Palo Alto patches PAN-OS flaw CVE-2026-0322, already exploited
The bug gives root control of a firewall to anyone with credentials and access to its management interface. CISA set Oct. 17 as the deadline.
Palo Alto Networks warned on Oct. 14 about CVE-2026-0322, a bug in the management panel of PAN-OS, the software that runs its firewalls. It allows code to run with root permissions, the highest level, and the company confirms attacks have already happened: it says it observed "very limited" exploitation of that interface.
The same day the U.S. cybersecurity agency CISA added it to its catalog of known exploited vulnerabilities. U.S. federal civilian agencies have until Oct. 17 to mitigate it.
Exploiting it requires a valid account and network access to the management interface. Palo Alto rates it 8.6 out of 10 on CVSS 4.0, the scale that measures how severe a flaw is. It was reported by Suraj Siddharudh, a researcher at the company itself.
The four key facts
| Item | Detail |
|---|---|
| Identifier | CVE-2026-0322 |
| Product | PAN-OS, on PA-Series and VM-Series firewalls and on the Panorama console. Cloud NGFW and Prisma Access are not affected |
| Fixed versions | Branch 12.2: 12.2.4. Branch 12.1: three builds, starting at 12.1.4-h12. Branch 11.2: four, starting at 11.2.4-h22. Branch 11.1: six, and branch 10.2: five, all listed in the advisory. Later versions also work |
| Patch | Yes, on five supported branches; build 11.2.16 is still pending and the company estimates it for Oct. 15 |
Unsupported versions must migrate to a fixed one. The advisory says there is no known workaround. As a containment measure, the company recommends allowing management access only from trusted internal addresses or from a single intermediate machine (a jump box).
The people who need to act are the network administrators at companies and institutions; for end users nothing changes directly. BleepingComputer also reported the case. In May, Palo Alto fixed another exploited PAN-OS flaw, CVE-2026-0300, in the authentication portal.
It is not known who is attacking, since when, or how many devices are compromised, and there is no data on impact in Mexico. The confirmation of exploitation comes from the company itself and from CISA; there is no independent measurement of its reach.
