Palo Alto Networks confirmed on Wednesday, October 14, 2026, the active exploitation in real-world attacks of a critical remote code execution (RCE) vulnerability in the PAN-OS operating system, tracked as CVE-2026-0322. The flaw resides in the management interface of the firewall platform and allows an attacker holding valid credentials and network access to execute arbitrary code with root privileges on the targeted device. Palo Alto Networks rated the issue with a severity score of 8.6 and a highest urgency designation, emphasizing that exploitation requires pre-existing authentication but no special configuration beyond standard network connectivity to the management interface.
The vulnerability directly affects the PA-Series and VM-Series hardware lines, as well as virtual and M-Series Panorama appliances. Devices running Cloud NGFW and Prisma Access are excluded from the affected product scope. The flaw was discovered internally by researcher Suraj Siddharudh, a senior principal product security researcher at Palo Alto Networks, rather than through an external disclosure channel. The impacted version range spans a significant breadth of releases: PAN-OS 12.2 up to but excluding 12.2.3, 12.1 up to but excluding 12.1.4-h12, 12.1.7 up to but excluding 12.1.7-h8, 12.1.10 up to but excluding 12.1.10-h2, 11.2.4 up to but excluding 11.2.4-h22, 11.2.7 up to but excluding 11.2.7-h21, 11.2.10 up to but excluding 11.2.10-h15, 11.2.13 up to but excluding 11.2.13-h3, 11.2.0 up to but excluding 11.2.16, 11.1.4 up to but excluding 11.1.4-h37, 11.1.6 up to but excluding 11.1.6-h39, 11.1.7 up to but excluding 11.1.7-h11, 11.1.10 up to but excluding 11.1.10-h35, 11.1.13 up to but excluding 11.1.13-h15, 11.1.16 up to but excluding 11.1.16-h3, 10.2.7 up to but excluding 10.2.7-h38, 10.2.10 up to but excluding 10.2.10-h41, 10.2.13 up to but excluding 10.2.13-h26, 10.2.16 up to but excluding 10.2.16-h11, and 10.2.18 up to but excluding 10.2.18-h12.
Palo Alto Networks has already released patches for the 10.2, 11.1, 11.2, 12.1, and 12.2 branches, with a definitive fix for the 11.2.16 line scheduled for publication on October 15. The company also disclosed three IP addresses linked to observed exploitation activity: 66.42.72.14, 208.83.239.114, and 149.248.47.234. Additionally, threat prevention signatures with IDs 510046 and 510047 provide limited protection when enabled, though they require SSL Decryption to be properly configured on the device.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-0322 to its Known Exploited Vulnerabilities (KEV) catalog, mandating that federal civilian agencies implement mitigation measures by October 17. Palo Alto Networks explicitly stated that no reliable workarounds exist, and the only effective mitigation consists of restricting management interface access exclusively to trusted internal IP addresses, as outlined in their secure deployment guidelines. The company simultaneously published a dozen additional security advisories covering command injection, denial of service, local privilege escalation, identity hijacking, cross-site scripting, and path traversal flaws, all rated medium or low severity.
What to watch for: organizations operating Palo Alto firewalls should prioritize immediate patch deployment, particularly in environments where administrator credentials are exposed on the network. Monitoring the three disclosed malicious IP addresses within intrusion detection systems and analyzing management interface logs for anomalous request patterns remain critical. Administrating the full fleet of Panorama appliances, including virtual instances and hardware units, ensures all affected deployments receive appropriate remediation.
Sources: BleepingComputer, SecurityWeek, Palo Alto Networks
✓ Independent sources cross-checked and verified before publishing
