Palo Alto Networks Patches PAN-OS Zero-Day Used in Remote Code Execution Attacks

Palo Alto Networks released patches on Wednesday for a zero-day vulnerability in its PAN-OS software that is currently being exploited in malicious attacks. The company stated that it has observed very limited exploitation targeting the management interface of its firewalls.

The high-severity flaw, tracked as CVE-2026-0322, allows an authenticated attacker with network access to execute arbitrary code with root privileges. Palo Alto Networks discovered the vulnerability internally and confirmed that no special configuration is required to exploit it.

Context and Background

The cybersecurity vendor made indicators of compromise available to customers, specifically sharing a few IP addresses associated with the observed malicious activity. No further details regarding the attacks or the threat actor responsible have been disclosed by the company.

CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog on Wednesday. The agency instructed federal agencies to address the issue by October 17. The KEV catalog now contains 16 Palo Alto Networks product vulnerabilities, including three added this year.

Who Is Affected

The vulnerability affects PAN-OS software running on PA-Series and VM-Series firewalls, as well as Panorama management appliances. On the same day, Palo Alto Networks published a dozen other advisories covering vulnerabilities in PAN-OS, GlobalProtect, and Prisma Cloud.

These additional flaws include denial-of-service, command injection, identity hijacking, local privilege escalation, cross-site scripting, and path traversal issues. All of these secondary vulnerabilities have been rated medium or low severity.

What should you do?

Palo Alto Networks updated its Prisma Browser to include the latest Chromium updates alongside these security advisories. The company emphasized that the zero-day requires authentication, but the root-level access it grants makes patching urgent.

Users should verify their PAN-OS versions against the vendor’s release notes to determine if they are running affected software. Monitoring for the released indicators of compromise can help detect ongoing attempts to exploit the management interface.

What to do and how to stay safe: Palo Alto Networks

• Verify your PAN-OS version and apply the latest security update provided by Palo Alto Networks to address CVE-2026-0322.
• Review firewall logs for connections from the IP addresses identified in the vendor’s indicators of compromise.
• Ensure that management interfaces are restricted to trusted networks and that authentication credentials are strong and unique.
• Monitor for any unusual administrative activity or code execution attempts on PA-Series, VM-Series, and Panorama systems.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-0322?

CVE-2026-0322 is a high-severity zero-day vulnerability in Palo Alto Networks’ PAN-OS that allows authenticated attackers to execute remote code with root privileges.

Which Palo Alto products are affected?

The flaw affects PAN-OS software on PA-Series and VM-Series firewalls, as well as Panorama management appliances.

Has this vulnerability been exploited in the wild?

Yes, Palo Alto Networks confirmed that very limited exploitation has been observed targeting the management interface of its firewalls.