Photo credits
Palo Alto Networks Patches Actively Exploited PAN-OS Security Flaw
A high-severity zero-day vulnerability in firewall software allowed authenticated attackers with network access to gain root control over management interfaces.
15 Oct 2026 0 reads Compiled with AI
#Palo Alto Networks #PAN-OS #Panorama #CISA #GlobalProtect #Prisma Cloud
Palo Alto Networks has released security updates to fix a zero-day vulnerability in its PAN-OS software that attackers have actively exploited in intrusions. The high-severity flaw is tracked as CVE-2026-0322 and allows remote code execution. An authenticated attacker who has network access can take advantage of the issue to run arbitrary commands with root privileges on an affected firewall.
The vendor discovered the flaw internally during its own security work. The vulnerability affects the management interface of PAN-OS software across PA-Series hardware firewalls, VM-Series virtual firewalls, and Panorama management systems. The company noted that targeted systems do not require any unusual or special configuration for an attacker to carry out an exploit.
Photo credits
Palo Alto Networks stated that it has observed very limited exploitation directed at the management interface. To help network administrators detect unauthorized access, the company released indicators of compromise that include several suspicious IP addresses. It has not shared details about the specific organizations targeted in the attacks or the threat actor behind the activity.
The Cybersecurity and Infrastructure Security Agency added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog on Wednesday. The agency instructed federal agencies to address the flaw by October 17. The addition brings the total number of Palo Alto Networks vulnerabilities listed in the catalog to 16, with three of those entries added during 2026.
Alongside the zero-day fix, Palo Alto Networks published a dozen other advisories covering medium- and low-severity flaws across PAN-OS, GlobalProtect, and Prisma Cloud. Those resolved issues include command injection, denial-of-service flaws, identity hijacking, and local privilege escalation. The company also updated its Prisma Browser to incorporate the newest Chromium patches.