Palo Alto PAN-OS CVE-2026-0322 exploited for root access

Palo Alto Networks disclosed CVE-2026-0322 on October 14, 2026, a flaw in the PAN-OS firewall software that attackers are already using. It lets an attacker who can log in to the firewall's management interface run any code as root, the device's all-powerful administrator account. The US Cybersecurity and Infrastructure Security Agency (CISA) gave federal agencies until October 17 to fix it, and every team running these firewalls should check its version today.

PAN-OS is the operating system on Palo Alto's firewalls, the network devices that guard the edge of many company networks. The management interface is the web page and service administrators use to configure them.

What the flaw does

The bug is a code injection flaw, Palo Alto's advisory says. Code injection means an attacker slips their own commands into input that the software then runs. It "enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall," the advisory says.

It is rated 8.6 out of 10 on CVSS 4.0, the common severity scale, which counts as high. The attacker needs a valid login, so this is not an open door for anyone on the internet. BleepingComputer says attackers need existing credentials and network access to the management interface. The vendor adds that "no special configuration is required to be affected by this issue."

"Very limited exploitation has been observed targeting the Palo Alto Networks management interface," the advisory says. Palo Alto shared three IP addresses linked to the attacks, BleepingComputer reports. No one has named the attackers, said when the attacks began, or said how many customers were hit.

Which products are affected

Affected are PA-Series and VM-Series firewalls plus Panorama virtual and M-Series appliances. Panorama is the tool that manages many firewalls at once. Cloud NGFW and Prisma Access, Palo Alto's cloud services, are not affected.

The advisory lists these fixed releases. Each train has older hotfix options too, listed on the advisory page.

PAN-OS train	Upgrade to	Older hotfix options
12.2	12.2.4 or later	none listed
12.1	12.1.10-h2	12.1.7-h8, 12.1.4-h12
11.2	11.2.16	11.2.13-h3, 11.2.10-h15, 11.2.7-h21, 11.2.4-h22
11.1	11.1.16-h3	11.1.13-h15, 11.1.10-h35, 11.1.7-h11, 11.1.6-h39, 11.1.4-h37
10.2	10.2.18-h12	10.2.16-h11, 10.2.13-h26, 10.2.10-h41, 10.2.7-h38

Version 11.2.16 was published on October 15. Older unsupported releases should move to a supported fixed version, the vendor says.

No workaround, only hardening

"No known workarounds exist for this issue," the advisory states. Threat Prevention signatures with Threat IDs 510046 and 510047 give limited coverage, and only when SSL decryption is on. The advisory also suggests these steps:

• Allow management access only from trusted internal IP addresses, or from a single jump box. A jump box is one hardened machine that is the only system allowed to reach the interface.
• Route management traffic through a data port, using a management profile on that interface.
• Decrypt inbound traffic to the management interface and turn on threat prevention for it.

"The risk is highest when you allow access to the management interface from external IP addresses on the internet," the advisory says.

CISA's deadline

CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 14, CSO Online reports. The catalog lists bugs that attackers are known to be using. It set an October 17 deadline under Binding Operational Directive 26-04 and marked the flaw for forensic triage, a check for signs of a past break-in.

The bug was found inside Palo Alto by Suraj Siddharudh, a senior principal product security researcher. Palo Alto also published about a dozen other advisories that week, all rated medium or low, SecurityWeek reports. Edge devices keep drawing fire: Tech AI Wire reported an Ivanti Connect Secure zero-day chain on October 15.

What this means for developers

• Check your version against the table. Run the PAN-OS version check on every firewall and Panorama box. Anything below the listed release for its train needs the upgrade.
• Take the management interface off the internet. The vendor ties the highest risk to internet-facing access. If your interface is reachable from outside, close that first.
• Treat admin logins as the real target. The attacker needs credentials. Review who has management accounts, rotate their passwords and require a second factor where you can.
• Look for a past break-in, not only the patch. CISA flagged this bug for forensic triage. Patching stops new attacks but does not remove an intruder who got in first. Check logs for logins from Palo Alto's three listed IP addresses.
• Do not lean on signatures alone. Threat IDs 510046 and 510047 help only with SSL decryption on. They are a stopgap until the upgrade is done.