Palo Alto Networks warns of exploited PAN-OS flaw giving attackers root on firewalls

Palo Alto Networks on October 14 disclosed and patched CVE-2026-0322, a code injection vulnerability in the management interface of its PAN-OS operating system that is already being exploited in attacks. The same day, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. Because PAN-OS powers firewalls that sit at the edge of many corporate networks, a compromise can give attackers a foothold in the most sensitive part of the infrastructure.

What happened

According to the vendor's advisory, an authenticated attacker with network access to the management interface can execute arbitrary code with root privileges on the device. Palo Alto Networks says it has observed "very limited exploitation" targeting the management interface and has published three IP addresses linked to the activity as indicators of compromise: 66.42.72.14, 208.83.239.114 and 149.248.47.234.

The company rates the flaw High with a CVSS 4.0 score of 8.6, but assigns it its highest urgency level. The advisory notes that risk is greatest when the management interface is reachable from external IP addresses on the internet. CISA's alert announced the flaw alongside three other actively exploited bugs, in Cisco Secure Email Gateway and AhsayCBS.

Technical details

The vulnerability is classified as CWE-94 (code injection). Palo Alto Networks says no special configuration is required for a device to be vulnerable. The issue was reported internally. SecurityOnline, which reported on the advisory, notes that no public proof-of-concept exploit has been confirmed.

Who is affected

The advisory covers PA-Series and VM-Series firewalls as well as Panorama (virtual and M-Series). Cloud NGFW and Prisma Access are not affected. Fixed releases, per the vendor, include:

• PAN-OS 12.2: 12.2.4
• PAN-OS 12.1: 12.1.4-h12, 12.1.7-h8, 12.1.10-h2
• PAN-OS 11.2: 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16 (the last listed with an expected date of October 15)
• PAN-OS 11.1: 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3
• PAN-OS 10.2: 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12

Devices running older, unsupported PAN-OS versions should be moved to a supported, fixed release.

What to do

Palo Alto Networks states that there are no known workarounds, so upgrading is the primary fix. Administrators should restrict management interface access to trusted internal IP addresses or a jump host, in line with the vendor's best-practice guidance. Threat Prevention subscribers can get limited protection by enabling Threat IDs 510046 and 510047 (content version 9159-10287 or later), which require SSL decryption of management traffic. Organizations should also check logs for connections from the published IP addresses and review devices for signs of compromise, since CISA's directive for federal agencies stresses verifying whether systems were breached before patches were applied.