Palo Alto Networks patches actively exploited PAN-OS flaw giving authenticated attackers root code execution on firewalls

Palo Alto Networks patched CVE-2026-0322, a remote code execution flaw rated 8.6 in the PAN-OS management interface that lets an authenticated attacker with network access run code with root privileges on the firewall. It affects PA-Series and VM-Series firewalls and Panorama, while Cloud NGFW and Prisma Access are not affected, and no special configuration is required to exploit it. Palo Alto reports very limited exploitation, and CISA added the flaw to its Known Exploited Vulnerabilities catalog with a federal patch deadline of October 17. Fixed builds are available across the 10.2, 11.1, 11.2, 12.1, and 12.2 branches.

Check

Upgrade PAN-OS on affected firewalls and Panorama to the fixed build for your branch now, and restrict management interface access to trusted internal IPs or a jump box.

Affected

PAN-OS firewalls and Panorama on affected versions let an authenticated attacker with network access to the management interface run code as root, and limited exploitation is occurring.

Fix

Apply the fixed PAN-OS releases, limit management interface exposure, and meet the CISA October 17 deadline, reviewing firewalls for signs of unauthorized code execution.