Palo Alto Networks Patches Critical PAN-OS Zero-Day Under Active Exploitation
Palo Alto Networks has issued patches for CVE-2026-0322, a high-severity authenticated remote code execution flaw in PAN-OS software that is under active exploitation. CISA added the vulnerability to its KEV catalog, requiring federal agencies to apply fixes by October 17, 2026.
Palo Alto Networks has released security updates for a critical zero-day vulnerability in its PAN-OS software, tracked as CVE-2026-0322. This high-severity flaw allows an authenticated attacker with network access to the management interface to execute arbitrary code with root privileges on vulnerable devices.
The vulnerability is a remote code execution flaw in the PAN-OS management interface. Exploitation requires existing credentials and network access. No special configuration is needed for a successful attack. The issue impacts PAN-OS software running on PA-Series and VM-Series firewalls and on Panorama appliances, both virtual and M-Series. Palo Alto Networks confirmed that its Cloud NGFW and Prisma Access services are not affected.
CISA adds vulnerability to KEV catalog amid observed exploitation
CISA has added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog. This action followed confirmation from Palo Alto Networks of "very limited exploitation" targeting the management interface in the wild. The agency also added a separate vulnerability, CVE-2026-76519, to the KEV list.
Palo Alto Networks shared three IP addresses observed exploiting the flaw: 66.42.72[.]14, 208.83.239[.]114, and 149.248.47[.]234. The company did not elaborate on the nature of the malicious activity, the identity of the threat actors, or when the exploitation began. CISA’s KEV catalog now includes 16 vulnerabilities affecting Palo Alto Networks products.
Patches released across multiple PAN-OS versions with mitigation guidance
Palo Alto Networks issued security updates on Wednesday for affected PAN-OS versions: 10.2, 11.1, 11.2, 12.1, and 12.2. The patches are available in specific maintenance releases. A fix for PAN-OS 11.2.16 is expected on October 15, 2026.
| PAN-OS Version | Patched Versions |
|---|---|
| 12.2 | >= 12.2.4 |
| 12.1 | >= 12.1.4-h12, >= 12.1.7-h8, >= 12.1.10-h2 |
| 11.2 | >= 11.2.4-h22, >= 11.2.7-h21, >= 11.2.10-h15, >= 11.2.13-h3, >= 11.2.16 (ETA: Oct 15, 2026) |
| 11.1 | >= 11.1.4-h37, >= 11.1.6-h39, >= 11.1.7-h11, >= 11.1.10-h35, >= 11.1.13-h15, >= 11.1.16-h3 |
| 10.2 | >= 10.2.7-h38, >= 10.2.10-h41, >= 10.2.13-h26, >= 10.2.16-h11, >= 10.2.18-h12 |
For administrators unable to apply patches immediately, the vendor recommends restricting access to the management interface to trusted internal IP addresses only. "You can reduce the risk of exploitation by restricting access to a jump box that is the only system allowed to access the management interface," Palo Alto Networks said.
Federal agencies directed to mitigate by October 17, 2026
CISA has mandated that all Federal Civilian Executive Branch agencies apply the provided patches or other mitigations for CVE-2026-0322 by October 17, 2026. This directive is binding under the agency's KEV catalog procedures, which require urgent action on vulnerabilities known to be exploited in attacks.
The vulnerability was discovered and reported internally by Suraj Siddharudh, a senior principal product security researcher at Palo Alto Networks. It carries a CVSS score of 8.6. Customers running older, unsupported PAN-OS versions must upgrade to a supported release to mitigate the vulnerability.
