Palo Alto PAN-OS Critical 0-Day Lets Attackers Remotely Execute Code

Key Takeaways

• A critical zero-day vulnerability (CVE-2026-0322) has been discovered in Palo Alto Networks PAN-OS.
• The flaw allows authenticated attackers with high privileges to execute code with root access on affected firewalls.
• Palo Alto Networks has confirmed limited exploitation in the wild and released hotfixes across multiple PAN-OS versions.
• Affected products include PA-Series, VM-Series, and Panorama deployments; Cloud NGFW and Prisma Access are not impacted.

Palo Alto Networks Battles Critical PAN-OS 0-Day Under Active Exploitation

Palo Alto Networks is urging customers to immediately patch a severe zero-day vulnerability in its PAN-OS software, which is currently being exploited in targeted attacks. The flaw, identified as CVE-2026-0322, enables authenticated attackers to achieve root-level code execution on vulnerable firewalls. The cybersecurity giant has acknowledged “very limited exploitation” and released hotfixes to address the critical issue.

The company issued a security advisory on October 14, 2026, assigning the vulnerability a CVSS 4.0 score of 8.6, indicating high severity. Palo Alto Networks also gave it the highest possible remediation urgency. Internal researcher Suraj Siddharudh is credited with the discovery and reporting of the flaw. Details regarding the identity of the attackers or the precise number of affected organizations have not been disclosed.

Understanding the PAN-OS 0-Day Vulnerability

CVE-2026-0322 is categorized as a code injection weakness (CWE-94). Successful exploitation requires an attacker to possess authenticated access with high privileges and network connectivity to the firewall’s management interface. Upon successful compromise, the attacker gains root privileges, granting them complete control over the device. No user interaction is necessary for the exploit to succeed.

It is important to note that this attack path is not unauthenticated. The prerequisite for an existing privileged login significantly narrows the pool of potential attackers. However, management interfaces exposed to the internet represent the highest risk vector for exploitation. No specific configuration beyond a vulnerable PAN-OS installation is required for a device to be susceptible to this flaw.

The vulnerability impacts a range of Palo Alto Networks products, including PA-Series hardware firewalls, VM-Series virtual firewalls, and Panorama deployments running on virtual systems or M-Series appliances. Cloud NGFW and Prisma Access are explicitly stated as unaffected by this vulnerability, requiring no action from their users.

The management interface of PAN-OS devices has historically been a target for threat actors. Previous incidents, such as the active exploitation of CVE-2025-0108 and reports of attackers chaining multiple PAN-OS vulnerabilities, highlight the ongoing risk associated with these interfaces. However, these past events concern distinct flaws and are not linked to the current exploitation activity.

Fixed Versions and Recommended Protection Measures

Palo Alto Networks has released several hotfix versions to address CVE-2026-0322. These include PAN-OS 12.2.4, 12.1.10-h2, 11.1.16-h3, and 10.2.18-h12. Additional hotfix options are available for earlier maintenance releases. For PAN-OS 11.2, fixed versions include 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, and 11.2.13-h3, with version 11.2.16 anticipated for release on October 15. Administrators should consult the official advisory’s upgrade path to ensure proper remediation for their specific installed version.

Palo Alto Networks says no known workaround fully mitigates the vulnerability. While restricting management access to trusted internal IP addresses, ideally via a dedicated jump box, can reduce exposure, it does not replace the necessity of applying the official patches. The company’s management access guidance consistently advises against exposing administrative interfaces to the internet or other untrusted networks.

Palo Alto Networks has identified specific IP addresses associated with limited exploit attempts: 66.42.72.14, 208.83.239.114, and 149.248.47.234. Security teams can leverage these indicators when analyzing management traffic for suspicious activity.

The advisory further cautions that variations of the attack may bypass existing security signatures, underscoring that a supported, fixed release remains the most effective protection for affected systems.

What You Should Do

• Immediately Apply Patches: Prioritize upgrading to one of the fixed PAN-OS versions (12.2.4, 12.1.10-h2, 11.1.16-h3, 10.2.18-h12, or relevant 11.2.x hotfixes) as soon as possible.
• Restrict Management Interface Access: Ensure that your firewall’s management interface is not exposed to the internet. Limit access to only trusted internal IP addresses, ideally through a dedicated jump box.
• Monitor for Indicators of Compromise (IoCs): Review management traffic logs for connections originating from the identified malicious IP addresses: 66.42.72.14, 208.83.239.114, and 149.248.47.234.
• Review Access Controls: Conduct an audit of all privileged accounts with access to your PAN-OS management interfaces to ensure strong authentication and least privilege principles are enforced.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.