Palo Alto Networks has disclosed CVE-2026-0322, a remote code execution flaw in the PAN-OS management interface, and says it is already being exploited. BleepingComputer reported the advisory on October 14.
The flaw is rated CVSS 8.6. An attacker with valid credentials and network access to the management interface can execute code as root. Palo Alto describes the exploitation it has seen as "very limited". It has not said when exploitation began, who is behind it, or whether any firewalls were used for lateral movement.
Affected products are PA-Series and VM-Series firewalls, plus Panorama virtual and M-Series appliances, on PAN-OS branches 10.2, 11.1, 11.2, 12.1 and 12.2. Cloud NGFW and Prisma Access are not affected. A fixed 11.2.16 build was expected on October 15. Customers on older, unsupported versions must upgrade to a supported release.
CISA has added the flaw to its Known Exploited Vulnerabilities catalog. Federal civilian agencies must mitigate by October 17, 2026.
Why it matters: the credential requirement lowers the bar less than an unauthenticated bug would. It does not remove the risk. Management interfaces exposed to untrusted networks, and any credentials that have leaked or been reused, turn this into a path to root on the device that enforces your perimeter.
Palo Alto published three indicator IP addresses: 66.42.72[.]14, 208.83.239[.]114 and 149.248.47[.]234.
Mitigation:
Restrict management interface access to trusted internal IP addresses. This is Palo Alto's primary guidance, and it lists no other workarounds.
Apply the fixed PAN-OS release as soon as it is available for your branch.
Threat Prevention signatures offer limited protection against known attack patterns. Variants may not be detected, so do not treat them as a substitute for patching.
Search management-plane logs and firewall access logs for the three indicator IPs, and review admin account activity for logins you cannot explain. Rotate administrator credentials on any appliance whose management interface was reachable from outside trusted networks.
