Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited to attack firewalls.
The vulnerability affects the PAN-OS management interface and allows authenticated attackers with network access to execute code as root on vulnerable devices.
Palo Alto Networks confirmed in a safety notice announced on Wednesday that there had been limited exploitation of the vulnerability in attacks.
“Very limited attacks were observed on the Palo Alto Networks management interface,” the company said.
The vulnerability has a severity of 8.6 and affects PA-Series and VM-Series firewalls, as well as Panorama and M-Series virtual appliances. According to Palo Alto, Cloud NGFW and Prisma Access are not affected.
To exploit the vulnerability, attackers would need existing credentials and network access to the PAN-OS management interface.
Therefore, Palo Alto Networks recommends limiting access to the management interface to only trusted internal IP addresses.
The company has released fixes for affected versions PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2, with a fix for PAN-OS 11.2.16 expected on October 15.
Customers using older, unsupported versions must upgrade to a supported version.
Palo Alto said there are no known workarounds for the vulnerability, but customers with Threat Prevention subscriptions can enable signatures that provide limited protection against known attack patterns.
“Limited threat prevention coverage means that while known attack patterns can be identified using current threat ID, there may also be variations that cannot currently be detected,” warns Palo Alto.
“If this CVE and the required exposure configuration impact your environment, we recommend upgrading to an unaffected version.”
The vulnerability was discovered internally by Suraj Siddharudh, a senior product security researcher at Palo Alto Networks.
The company also shared three IP addresses that exploited the flaw: 66.42.72(.)14, 208.83.239(.)114, and 149.248.47(.)234.
BleepingComputer contacted Palo Alto Networks to learn when the exploitation began, who was behind the attacks, and whether attackers compromised firewalls or accessed internal networks through them.
The US Cybersecurity and Infrastructure Security Agency (CISA) has now added CVE-2026-0322 to the list Catalog of known exploited vulnerabilities and requires federal civilian agencies to mitigate the vulnerability by October 17.
