Palo Alto confirms exploitation of CVE-2026-0322, a PAN-OS management flaw that grants root
Palo Alto Networks patched CVE-2026-0322 (CVSS 8.6), a PAN-OS management RCE it says is under limited exploitation. CISA gave federal agencies until October 17; exploiting it takes a valid login and network access to the management interface.
The Watch · Security desk
PAN-OS on PA-Series, VM-Series and Panorama is affected; Cloud NGFW and Prisma Access are not. CISA gives federal civilian agencies until October 17, 2026. The 11.2.16 fix arrives October 15, 2 days earlier. Unsupported versions must upgrade. Threat Prevention gives limited protection.
- Who's exposed exposure PA-Series, VM-Series, Panorama PAN-OS on these firewalls and Panorama appliances is affected; Cloud NGFW and Prisma Access are not, claim 11
- What it limits constraint Federal civilian agencies CISA requires them to mitigate CVE-2026-0322 by October 17, 2026, claim 17
- What it limits constraint PAN-OS 11.2.16 users The 11.2.16 fix arrives October 15, 2 days before the CISA deadline of October 17, claim 20
- What it limits constraint Customers on unsupported versions Must upgrade to a supported release, Palo Alto says, claim 19
- What's now possible capability Threat Prevention subscribers Can enable signatures that give limited protection against known attack patterns, per Palo Alto, claim 9
| Who | How | Kind | Claim |
|---|---|---|---|
| PA-Series, VM-Series, Panorama | PAN-OS on these firewalls and Panorama appliances is affected; Cloud NGFW and Prisma Access are not | exposure | 11 |
| Federal civilian agencies | CISA requires them to mitigate CVE-2026-0322 by October 17, 2026 | constraint | 17 |
| PAN-OS 11.2.16 users | The 11.2.16 fix arrives October 15, 2 days before the CISA deadline of October 17 | constraint | 20 |
| Customers on unsupported versions | Must upgrade to a supported release, Palo Alto says | constraint | 19 |
| Threat Prevention subscribers | Can enable signatures that give limited protection against known attack patterns, per Palo Alto | capability | 9 |
What happened
- The flaw affects PAN-OS on PA-Series and VM-Series firewalls and on Panorama virtual and M-Series appliances; Cloud NGFW and Prisma Access are not affected.
- Palo Alto listed three US-geolocated addresses tied to the exploit attempts: 66.42.72[.]14, 208.83.239[.]114 and 149.248.47[.]234.
- Fixes exist for the 10.2, 11.1, 11.2, 12.1 and 12.2 trains, and the 11.2.16 build is not due until October 15.
- Palo Alto says there are no known workarounds, so the upgrade is the only complete fix.
Why it matters
- Who's exposed exposure Exposure follows reachability: any affected device whose management interface answers to untrusted networks is a target for anyone who holds a login.
- Who has to decide decision Palo Alto has not said when exploitation began, so responders must pick how far back to search management logs for the three addresses. In our view, well before the advisory date.
- What it costs cost Operators on unsupported releases must migrate to a supported release before they can close the flaw.
Next story · Security · 10h ago
CISA adds Atlassian Data Center flaw CVE-2026-21589 to its exploited-vulnerabilities listConfirmed2 publishers
The record is thinnest on what responders need first. Palo Alto did not elaborate on the nature of the activity, who is behind it, or when it began [6]. BleepingComputer put those questions to the company and added one more: whether attackers compromised firewalls or used them to reach internal networks [13]. BleepingComputer calls the flaw a zero-day [7]. Palo Alto says its own researcher, Suraj Siddharudh, found it [18].
What is public is the vendor's statement and three addresses. "Very limited exploitation has been observed targeting the Palo Alto Networks management interface," the company said [5]. That is not enough to tell a one-off exploit from a sustained campaign.
