Palo Alto Networks Patches PAN-OS RCE Flaw Exploited in Attacks

Summary

Palo Alto Networks says attackers have exploited CVE-2026-0322, an authenticated PAN-OS management-interface RCE flaw. Fixes are available for affected versions, and CISA added it to its Known Exploited Vulnerabilities catalog.

Key points

Palo Alto Networks reported limited exploitation of CVE-2026-0322, a high-severity flaw in the PAN-OS management interface.
An attacker needs existing credentials and network access to the interface to execute code as root.
The flaw affects PA-Series and VM-Series firewalls and Panorama virtual and M-Series appliances; Cloud NGFW and Prisma Access are not affected.
Fixes are available for affected PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 versions; a fix for 11.2.16 was expected October 15.
Palo Alto recommends restricting management-interface access to trusted internal IP addresses. It says there are no known workarounds.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and set an October 17 mitigation deadline for federal civilian agencies.

Article Details

Vulnerability Types: Remote code execution
Severity: High; severity score 8.6
Affected Versions: PAN-OS 10.2
PAN-OS 11.1
PAN-OS 11.2
PAN-OS 12.1
PAN-OS 12.2
Exploitation Status: active
Exploit Availability: unknown
Patch Status: partial
Workarounds: Restrict access to the management interface to trusted internal IP addresses only.
Customers with Threat Prevention subscriptions can enable signatures that provide limited protection against known attack patterns.

Indicators of compromise

Type	Indicator	Context
IPV4	`149[.]248[.]47[.]234`	IP address Palo Alto Networks shared as exploiting the vulnerability.
IPV4	`208[.]83[.]239[.]114`	IP address Palo Alto Networks shared as exploiting the vulnerability.
IPV4	`66[.]42[.]72[.]14`	IP address Palo Alto Networks shared as exploiting the vulnerability.