Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation

Palo Alto Networks has released fixes for a high-severity authenticated remote code execution bug in PAN-OS, identified as CVE-2026-0322 (CVSS 8.6), after confirming it is being actively abused in the wild. The flaw sits in the management interface and lets an attacker who already has network access and valid credentials run arbitrary code with root privileges on the firewall, with no special setup needed to trigger it. It hits PAN-OS running on PA-Series and VM-Series firewalls plus Panorama appliances (virtual and M-Series), while Cloud NGFW and Prisma Access remain unaffected. The vendor says it has only observed very limited attack activity so far, tied to a handful of US-based IP addresses, and recommends locking down management-interface access to trusted hosts or a jump box while applying the patched PAN-OS builds. CISA has added this flaw, alongside a separate critical Cisco Secure Email Gateway bug (CVE-2026-76519), to its Known Exploited Vulnerabilities catalog, giving federal agencies until October 17, 2026 to remediate.