Palo Alto Networks fixes PAN-OS zero-day exploited in attacks

Palo Alto Networks has released security updates for a high-severity remote code execution (RCE) flaw in PAN-OS, tracked as CVE-2026-0322. The company says it has observed limited exploitation targeting firewalls.

The vulnerability affects the PAN-OS management interface. An attacker needs existing credentials and network access to that interface to execute code as root on a vulnerable device. The flaw has a severity score of 8.6 and affects PA-Series and VM-Series firewalls, along with Panorama virtual and M-Series appliances. Palo Alto Networks says Cloud NGFW and Prisma Access are not affected.

Fixes are available for affected PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 versions. A fix for PAN-OS 11.2.16 is expected on October 15. The company says customers using unsupported older versions must upgrade to a supported release. There are no known workarounds. Customers with Threat Prevention subscriptions can enable signatures that offer limited protection against known attack patterns; variations may not be detected.

Palo Alto Networks recommends limiting management-interface access to trusted internal IP addresses. The flaw was discovered internally by Suraj Siddharudh, a senior principal product security researcher at the company. CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog and requires federal civilian agencies to mitigate it by October 17.