Palo Alto Networks has patched CVE-2026-0322, a remote code execution flaw in the PAN-OS management interface that attackers are already exploiting. The company describes the exploitation as “very limited,” and CISA added the bug to its Known Exploited Vulnerabilities catalog the same day.
CVE-2026-0322 Gives Authenticated Attackers Root Code Execution on PAN-OS
CVE-2026-0322 carries a CVSS score of 8.6. According to Palo Alto Networks, an authenticated attacker with network access to the PAN-OS management interface can run arbitrary code as root on the firewall. The flaw requires no special configuration, so any device whose management interface is reachable by an attacker holding valid credentials is exposed.
Palo Alto researcher Suraj Siddharudh found the vulnerability internally. The company has not said who is behind the exploitation or when it began.
Affected Products: PA-Series, VM-Series and Panorama
The vulnerability affects PAN-OS on PA-Series and VM-Series firewalls, and on Panorama management appliances in both virtual and M-Series form. Cloud NGFW and Prisma Access are not affected.
Three US-Geolocated IP Addresses Linked to Exploit Attempts
Palo Alto published three IP addresses tied to exploit attempts against the management interface: 66.42.72[.]14, 208.83.239[.]114 and 149.248.47[.]234. All three geolocate to the United States. The company has not described what the attackers did after gaining access.
Patched Releases Span Five PAN-OS Branches
Fixes cover the PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 branches. Examples include 12.2.4, 12.1.10-h2, 11.1.16-h3 and 10.2.18-h12. The fix for the 11.2 branch, version 11.2.16, was due on October 15, a day after the advisory.
Palo Alto says there is no known workaround. Customers with Threat Prevention subscriptions can enable Threat IDs 510046 and 510047 for limited protection. The company recommends upgrading to a fixed release, restricting management access to a trusted internal jump box, and reviewing logs for the listed IP addresses.
CISA Adds CVE-2026-0322 to KEV With a Three-Day Federal Deadline
CISA added CVE-2026-0322 to its KEV catalog on October 14 and set October 17 as the remediation deadline for federal civilian agencies, a three-day window. The catalog now lists 16 vulnerabilities in Palo Alto Networks products, three of them added this year.
Why Credentials Are the Likely Entry Point
Palo Alto rated the urgency of the flaw “Red” for management interfaces exposed to the internet, which carry the highest risk. Because the attacker needs valid credentials, stolen or weak administrator logins are the probable route in. That makes the practical exposure a combination of two conditions: a reachable management interface and a credential an attacker can obtain.
The vendor’s own guidance, which centers on limiting who can reach the interface at all, reflects that the patch removes the code execution flaw but does not change the exposure created by a management port open to the internet.
A Dozen Other Advisories Published the Same Day
Palo Alto Networks also published about a dozen other advisories on October 14, covering PAN-OS, GlobalProtect and Prisma Cloud. All are rated medium or low severity, so CVE-2026-0322 is the only one of the batch that combines active exploitation with root-level impact.
What the “Very Limited Exploitation” Statement Leaves Unanswered
The company has given no count of affected devices, no timeframe and no attribution, which leaves the scope of exploitation unverified outside Palo Alto’s own telemetry. The inclusion of the three IP addresses gives defenders a concrete search term, but a shortlist of attacker addresses typically captures only the infrastructure seen so far. Organizations that cannot rule out management-interface exposure have a reason to review historical access logs for the period before the advisory, since the company has not said when the first attempts occurred.
