16 OCT 2026 — Palo Alto Networks has patched a firewall software flaw after finding it was already being used in attacks. The bug, CVE-2026-0322, lets an attacker who can log in to a firewall's management interface run code on it as root. The company's advisory, published on 14 October, says "very limited exploitation has been observed".
The US Cybersecurity and Infrastructure Security Agency added the flaw to its catalogue of exploited vulnerabilities the same day and gave federal civilian agencies until 17 October to fix it. That is the third PAN-OS flaw to enter the catalogue this year.
What the flaw does
The vulnerability is a code injection bug in the management interface of PAN-OS, the operating system on Palo Alto's PA-Series and VM-Series firewalls and its Panorama management appliances. An attacker who already has administrator-level credentials and can reach that interface over the network can execute arbitrary code with root privileges. Palo Alto's cloud firewall service and Prisma Access are not affected.
The severity score is 8.6, not critical, because the attacker needs admin credentials. That does not make the flaw harmless. Stolen or reused admin passwords are common, and root on a firewall gives an attacker control of the device that sits between an organisation and the internet. Palo Alto says no special configuration is needed to be exposed and that no workaround exists.
What is known about the attacks
Public detail is thin. Palo Alto found the bug itself, crediting one of its own researchers, and published three IP addresses linked to exploit attempts. BleepingComputer asked the company when exploitation began, who was behind it and whether any firewalls were used to reach internal networks. The answers have not been published.
That leaves defenders with a familiar gap. A vendor's "very limited" describes what it has seen, not what has happened, and it does not tell an organisation whether its own device was one of the targets.
A pattern on the management interface
PAN-OS has been a steady target this year. In May, RECATOOLS reported on CVE-2026-0300, a zero-day exploited by a state-sponsored group, and later that month on CVE-2026-0257, an authentication bypass. In September we covered CVE-2026-0310, another root-level flaw with no workaround. The same week as this advisory, Ivanti disclosed a chain of three zero-days in its VPN appliances.
Palo Alto's own guidance puts the common thread plainly. The risk, it says, is "highest when you allow access to the management interface from external IP addresses on the internet". A management page that can be reached from anywhere turns every stolen admin password into a potential foothold.
What to do
Fixed releases are available for PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2. The advisory lists the exact hotfix for each branch, and it is long, so administrators should check it against the version they run rather than assume a minor update is enough. Older, unsupported versions need to move to a supported release.
Until the patch is on
Until patched, the main defence is to restrict the management interface to trusted internal addresses, ideally a single jump host. Customers with Palo Alto's Threat Prevention subscription can enable two signatures that give what the company calls "limited coverage", but only if management traffic is routed and decrypted so the firewall can inspect it. Organisations that have exposed the interface should also review admin accounts and logins, because the flaw rewards anyone who already holds a valid password.
View author profile → · Editorial policy
