CISA Warns: Critical Palo Alto PAN-OS Flaw Exploited in Attacks

Key Takeaways

• The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed active exploitation of a high-severity vulnerability in Palo Alto Networks PAN-OS.
• The flaw, CVE-2026-0322, allows authenticated attackers to achieve root-level remote code execution on affected firewall management interfaces.
• Impacted products include PA-Series and VM-Series firewalls, Panorama virtual appliances, and M-Series appliances. Cloud NGFW and Prisma Access are not affected.
• Palo Alto Networks has released patches across multiple PAN-OS versions, and CISA has mandated federal agencies to apply mitigations by October 17.
• Organizations must prioritize patching and conduct forensic analysis for signs of compromise, as no complete workaround is available.

CISA Confirms Exploitation of Critical Palo Alto PAN-OS Flaw

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical warning regarding a high-severity vulnerability in Palo Alto Networks’ PAN-OS. The flaw, tracked as CVE-2026-0322, has been added to CISA’s Known Exploited Vulnerabilities catalog, indicating its active exploitation in real-world attacks.

This vulnerability resides within the PAN-OS management interface, posing a significant risk. An authenticated attacker who gains network access to this interface could execute arbitrary code with root privileges on the compromised firewall. This level of access grants deep control over a critical network security device.

Technical Details of CVE-2026-0322

Palo Alto Networks initially disclosed the issue on October 14, describing it as an authenticated remote code execution vulnerability. The company assigned CVE-2026-0322 a CVSS 4.0 score of 8.6, highlighting its severe impact. Despite requiring valid credentials and network access to the management interface, a successful exploit could allow an intruder to bypass network defenses and gain control over an organization’s perimeter.

The vulnerability is categorized as CWE-94, or improper control of code generation/code injection. This classification means the system fails to properly sanitize or validate user input, allowing an attacker to inject and execute malicious code. The primary risk factor is the exposure of the firewall’s management interface to untrusted networks or the public internet, which significantly increases the attack surface.

Palo Alto Networks has confirmed observing limited exploitation attempts targeting this vulnerability.

CISA Mandates Action for Federal Agencies

CISA’s inclusion of CVE-2026-0322 in the KEV catalog on October 14 came with a strict directive for U.S. federal civilian agencies: implement mitigation measures by October 17. Furthermore, CISA has mandated forensic triage under Binding Operational Directive 26-04. This directive emphasizes that simply patching is insufficient; organizations must also actively investigate their devices for any signs of unauthorized access, both before and after applying remediation.

The vulnerability impacts PAN-OS versions running on PA-Series and VM-Series firewalls, as well as Panorama virtual appliances and M-Series appliances. Palo Alto Networks has clarified that its Cloud NGFW and Prisma Access services are not affected by this flaw.

Available Patches and Mitigation Strategies

Palo Alto Networks has released patches across several PAN-OS branches, including 10.2, 11.1, 11.2, 12.1, and 12.2. The specific recommended upgrade version depends on the currently deployed maintenance line. For instance, customers running PAN-OS 12.2 should upgrade to version 12.2.4 or later. Similarly, users on PAN-OS 11.2.14 through 11.2.15 are advised to update to 11.2.16 or newer. Organizations currently on unsupported PAN-OS releases must transition to a supported, fixed version. Administrators are urged to consult the official Palo Alto Networks advisory for precise upgrade paths, particularly in high-availability environments and for Panorama-managed devices.

While no complete workaround exists for CVE-2026-0322, Palo Alto Networks strongly recommends restricting access to the management interface to trusted internal IP addresses, ideally through a hardened jump box. Any internet exposure of firewall administration portals should be eliminated. Additionally, organizations utilizing Threat Prevention can enable Threat IDs 510046 and 510047, although the vendor notes this coverage is limited and requires SSL decryption for inbound management traffic.

Palo Alto Networks has also provided three IP addresses linked to observed exploit attempts: 66[.]42[.]72[.]14, 208[.]83[.]239[.]114, and 149[.]248[.]47[.]234. Security teams should proactively review logs for activity involving these indicators of compromise.

What You Should Do

• Patch Immediately: Identify all PAN-OS management systems and upgrade to the latest patched versions provided by Palo Alto Networks. Consult the official vendor advisory for precise version recommendations.
• Restrict Management Interface Access: Limit access to PAN-OS management interfaces to only trusted internal IP addresses. Eliminate any internet exposure of these interfaces.
• Enable Threat Prevention: If applicable, enable Threat IDs 510046 and 510047 in Threat Prevention, understanding its limitations and the requirement for SSL decryption.
• Conduct Forensic Analysis: Actively search for signs of compromise, including unfamiliar administrator accounts, unexpected configuration changes, suspicious login attempts (both failed and successful), and unusual outbound connections from firewall management systems. Review firewall, VPN, authentication, and management-plane logs for activity involving the provided malicious IP addresses.
• Review Official Advisories: Always refer to the latest security advisories from Palo Alto Networks and CISA for the most current information and detailed instructions.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.