Palo Alto Networks has released security updates for a PAN-OS RCE flaw that attackers have exploited against firewall management interfaces. Tracked as CVE-2026-0322, the vulnerability allows authenticated attackers to execute code with root privileges.
The company confirmed limited exploitation in its October 14 advisory. However, attackers need valid credentials and network access to the management interface before they can exploit the weakness.
Vulnerability Affects Firewalls and Panorama Appliances
CVE-2026-0322 carries a severity score of 8.6 and affects the PAN-OS management interface.
Affected products include PA-Series and VM-Series firewalls, alongside Panorama virtual and M-Series appliances. In contrast, Cloud NGFW and Prisma Access do not contain the vulnerability.
Successful exploitation gives an attacker root-level code execution on a vulnerable device. Nevertheless, the requirement for existing credentials and management-interface access limits the conditions under which an attack can succeed.
Palo Alto Networks therefore advises customers to restrict management access to trusted internal IP addresses.
Security Updates Address the PAN-OS RCE Flaw
The company has released fixes across affected PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 releases.
At the time of the advisory, it expected a fix for PAN-OS 11.2.16 on October 15. Meanwhile, customers using older, unsupported versions must move to a supported release.
Administrators should check the advisory for the appropriate fixed version for their deployment. Restricting management access reduces exposure, but it does not replace the security update.
The company says it has no known workaround for the vulnerability.
Threat Prevention Offers Only Partial Coverage
Customers with Threat Prevention subscriptions can enable signatures that detect known attack patterns associated with the flaw.
However, Palo Alto Networks cautions that this protection has limits. Attackers may use variations that the current signatures cannot detect.
Consequently, organizations should not treat signature coverage as a complete defense. The company recommends upgrading affected deployments to an unaffected version.
An internal product security researcher discovered the vulnerability.
Three IP Addresses Linked to Exploitation
Palo Alto Networks published three IP addresses associated with attacks exploiting CVE-2026-0322:
66.42.72[.]14208.83.239[.]114149.248.47[.]234
These indicators give security teams specific addresses to examine during investigations. However, the available information does not establish when exploitation began or identify the attackers.
It also remains unclear whether the observed activity led to firewall compromises or access to internal networks.
CISA Sets October 17 Mitigation Deadline
The U.S. Cybersecurity and Infrastructure Security Agency has added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog.
Federal civilian agencies must mitigate the vulnerability by October 17. The deadline follows confirmation that attackers have already used the flaw in real-world activity.
For affected organizations, the vendor’s guidance centers on installing a fixed release and limiting management-interface access to trusted internal addresses.
0 responses to “PAN-OS RCE Flaw Exploited in Attacks as Palo Alto Releases Patches”