Palo Alto Networks patches PAN-OS flaw exploited in attacks
Palo Alto Networks has released fixes for CVE-2026-0322, a high-severity flaw in the PAN-OS management interface that lets an attacker with valid credentials and network access execute code as root. The company says exploitation has been very limited; CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue and set US federal civilian agencies an October 17 mitigation deadline.
Bottom line — CVE-2026-0322 has a severity score of 8.6, and Palo Alto Networks says there is no complete workaround.
Go deeper 6
-
The flaw affects PA-Series and VM-Series firewalls and Panorama virtual and M-Series appliances; Cloud NGFW and Prisma Access are not affected, Palo Alto Networks says.
-
Palo Alto Networks recommends restricting management-interface access to trusted internal IP addresses.
-
The company has issued fixes across PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 branches; the applicable fixed release depends on the version in use.
-
Palo Alto Networks shared three IP addresses linked to observed activity: 66.42.72.14, 208.83.239.114 and 149.248.47.234.
-
SecurityWeek reports that the company has not identified who is behind the attacks or shared further details about them.
-
CISA also called for forensic triage of affected systems, according to Cyber Security News.