Palo Alto Networks patches exploited PAN-OS management RCE

Palo Alto Networks has released security updates for CVE-2026-0322, a high-severity remote code execution vulnerability in the PAN-OS management interface that the company says is under active exploitation. The flaw has a CVSS score of 8.6 and can allow an authenticated attacker with network access to execute arbitrary code with root privileges on an affected firewall.

The issue affects PAN-OS deployments on PA-Series and VM-Series firewalls, as well as Panorama virtual and M-Series appliances. Palo Alto Networks said Cloud NGFW and Prisma Access are not affected. The company credited Suraj Siddharudh, senior principal product security researcher at Palo Alto Networks, with discovering and reporting the vulnerability.

Management-plane access is the exposure point

Palo Alto Networks said no special configuration is needed to exploit CVE-2026-0322. The condition is therefore especially relevant where an attacker can authenticate to, and reach, the management interface. The company has observed what it described as “very limited exploitation” targeting that interface, without disclosing the activity’s timing, operators or techniques.

The vendor identified three IP addresses geolocated in the United States as assessed to be associated with exploit attempts: 66.42.72[.]14, 208.83.239[.]114 and 149.248.47[.]234. Those indicators may assist investigation, but patching and limiting management-plane reachability remain the remediation measures described by the vendor.

The wider pattern of exposed administration services is also reflected in PAN-OS RCE and related attack methods, where PAN-OS remote code execution featured alongside other security issues requiring prompt operational review.

Fixed PAN-OS versions are available

Patches are available in PAN-OS 12.2.4 and later; 12.1.4-h12, 12.1.7-h8 and 12.1.10-h2; and multiple maintained 11.2, 11.1 and 10.2 releases. The listed 11.2 builds include 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3 and 11.2.16, which was scheduled for October 15, 2026.

For PAN-OS 11.1, the fixed builds include 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15 and 11.1.16-h3. For PAN-OS 10.2, the vendor lists 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11 and 10.2.18-h12.

Priorities for security teams

Palo Alto Networks recommends restricting management-interface access to trusted internal IP addresses. It also advises using a jump box as the only system permitted to access the interface, reducing the systems from which exploitation can be attempted.

The U.S. Cybersecurity and Infrastructure Security Agency has added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog alongside Cisco Secure Email Gateway flaw CVE-2026-76519. Federal Civilian Executive Branch agencies must prioritize fixes for both issues by October 17, 2026. Organisations using affected PAN-OS platforms should inventory management-plane exposure, move to an applicable fixed release, and enforce the vendor’s access restrictions as a practical business priority.