Securify

Palo Alto Networks has patched a zero-day vulnerability in its PAN-OS firewall operating system that gives authenticated attackers the ability to execute arbitrary code as root — and attackers are already using it. CISA responded by adding the flaw to its Known Exploited Vulnerabilities catalog on October 14, giving federal agencies just three days to remediate.

What Happened

Tracked as CVE-2026-0322, the vulnerability is a code injection flaw (CWE-94) in the PAN-OS management interface. An attacker who holds valid administrator credentials and can reach the management interface over the network can exploit the bug to run arbitrary commands with root privileges on the underlying firewall operating system. No special device configuration is required — any unpatched instance running an affected PAN-OS version is vulnerable.

Palo Alto Networks disclosed the flaw on Wednesday and acknowledged that “very limited exploitation has been observed targeting the Palo Alto Networks management interface.” The company did not identify the threat actors responsible or describe when the attacks began, but it published three U.S.-geolocated IP addresses tied to the observed exploit activity: 66.42.72.14, 208.83.239.114, and 149.248.47.234.

The vulnerability was found internally by Suraj Siddharudh, a senior principal product security researcher at Palo Alto Networks, and carries a CVSS 4.0 score of 8.6 (High).

Why It Matters

Firewalls sit at the perimeter of enterprise networks. They are, by design, the first and last line of defense between an organization’s internal systems and the hostile internet. When an attacker gains root on a firewall, the consequences go well beyond a single compromised host. Root-level access on a PAN-OS device can allow an adversary to:

• Tamper with security policies, silently opening holes in the firewall ruleset
• Inspect or modify traffic passing through the device, including encrypted sessions terminated at the firewall
• Establish persistence that survives reboots and policy reloads
• Pivot deeper into the internal network, using the firewall as a launching point
• Disable logging and erase forensic evidence

Palo Alto Networks firewalls are among the most widely deployed in the world. PA-Series hardware appliances, VM-Series virtual firewalls, and Panorama centralized management platforms are found across Fortune 500 enterprises, government agencies, healthcare systems, and critical infrastructure operators. Even “very limited” exploitation of this class of device is a serious event.

Who Is Affected

The vulnerability affects PAN-OS versions 10.2, 11.1, 11.2, 12.1, and 12.2 running on PA-Series and VM-Series firewalls, as well as Panorama virtual and M-Series appliances. Palo Alto Networks confirmed that Cloud NGFW and Prisma Access are not affected.

Organizations whose management interfaces are exposed to the public internet face the highest risk. While exploitation requires valid credentials, attackers routinely obtain those through phishing, credential stuffing, password reuse from prior breaches, or as part of multi-stage intrusion chains. An exposed management interface dramatically lowers the bar.

Patches and Mitigation

Fixed releases are now available across all supported PAN-OS branches:

• PAN-OS 12.2: version 12.2.4 and later
• PAN-OS 12.1: versions 12.1.4-h12, 12.1.7-h8, 12.1.10-h2 and later
• PAN-OS 11.2: versions 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, and 11.2.16 (expected October 15)
• PAN-OS 11.1: versions 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3 and later
• PAN-OS 10.2: versions 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12 and later

Organizations running unsupported PAN-OS versions must upgrade to a supported branch to receive the fix.

For organizations that cannot patch immediately, Palo Alto Networks recommends restricting management interface access to trusted internal IP addresses only, ideally routing all administrative access through a dedicated jump box. The company has also released Threat Prevention signatures (Threat IDs 510046 and 510047, available in content update 9159-10287) that can provide limited detection coverage — but enabling them requires routing management traffic through a data-plane interface with TLS decryption and Threat Prevention inspection enabled. The vendor emphasizes this is not a substitute for patching.

The Bigger Picture: A Busy Day for CISA

CVE-2026-0322 was not the only firewall-and-gateway flaw to land in the CISA KEV catalog this week. On the same day, CISA also flagged:

• CVE-2026-76519 (CVSS 9.8, Critical) — a relative path traversal in Cisco Secure Email Gateway’s AMP feature that allows unauthenticated attackers to write arbitrary files and execute commands as root via a crafted email attachment. Cisco confirmed active exploitation.
• CVE-2026-105133 and CVE-2026-105134 — an authentication bypass and command injection in Ahsay AhsayCBS backup software, being chained by attackers to deploy webshells and cryptominers on internet-facing servers.

Federal Civilian Executive Branch agencies face a remediation deadline of October 17, 2026 for all four vulnerabilities — an unusually tight three-day window that reflects the severity and active exploitation of these flaws.

What You Should Do Now

If your organization runs Palo Alto Networks firewalls, treat this as an urgent priority:

1. Audit your management interface exposure. Determine whether the PAN-OS management interface is reachable from the internet or from untrusted network segments. If it is, restrict access to trusted internal IPs immediately — before you even start the patching process.
2. Patch without delay. Apply the fixed PAN-OS release for your branch. If you run PAN-OS 11.2 and the 11.2.16 hotfix hasn’t dropped yet, apply the nearest available hotfix and restrict access as a bridge.
3. Hunt for compromise. Search your management-interface authentication logs and network logs for the three IOC IP addresses. Look for unexpected admin logins, anomalous source addresses, suspicious process activity, and unexplained configuration changes. The absence of hits on the published IPs does not guarantee you were not targeted — other infrastructure may be in play.
4. Rotate credentials. If you suspect compromise, rotate all administrative credentials for the affected device and any accounts that share passwords with it.
5. Check Cisco and Ahsay too. If you also run Cisco Secure Email Gateway or Ahsay backup software, verify you’re patched against the companion CVEs flagged in the same CISA advisory.

This is the 16th Palo Alto Networks vulnerability to land in CISA’s KEV catalog, and the third this year alone. Perimeter devices remain a favorite target for sophisticated adversaries precisely because they are high-privilege, always-on, and often under-monitored. Keeping management interfaces off the public internet is no longer optional hygiene — it is a baseline survival requirement.