Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution

Palo Alto Networks has shipped fixes for a zero-day vulnerability in PAN-OS that attackers were already abusing in limited real-world attacks. The high-severity bug, CVE-2026-0322, resides in the management interface and lets an authenticated attacker with network access run arbitrary code with root privileges on affected firewalls, with no special configuration required to trigger it. It impacts PAN-OS running on PA-Series and VM-Series firewalls as well as on Panorama, and was found by the vendor's own internal research rather than an outside reporter. Palo Alto has published a handful of related IP indicators of compromise, though details on the attackers or their methods remain undisclosed, and CISA has already added the flaw to its Known Exploited Vulnerabilities catalog, giving federal agencies until October 17 to remediate. The same day, Palo Alto also released about a dozen advisories covering lower-severity issues across PAN-OS, GlobalProtect and Prisma Cloud, and refreshed Prisma Browser with current Chromium security updates.