PAN-OS zero-day CVE-2026-0322 exploited to gain root
Palo Alto Networks has patched a high-severity remote code execution flaw in PAN-OS that attackers have already exploited against its firewalls. The bug is tracked as CVE-2026-0322 and sits in the PAN-OS management interface.
An attacker who is authenticated and has network access to that interface can run code as root on a vulnerable device. In an advisory published Wednesday, the company confirmed that it has seen the flaw used in a small number of attacks.
"Very limited exploitation has been observed targeting the Palo Alto Networks management interface," the vendor said.
Affected products and fixed versions
The flaw has a severity score of 8.6. It affects PA-Series and VM-Series firewalls, along with Panorama virtual and M-Series appliances. Panorama is the company's central management platform for its firewalls. Palo Alto says Cloud NGFW and Prisma Access are not affected.
Fixes are out for affected releases of PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2. A fix for PAN-OS 11.2.16 is expected on October 15. Customers still on older, unsupported versions need to move to a supported release to get protection.
The vulnerability was found internally by Suraj Siddharudh, a senior principal product security researcher at Palo Alto Networks.
Credentials and access required
The attack is not open to anyone on the internet. An attacker needs valid credentials and network access to the PAN-OS management interface. For this reason, Palo Alto advises customers to allow access to that interface only from trusted internal IP addresses.
There are no known workarounds. Customers with a Threat Prevention subscription can turn on signatures that offer some protection against known attack patterns, but the company is clear that this coverage has gaps.
"Limited coverage in Threat Prevention means that while known attack patterns can be identified using the current Threat ID, variations may exist that cannot currently be detected," Palo Alto warned.
"If this CVE and Required Configuration for Exposure impact your environment, we recommend upgrading to an unaffected version," the company added.
Attacker IP addresses and CISA deadline
Palo Alto shared three IP addresses linked to exploitation of the flaw:
- 66.42.72[.]14
- 208.83.239[.]114
- 149.248.47[.]234
Several key questions remain open. BleepingComputer has asked the company when exploitation began, who is behind the attacks, and whether the attackers compromised firewalls or used them to reach internal networks.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-0322 to its Known Exploited Vulnerabilities (KEV) catalog. The KEV catalog lists flaws that are confirmed to be under active attack, and inclusion triggers binding deadlines for U.S. federal civilian agencies. In this case, agencies must mitigate the flaw by October 17, giving them only a few days.
Our Take
The requirement for valid credentials may make this flaw look less urgent, but defenders should be careful with that reading. Attackers often get credentials through phishing, reuse of leaked passwords or earlier breaches, and the confirmed exploitation suggests at least some of them had what they needed. Root access on a firewall is about as valuable a foothold as an attacker can get.
The case also fits a wider pattern. Edge and network appliances keep showing up in exploited zero-day reports, as seen recently with the Cisco Secure Email Gateway zero-day, the Citrix NetScaler SAML flaw and attacks on SonicWall SMA1000 devices. Management interfaces exposed beyond trusted networks remain a recurring weak point.
Admins should patch, lock down management access and check logs for the published IP addresses. It is worth watching whether Palo Alto shares more about who is behind the attacks and whether internal networks were reached.