Palo Alto Networks patches exploited RCE flaw in PAN-OS

Palo Alto Networks has released security updates for a high-severity PAN-OS flaw that is already being used in live attacks. The bug, tracked as CVE-2026-0322, allows remote code execution and affects the firewall management interface.

What the flaw does

According to the company, the vulnerability lets an authenticated attacker with network access to the PAN-OS management interface run code as root on vulnerable devices. In an advisory published Wednesday, Palo Alto Networks confirmed it had observed limited exploitation of the issue in the wild.

The flaw carries a severity score of 8.6 and affects PA-Series and VM-Series firewalls, as well as Panorama virtual and M-Series appliances. The company says Cloud NGFW and Prisma Access are not affected.

Mitigation and fixes

Exploitation requires valid credentials and network access to the management interface, so Palo Alto Networks recommends restricting that interface to trusted internal IP addresses only.

Fixes are available for PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2, with a patch for PAN-OS 11.2.16 expected on October 15. Customers on older, unsupported releases must upgrade to a supported version.

There are no workarounds, but Threat Prevention subscribers can enable signatures that offer limited protection against known attack patterns. The company cautions that this coverage may miss variations of the attack, so upgrading remains the preferred path.

The vulnerability was discovered internally by researcher Suraj Siddharudh. Palo Alto Networks also shared three IP addresses seen exploiting the flaw: 66.42.72.14, 208.83.239.114 and 149.248.47.234.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog and ordered federal civilian agencies to remediate it by October 17.

Source: Bleeping Computer