Hackers have recently exploited a significant flaw in Palo Alto Networks’ PAN-OS, enabling them to execute code with root privileges on compromised firewalls. This vulnerability, identified as CVE-2026-0322, affects the management interface of the system. Palo Alto Networks has acknowledged limited exploitation and has strongly advised users to implement the necessary updates immediately.
PAN-OS Vulnerability Details
Palo Alto Networks released a security advisory on October 14, 2026, highlighting the flaw with a CVSS 4.0 score of 8.6, indicating high severity. The vulnerability was discovered by internal researcher Suraj Siddharudh. While the attackers remain unnamed, the extent of targeted organizations has not been disclosed.
The vulnerability is classified as a code injection flaw (CWE-94), requiring authenticated access with high privileges to exploit. Successful exploitation allows attackers to execute root-level commands, providing them full control over the firewall. This flaw does not require user interaction but is limited to users with privileged access.
Impact on Products and Previous Incidents
The vulnerability affects PA-Series hardware firewalls, VM-Series virtual firewalls, and Panorama deployments on virtual systems or M-Series appliances. Notably, Cloud NGFW and Prisma Access are unaffected by this issue.
This isn’t the first time the management interface of PAN-OS has been targeted. Past attacks, such as those involving CVE-2025-0108, have utilized chains of vulnerabilities to compromise systems, although these are unrelated to the current threat.
Security Fixes and Recommendations
Palo Alto Networks has released fixed versions, including PAN-OS 12.2.4, 12.1.10-h2, 11.1.16-h3, and 10.2.18-h12, with further updates scheduled. Administrators are advised to follow the upgrade paths outlined in the security advisory for their specific installations.
The company stresses that no known workaround exists, and restricting management access to trusted IP addresses can reduce risk but not replace the need for patching. They recommend avoiding internet exposure of administrative interfaces to minimize vulnerability.
IP addresses such as 66[.]42[.]72[.]14, 208[.]83[.]239[.]114, and 149[.]248[.]47[.]234 have been associated with limited exploit attempts. Security teams should monitor these as indicators in management traffic and prioritize system updates and access controls.
As attack variations may evade current defenses, implementing supported fixed releases is the best protection strategy for affected systems. An EDR alert might indicate an attack’s presence, but thorough analysis is necessary to understand the full scope of any breach.
