Palo Alto PAN-OS Firewall Flaw Allows Root Code Execution
A critical zero-day vulnerability in Palo Alto Networks' PAN-OS, CVE-2026-0322, is being exploited by attackers to gain root code execution on firewalls.
Palo Alto Networks is urging customers to urgently patch their firewalls against a critical vulnerability, CVE-2026-0322, that allows authenticated attackers to achieve root code execution. The flaw, discovered by internal researcher Suraj Siddharudh, carries a CVSS score of 8.6 and has seen "very limited exploitation" in the wild, according to the company's advisory.
The vulnerability resides within the management interface of PAN-OS and is classified as a code injection weakness (CWE-94). Successful exploitation requires an attacker to possess authenticated, high-privilege access and network connectivity to the management interface. Once compromised, an attacker can execute commands with the highest level of control over the affected firewall, as no user interaction is needed for the exploit to succeed.
While the requirement for privileged access limits the potential attack surface, internet-facing management interfaces present the most significant risk. Palo Alto Networks has confirmed that no special configuration is necessary for a vulnerable PAN-OS installation to be susceptible to this flaw. The affected products include PA-Series hardware firewalls, VM-Series virtual firewalls, and Panorama deployments, whether running on virtual systems or M-Series appliances. Cloud NGFW and Prisma Access are not impacted and do not require any action.
This is not the first time the management interface of PAN-OS has been targeted. Previous attacks have exploited different vulnerabilities, such as CVE-2025-0108, and attackers have chained multiple PAN-OS flaws to compromise devices. However, Palo Alto Networks has stated that these past incidents are separate and do not indicate a connection to the current activity involving CVE-2026-0322.
Palo Alto Networks has released patches for multiple versions of PAN-OS to address the vulnerability. Fixed releases include PAN-OS 12.2.4, 12.1.10-h2, 11.1.16-h3, and 10.2.18-h12. Additionally, specific hotfix options are available for earlier maintenance releases, and version 11.2 has received updates including 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, and 11.2.13-h3, with version 11.2.16 expected shortly after the advisory's release.
Currently, no workaround is available for CVE-2026-0322. Palo Alto Networks strongly advises administrators to apply the provided patches as soon as possible. While restricting management access to trusted internal IP addresses, ideally through a dedicated jump box, can reduce exposure, it is not a substitute for patching. The company reiterates its guidance against exposing administrative interfaces to the internet or other untrusted networks.
As indicators of compromise, Palo Alto Networks has identified specific IP addresses linked to threat activity and limited exploit attempts: 66[.]42[.]72[.]14, 208[.]83[.]239[.]114, and 149[.]248[.]47[.]234. Security teams are encouraged to review their management traffic logs for these indicators while prioritizing the upgrade process and implementing stricter access controls. The advisory cautions that attack variations might evade current signature-based detection, making a supported, fixed release the most reliable protection.
The vulnerability, CVE-2026-0322, has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, mandating that U.S. Federal Civilian Executive Branch (FCEB) agencies prioritize its remediation by October 17, 2026. Palo Alto Networks also noted that the security risk can be mitigated by restricting management interface access to trusted internal IP addresses, and has provided a comprehensive list of patched PAN-OS versions.
Palo Alto Networks has confirmed that a zero-day vulnerability in its PAN-OS software, identified as CVE-2026-0322, has been exploited in limited attacks against customer firewalls. The company has released patches to address the flaw, which allows for remote code execution, and has provided Indicators of Compromise (IoCs) to assist customers in detecting and mitigating potential compromises.