Palo Alto Networks warns of a PAN-OS RCE flaw exploited in attacks

Palo Alto Networks has released security updates for a high-severity remote code execution vulnerability in its PAN-OS software, tracked as CVE-2026-0322, and says it has observed "very limited" exploitation in the wild. The flaw affects the management interface of several firewall and appliance lines, and administrators are being urged to update or restrict access.

What's happening

According to BleepingComputer, Palo Alto Networks published a security advisory on Wednesday confirming limited exploitation of the flaw. The vendor's own advisory describes it as an "authenticated remote code execution (RCE) in the management interface" that lets an attacker with network access execute arbitrary code with root privileges on the firewall.

The vulnerability has a severity score of 8.6. To exploit it, an attacker reportedly needs existing credentials plus network access to the PAN-OS management interface — so it is not an unauthenticated, hit-anyone-on-the-internet bug. Palo Alto Networks says no special configuration is required for a device to be affected.

The vendor says it has released fixes for affected PAN-OS branches 10.2, 11.1, 11.2, 12.1 and 12.2, with a fix for PAN-OS 11.2.16 expected on October 15. It adds that customers on older, unsupported versions must upgrade to a supported release. The flaw was reportedly discovered internally by Suraj Siddharudh, a senior principal product security researcher at Palo Alto Networks.

BleepingComputer reports that the vendor shared three IP addresses associated with exploitation: 66.42.72[.]14, 208.83.239[.]114 and 149.248.47[.]234. The U.S. cybersecurity agency CISA has added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog, requiring federal civilian agencies to mitigate it by October 17. Details such as exactly when exploitation began and who is behind it are, at the time of writing, not fully established.

Who's affected

Palo Alto Networks PA-Series and VM-Series firewalls running affected PAN-OS versions.
Panorama virtual and M-Series appliances, which the advisory also lists as impacted.
Not affected: the vendor says Cloud NGFW and Prisma Access are not impacted by this vulnerability.
Administrators who expose the management interface to the internet, since network access to that interface is required to exploit the flaw.

What to do

Upgrade to a fixed PAN-OS release. Check your branch against the patched versions for 10.2, 11.1, 11.2, 12.1 and 12.2, and note that a fix for 11.2.16 is expected on October 15. Unsupported versions should be moved to a supported release.
Do not expose the management interface. The vendor recommends restricting management-interface access to trusted internal IP addresses only, which it says minimises the risk.
There is reportedly no workaround. Palo Alto Networks says no known workarounds exist. Customers with a Threat Prevention subscription can get limited protection by enabling Threat IDs 510046 and 510047, but this requires SSL decryption and, the vendor warns, cannot detect every variation of an attack.
Check for signs of compromise. Look for unusual root-level activity tied to the management interface and for the three IP addresses above in your logs.
Treat it as evolving. Follow the vendor advisory and CISA's catalog for updates, as more detail may emerge.

Sources

BleepingComputer — reports the advisory, the CVSS score, the affected product lines, the fixed versions and the three attacker IPs.
Palo Alto Networks (advisory) — the vendor's own page, confirming the authenticated management-interface RCE, the affected products and the lack of workarounds.
The Hacker News — covers the PAN-OS patches for the actively exploited flaw.