Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks

Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls.

The vulnerability affects the PAN-OS management interface and lets authenticated attackers with network access execute code as root on vulnerable devices.

Palo Alto Networks confirmed in a security advisory published Wednesday that it has seen limited exploitation of the flaw in attacks.

"Very limited exploitation has been observed targeting the Palo Alto Networks management interface," the company said.

The vulnerability has a severity score of 8.6 and affects PA-Series and VM-Series firewalls, as well as Panorama virtual and M-Series appliances. Palo Alto says Cloud NGFW and Prisma Access are not affected.

To exploit the vulnerability, attackers need existing credentials and network access to the PAN-OS management interface.

Therefore, Palo Alto Networks recommends restricting access to the management interface to trusted internal IP addresses only.

The company has released fixes for affected PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 versions, with a fix for PAN-OS 11.2.16 expected on October 15.

Customers running older, unsupported versions must upgrade to a supported release.

Palo Alto says there are no known workarounds for the vulnerability, but customers with Threat Prevention subscriptions can enable signatures that provide limited protection against known attack patterns.

"Limited coverage in Threat Prevention means that while known attack patterns can be identified using the current Threat ID, variations may exist that cannot currently be detected," warns Palo Alto.

"If this CVE and Required Configuration for Exposure impact your environment, we recommend upgrading to an unaffected version."

The vulnerability was discovered internally by Suraj Siddharudh, a senior principal product security researcher at Palo Alto Networks.

The company also shared three IP addresses that have been exploiting the flaw: 66.42.72[.]14, 208.83.239[.]114, and 149.248.47[.]234.

BleepingComputer contacted Palo Alto Networks to learn when exploitation began, who is behind the attacks, and whether attackers compromised firewalls or used them to access internal networks.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has now added CVE-2026-0322 to the Known Exploited Vulnerabilities catalog and requires federal civilian agencies to mitigate the vulnerability by October 17.