Palo Alto Networks has shipped fixes for a firewall bug that was being exploited before the company named it. The flaw lives in the PAN-OS management interface and is tracked as CVE-2026-0322, rated 8.6.
An attacker who already holds credentials and can reach the management interface could execute arbitrary code with root privileges. PA-Series and VM-Series firewalls are exposed, along with Panorama. Cloud NGFW and Prisma Access are not affected. No unusual configuration is needed to exploit it.
The vendor found the bug through its own research and rated the urgency highest. “Very limited exploitation has been observed targeting the Palo Alto Networks management interface,” the advisory notes, and it lists three IP addresses tied to the attempts.
Fixed builds cover PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2. Version 11.2.16 was expected on October 15. Organisations on unsupported releases must move to a supported fixed version instead.
There are no workarounds. Palo Alto’s recommended mitigation is to restrict who can reach the management interface, allowing only trusted internal addresses.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and gave federal civilian agencies until October 17 to act. Palo Alto Networks products now account for 16 entries in that catalog, three of them added this year.
The company also published a dozen lower-severity advisories covering PAN-OS, GlobalProtect and Prisma Cloud.
