Palo Alto Networks PAN-OS Flaw CVE-2026-0322 Exploited in Attacks: Patches Now Available

On October 14, Palo Alto Networks disclosed CVE-2026-0322, a vulnerability in the PAN-OS management interface, and confirmed that it is being exploited in attacks. An authenticated attacker with network access to the management interface can execute code with root privileges. The vendor recommends fixing the vulnerability as soon as possible.

What we know about the threat

The vendor describes the exploitation seen so far as very limited. The public advisory does not name the attackers or say how many organizations have been affected. The flaw has a CVSS score of 8.6. To exploit it, an attacker must first authenticate and must be able to connect to the management interface.

The issue affects PA-Series and VM-Series firewalls, as well as Panorama in both its virtual appliance form and on M-Series appliances. Cloud NGFW and Prisma Access are not affected.

The risk is highest where the management interface can be reached from external internet addresses. Restricting access lowers the risk, but it does not remove the flaw from the software. The vendor has not provided a workaround that could stand in for the patch.

What to do now

• Take inventory of your devices and their full PAN-OS release numbers, including hotfix designations. Compare them against the table in the vendor’s advisory.
• Install the fixed release for the branch you run. Updates are available for the 10.2, 11.1, 11.2, 12.1 and 12.2 release lines. Older, unsupported versions must be upgraded to a supported version that includes the fix.
• For PAN-OS 11.2.16, the advisory lists October 15 as the planned availability date. Confirm that the release is actually available before you schedule the installation. An announcement is not confirmation that the release has shipped.
• Restrict the management interface to trusted internal addresses, ideally through a dedicated jump server used for administration.
• Review administrative access and logs for unusual connections. Include in your analysis the IP addresses linked to exploitation attempts that the vendor has published.

Threat prevention signatures offer only limited detection coverage. Palo Alto Networks warns that they may catch known attack patterns while variants go undetected. Enabling these protections is not a reason to delay patching.

SecurHUB commentary

A firewall’s management interface should be reachable only by authorized staff, and only from controlled points on the network. An infrastructure security audit can help you assess how exposed these interfaces are and how accounts and updates are managed.

Sources: Palo Alto Networks, BleepingComputer