Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks

Palo Alto Networks has patched a high-severity zero-day in PAN-OS, identified as CVE-2026-0322, after confirming it was already being abused against firewalls in the field. The flaw sits in the PAN-OS management interface and allows an authenticated attacker with network access to run commands with root privileges, carrying a severity rating of 8.6. Affected gear includes PA-Series and VM-Series firewalls plus Panorama virtual and M-Series appliances, while Cloud NGFW and Prisma Access remain unaffected. The vendor says exploitation so far has been limited, has released fixes for PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 (with the 11.2.16 build due October 15), and urges customers to restrict management-interface access to trusted internal IPs since no workaround exists. CISA has added the bug to its Known Exploited Vulnerabilities list, giving federal agencies until October 17 to apply mitigations, and Palo Alto has published three attacker IP addresses tied to the activity.