Palo Alto Networks Patches Actively Exploited PAN-OS RCE Flaw; CISA Adds It to KEV List
Summary
Palo Alto Networks issued updates for an authenticated PAN-OS management-interface RCE flaw after observing very limited exploitation. CISA added it and an actively exploited Cisco Secure Email Gateway flaw to its KEV catalog.
Key points
- CVE-2026-0322 is an authenticated remote code execution flaw in the PAN-OS management interface, allowing an attacker with network access to run code as root.
- The flaw affects PA-Series and VM-Series firewalls and Panorama; Cloud NGFW and Prisma Access are not affected.
- Palo Alto Networks issued security updates and advised restricting management-interface access to trusted internal IP addresses or a jump box.
- Palo Alto Networks reported “very limited exploitation” but gave no details about the activity, responsible actors, or when it began.
- Cisco warned that attackers are exploiting CVE-2026-76519 in Secure Email Gateway; a crafted email attachment can enable arbitrary file writes and command execution with root privileges.
- CISA added both vulnerabilities to its KEV catalog and set an October 17, 2026, remediation deadline for federal civilian agencies.
Article Details
- Vulnerability Types
- Remote code execution
- Severity
- High (CVSS 8.6)
- Affected Versions
- PAN-OS on PA-Series and VM-Series firewalls and Panorama (virtual and M-Series); affected version numbers not provided
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Restrict access to the management interface to trusted internal IP addresses, such as a jump box that is the only system permitted to access it.
CVE
People
Vendors
Products
Cloud NGFWThe issue impacts PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma Access are not affected by the vulnerability.PA-SeriesThe issue impacts PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma Access are not affected by the vulnerability.PAN-OSPalo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation.PanoramaThe issue impacts PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma Access are not affected by the vulnerability.Prisma AccessThe issue impacts PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma Access are not affected by the vulnerability.VM-SeriesThe issue impacts PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma Access are not affected by the vulnerability.