CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities (KEV) catalogue on 14 October 2026. The vulnerability affects Palo Alto Networks PAN-OS and could let an authenticated attacker with network access execute arbitrary code as root on a firewall.
CVE-2026-0322 is a code injection vulnerability with a CVSS score of 8.6, rated HIGH. The stated attack vector requires network access and authentication; successful exploitation could give an attacker root privileges on the affected firewall. Patch status is unknown in the available data. Palo Alto Networks’ vulnerability information is available at https://security.paloaltonetworks.com/CVE-2026-0322.
CISA’s KEV listing indicates that active exploitation has been confirmed. The available data does not confirm whether the vulnerability has been used in ransomware campaigns. CISA set 17 October 2026 as the remediation deadline.
CISA requires organisations to apply mitigations in accordance with vendor instructions, comply with applicable BOD 26-04 guidance and its Forensics Triage Requirements, and follow BOD 26-04 guidance for cloud services or discontinue use if mitigations are unavailable. Stakeholders must assess each asset’s internet exposure and follow the directive’s patching guidelines.
The deadline applies to Federal Civilian Executive Branch (FCEB) agencies; all organisations should review their exposure and determine appropriate remediation.
For full details, see the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-0322 and CISA’s KEV catalogue at https://www.cisa.gov/known-exploited-vulnerabilities-catalog.