Palo Alto Networks Patches Actively Exploited PAN-OS Zero-Day
Summary
Palo Alto Networks patched CVE-2026-0322, an authenticated remote-code-execution flaw in PAN-OS management interfaces. Limited exploitation was observed; CISA added the vulnerability to its KEV catalog.
Key points
- CVE-2026-0322 is a high-severity zero-day that can let an authenticated attacker with network access execute code as root on a targeted firewall.
- The flaw affects PAN-OS on PA-Series and VM-Series firewalls and Panorama; the advisory says no special configuration is required for exploitation.
- Palo Alto Networks reported very limited exploitation targeting the management interface and released IoCs, including several IP addresses.
- The company released patches; the article does not specify affected versions or patch details.
- CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog and set an October 17 deadline for federal agencies to address it.
- Palo Alto also issued 12 advisories for medium- or low-severity vulnerabilities in PAN-OS, GlobalProtect, and Prisma Cloud.
Article Details
- Vulnerability Types
- Remote code execution
- Severity
- High
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
CVE
Vendors
Products
PA-SeriesIt affects PAN-OS software on PA-Series and VM-Series firewalls and on Panorama.PAN-OSPalo Alto Networks on Wednesday informed customers that it has released patches for a PAN-OS zero-day vulnerability exploited in malicious attacks.PanoramaIt affects PAN-OS software on PA-Series and VM-Series firewalls and on Panorama.VM-SeriesIt affects PAN-OS software on PA-Series and VM-Series firewalls and on Panorama.