Palo Alto Networks Patches Actively Exploited PAN-OS Vulnerability Allowing Root-Level Code Execution

Palo Alto Networks has released security updates for a high-severity vulnerability in its PAN-OS software that is being actively exploited. Tracked as CVE-2026-0322, the flaw carries a CVSS score of 8.6 and could allow an authenticated attacker with network access to execute arbitrary code with root privileges on affected firewalls.

The vulnerability affects the management interface of PAN-OS, the operating system used by Palo Alto Networks security appliances. According to the company's security advisory, exploitation does not require any special configuration.

Affected Products and Vulnerability Details

CVE-2026-0322 is a remote code execution vulnerability in the PAN-OS management interface. An attacker who has valid authentication and network access to the interface could exploit the flaw to execute commands with root-level privileges on the firewall.

The vulnerability affects:

  • PA-Series firewalls
  • VM-Series firewalls
  • Panorama appliances, including virtual and M-Series deployments

Cloud NGFW and Prisma Access are not affected.

Palo Alto Networks has acknowledged observing very limited exploitation attempts targeting its management interface. However, the company has not disclosed further details about the attackers, the nature of the activity, or when the exploitation began.

The company credited Suraj Siddharudh, a senior principal product security researcher at Palo Alto Networks, with discovering and reporting the vulnerability.

Security Updates Available

Palo Alto Networks has released fixes across multiple supported PAN-OS branches. Administrators should consult the official advisory to identify the appropriate release for their specific deployment.

The patched versions listed in the advisory include:

  • PAN-OS 12.2: 12.2.4 or later.
  • PAN-OS 12.1: 12.1.4-h12, 12.1.7-h8, or 12.1.10-h2 and later within the respective release branches.
  • PAN-OS 11.2: 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, or 11.2.16 and later within the respective release branches. Version 11.2.16 was listed with an expected availability date of October 15, 2026.
  • PAN-OS 11.1: 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, or 11.1.16-h3 and later within the respective release branches.
  • PAN-OS 10.2: 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, or 10.2.18-h12 and later within the respective release branches.

Administrators should verify the exact fixed version applicable to their software branch before scheduling an upgrade.

Palo Alto Networks recommends restricting access to the management interface to trusted internal IP addresses to reduce the risk of exploitation.

Organizations can further limit exposure by configuring a dedicated jump host as the only system permitted to access the management interface. This approach reduces the number of systems that can reach the vulnerable component.

Because exploitation has already been observed, organizations should prioritize applying the relevant security updates, reviewing management-interface access controls, and investigating suspicious activity involving their firewall appliances.

CISA Adds the Vulnerability to Its Known Exploited Vulnerabilities Catalog

The disclosure coincides with a separate warning from Cisco regarding active exploitation of a critical vulnerability in Cisco Secure Email Gateway.

Tracked as CVE-2026-76519, the Cisco flaw carries a CVSS score of 9.8 and could allow an unauthenticated remote attacker to write arbitrary files to the underlying operating system and execute commands with root privileges.

The vulnerability results from improper handling of email attachments when the file reputation service is enabled. An attacker could exploit it by sending an email containing a specially crafted attachment through an affected device.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added both CVE-2026-0322 and CVE-2026-76519 to its Known Exploited Vulnerabilities (KEV) catalog. Federal Civilian Executive Branch agencies have been directed to prioritize remediation by October 17, 2026.

The inclusion of both vulnerabilities in the catalog highlights the need for organizations using Palo Alto Networks firewalls or Cisco Secure Email Gateway appliances to identify affected systems and apply the appropriate fixes promptly.