Palo Alto Networks has released crucial security updates to address a high-severity vulnerability in its PAN-OS software that is currently being actively exploited. The security flaw, identified as CVE-2026-0322 and receiving a CVSS score of 8.6, allows remote code execution through the management interface.
Vulnerability Details and Impact
The issue involves an authenticated attacker’s ability to execute arbitrary code with root privileges on firewalls running PAN-OS. This vulnerability affects devices such as the PA-Series and VM-Series firewalls, along with Panorama (virtual and M-Series). However, Palo Alto’s Cloud NGFW and Prisma Access are not susceptible.
Notably, exploitation of this flaw requires no special configuration, although restricting access to the management interface to trusted internal IP addresses is recommended to reduce risk.
Available Patches and Exploitation Attempts
Palo Alto Networks has released patches in multiple versions of PAN-OS to mitigate this vulnerability. The updates are available for PAN-OS versions 12.2.4 and above, spanning various iterations of 12.1, 11.2, 11.1, and 10.2 versions.
The company acknowledged limited exploitation attempts targeting the management interface but did not disclose specific details about the attacks. Certain IP addresses traced to the U.S. have been linked to these exploit attempts, including 66.42.72[.]14, 208.83.239[.]114, and 149.248.47[.]234.
Industry Response and Future Outlook
Suraj Siddharudh, a senior principal product security researcher at Palo Alto Networks, was credited for discovering the vulnerability. Meanwhile, Cisco has also reported exploitation of a critical flaw in its Secure Email Gateway, CVE-2026-76519, which allows attackers to write arbitrary files on the system.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, urging Federal Civilian Executive Branch agencies to prioritize patching by October 17, 2026.
As cybersecurity threats continue to evolve, timely updates and adherence to recommended security practices remain essential in safeguarding network systems.
