Palo Alto Networks patches exploited PAN-OS zero-day

Palo Alto Networks disclosed and patched a zero-day remote code execution vulnerability in PAN-OS on October 14, 2026. The flaw, CVE-2026-0322, is being actively exploited, though Palo Alto Networks said it has observed "very limited exploitation" against the management interface. Someone who already holds valid credentials and can reach the management interface over the network is able to execute code as root on that firewall.

PAN-OS on PA-Series and VM-Series firewalls, plus Panorama virtual and M-Series appliances, is vulnerable. Cloud NGFW and Prisma Access are outside the affected set. No special configuration is required for exploitation. Palo Alto Networks said the issue was discovered internally and credited a senior principal product security researcher, Suraj Siddharudh.

Palo Alto Networks released patches for multiple branches on October 14. Systems are affected until they reach these releases: 12.2.4 for the 12.2 branch, 12.1.10-h2 for 12.1, 11.2.16 for 11.2, 11.1.16-h3 for 11.1, and 10.2.18-h12 for 10.2. The vendor said a patch for 11.2.16 would be available on October 15. If an installation is on an unsupported release, moving to a supported version is required.

There is no workaround for the vulnerability. The vendor advises that administrators limit management interface access to trusted internal addresses, preferably through a jump box. The company also said Threat Prevention subscriptions can provide limited coverage against known attack patterns, but variations may evade detection.

Palo Alto Networks published three IP addresses tied to the exploitation attempts: 66.42.72[.]14, 208.83.239[.]114, and 149.248.47[.]234. The vendor has not named a threat actor, described the attacks, or said when exploitation began.

On October 14, the U.S. Cybersecurity and Infrastructure Security Agency placed CVE-2026-0322 on its Known Exploited Vulnerabilities list and directed federal civilian agencies to remediate by October 17. The Canadian Centre for Cyber Security issued a parallel advisory.

A root-level compromise of a firewall is particularly dangerous because the device sits inline on traffic and can be used to disable logging, redirect connections, or extract credentials. Tech Insider reported that security teams treat a quick CISA KEV addition as a signal to patch immediately, even outside federal obligations.

Administrators should catalogue every PAN-OS, Panorama, PA-Series, and VM-Series device, patch internet-facing units first, restrict management interface exposure, and check authentication logs for anomalous administrative activity. The only complete fix is to upgrade to a patched release.