Palo Alto says no special configuration is required to exploit the flaw [12]. The gate is a login plus a route to the interface [3]. The company's mitigation works on the route. "You can reduce the risk of exploitation by restricting access to a jump box that is the only system allowed to access the management interface," it said [4]. The verb is reduce. A jump box concentrates the path, so in our view its credentials and logs need the attention the firewall's management port used to get.
Signatures cover part of the gap. Customers with a Threat Prevention subscription can enable them [9]. Palo Alto warned: "Limited coverage in Threat Prevention means that while known attack patterns can be identified using the current Threat ID, variations may exist that cannot currently be detected," [10].
The dates are tight on one branch. The 11.2.16 fix is due October 15 [16] and CISA's deadline for federal civilian agencies is October 17 [17], a gap of two days [20]. The remaining listed builds are available now [15].
What to watch
- Whether Palo Alto or CISA discloses when exploitation began and what attackers did after getting root.
- Whether the PAN-OS 11.2.16 build ships on October 15, two days ahead of the CISA deadline.
- Whether Palo Alto adds addresses to its list of three or widens Threat Prevention coverage.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence80
Perspective Coverage
5 publishers- Builder
- Builder 8%
- Operator
- Operator 80%
- Investor
- Investor 12%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Palo Alto Networks issued security updates on Wednesday for CVE-2026-0322 (CVSS 8.6), a remote code execution flaw in the PAN-OS management interface that has come under active exploitation.
- [2]
Palo Alto says the flaw enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
- [3]
To exploit the vulnerability, attackers need existing credentials and network access to the PAN-OS management interface.
- [4]
"You can reduce the risk of exploitation by restricting access to a jump box that is the only system allowed to access the management interface," Palo Alto Networks said.
- [5]
"Very limited exploitation has been observed targeting the Palo Alto Networks management interface," Palo Alto Networks said.
- [6]
Palo Alto Networks did not elaborate on the nature of the malicious activity, who is behind it, or when it began.
- [7]
BleepingComputer describes CVE-2026-0322 as a PAN-OS RCE zero-day.
- [8]
Palo Alto says there are no known workarounds for the vulnerability.
- [9]
Customers with Threat Prevention subscriptions can enable signatures that provide limited protection against known attack patterns.
- [10]
"Limited coverage in Threat Prevention means that while known attack patterns can be identified using the current Threat ID, variations may exist that cannot currently be detected," Palo Alto warned.
- [11]
The issue affects PAN-OS on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma Access are not affected.
- [12]
Palo Alto said no special configuration is required to exploit the issue.
- [13]
BleepingComputer contacted Palo Alto to ask when exploitation began, who is behind the attacks, and whether attackers compromised firewalls or used them to access internal networks.
- [14]
Palo Alto assessed three IP addresses geolocated to the U.S. as linked to the exploit attempts: 66.42.72[.]14, 208.83.239[.]114 and 149.248.47[.]234.
- [15]
Palo Alto released fixes for affected PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 versions.
- [16]
The fix for PAN-OS 11.2.16 is expected on October 15, 2026.
- [17]
CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog and requires federal civilian agencies to mitigate it by October 17, 2026.
- [18]
The vulnerability was discovered internally by Suraj Siddharudh, a senior principal product security researcher at Palo Alto Networks.
- [19]
Customers running older, unsupported versions must upgrade to a supported release.
- [20]
The PAN-OS 11.2.16 fix (October 15) arrives 2 days before the CISA deadline (October 17).
Sources
5 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comPalo Alto Networks warns of PAN-OS RCE flaw exploited in attacks
1 article · October 14, 2026
- dev.toPAN-OS CVE-2026-0322: Authenticated Code Injection in Management Interface Leads to Root Privileges
1 article · October 16, 2026
- CVE-2026-0322
security.paloaltonetworks.com
1 article · October 15, 2026
- securityweek.comPalo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution
1 article · October 14, 2026
- thehackernews.comPalo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation
1 article · October 14, 2026
Topics and entities
Topics
- Network Security
- Known Exploited Vulnerabilities catalog
- Vulnerability Management