seen limited exploitation of the flaw in real attacks targeting firewall appliances.
Palo Alto Networks described the activity as very limited exploitation directed at the management interface. It published three attacker IP addresses linked to the exploit attempts, all geolocated to the United States: 66.42.72.14, 208.83.239.114, and 149.248.47.234. Security teams should check firewall logs for connections from these addresses.
The flaw was discovered internally by Suraj Siddharudh, a senior principal product security researcher at Palo Alto Networks, rather than by an outside researcher or customer.
What CVE-2026-0322 Is
CVE-2026-0322 is a code injection vulnerability (CWE-94) in the management interface of PAN-OS. An authenticated attacker with network access to that interface can execute arbitrary code with root privileges on the firewall.
Two details matter here:
- It requires authentication. Unlike some firewall zero-days that need no credentials, the attacker needs valid credentials and network access to the management interface. That limits opportunistic attacks but means any stolen admin credential is now far more dangerous.
- The result is root access. Root on a firewall is about as bad as it gets. An attacker who reaches this point controls the device that is supposed to protect everything behind it.
The vulnerability carries a CVSS 4.0 score of 8.6, rated High. Palo Alto Networks marks its urgency as highest and its exploit maturity as attacked, which is the vendor’s way of confirming exploitation is real.
Which Products and Versions Are Affected
The flaw affects PAN-OS software running on PA-Series and VM-Series firewalls, and on Panorama virtual and M-Series appliances. Cloud NGFW and Prisma Access are not affected.
Patches are available for the supported PAN-OS branches. Palo Alto Networks lists the following as fixed releases:
- PAN-OS 12.2: fixed in 12.2.4 and later
- PAN-OS 12.1: fixed hotfixes including 12.1.4-h12, 12.1.7-h8, and 12.1.10-h2
- PAN-OS 11.2: fixed hotfixes including 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, with 11.2.16 expected on October 15, 2026
- PAN-OS 11.1: fixed hotfixes including 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, and 11.1.16-h3
- PAN-OS 10.2: fixed hotfixes including 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, and 10.2.18-h12
Customers running older, unsupported versions cannot just apply a hotfix. They need to upgrade to a supported fixed release. Palo Alto Networks says no special configuration is needed for the flaw to be exploitable, and there are no known workarounds.
What to Do Right Now
1. Patch to a fixed PAN-OS release
This is the only real fix. Upgrade to the fixed release for your branch listed above. If you are on an unsupported version, plan the upgrade to a supported branch now.
2. Lock down the management interface
Until the patch is applied, reduce exposure. Palo Alto Networks recommends restricting access to the management interface to trusted internal IP addresses only. Its specific suggestion is to route management through a jump box, so that the jump box is the only system allowed to reach the management interface.
3. Check logs for the known attacker IPs
Look for connections to your management interfaces from 66.42.72.14, 208.83.239.114, and 149.248.47.234. These are hunting leads tied to the observed exploitation, so treat any hits as a strong signal to investigate.
4. Know the limits of Threat Prevention
Customers with Threat Prevention subscriptions can enable signatures that detect known attack patterns, but Palo Alto Networks warns this coverage is limited. Variants of the attack may not be detected. Patching is the only reliable mitigation.
5. Meet the CISA deadline
CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog, which sets a binding remediation deadline of October 17, 2026 for US federal civilian agencies. Even if you are not a federal agency, treat that date as the urgency benchmark. Exploitation is already happening, and proof-of-concept activity tends to scale up quickly after a public advisory.
Why This Flaw Is Especially Uncomfortable
Firewalls sit at the edge of the network, and their management interfaces are among the most sensitive surfaces an organization owns. This advisory lands in the middle of a rough week for security infrastructure. Cisco disclosed an actively exploited Secure Email Gateway zero-day the same day, and Ivanti’s Connect Secure zero-day is being exploited in the wild right now.
The pattern is consistent: attackers are going after the security appliances themselves. A firewall with root-level code execution is not just one compromised box. It is a foothold inside the trust boundary, on a device that sees all traffic and is rarely suspected. That is why October’s record Patch Tuesday and this advisory both point to the same advice: patch the infrastructure that protects you first, then patch everything else.
FAQ
What is CVE-2026-0322?
CVE-2026-0322 is an authenticated remote code execution vulnerability in the management interface of Palo Alto Networks PAN-OS. It lets an authenticated attacker with network access to the interface execute arbitrary code with root privileges on the firewall. It is rated CVSS 8.6 (High) and is being actively exploited.
Is my Palo Alto firewall affected?
If you run PAN-OS on PA-Series or VM-Series firewalls, or on Panorama virtual or M-Series appliances, and your version is older than the fixed releases listed in Palo Alto’s advisory, you are affected. Cloud NGFW and Prisma Access are not affected.
Do attackers need a password to exploit it?
Yes. Exploitation requires an authenticated attacker with network access to the management interface. It is not a no-authentication flaw, but stolen or leaked admin credentials would be enough.
Is there a workaround if I cannot patch immediately?
Palo Alto Networks says there are no known workarounds. The recommended risk reduction is to restrict the management interface to trusted internal IP addresses only, ideally through a dedicated jump box. Threat Prevention signatures offer only limited detection of known attack patterns.
What is the patch deadline?
CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog with a remediation deadline of October 17, 2026 for US federal civilian agencies. Palo Alto Networks released fixed hotfixes for PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2, with the 11.2.16 fixed release expected October 15, 2026.