PALO Alto Networks has released patches for a PAN-OS zero-day vulnerability tracked as CVE-2026-0322, which has been exploited in limited attacks against the management interface of PAN-OS. The flaw allows remote code execution and can be exploited by an authenticated attacker with network access to run arbitrary code with root privileges on the targeted firewall.
The company said exploitation appeared to be very limited and disclosed indicators of compromise, including a small set of IP addresses observed in the related activity. The zero-day affects PAN-OS software on PA-Series and VM-Series firewalls and on Panorama, and no special configuration is required to exploit CVE-2026-0322.
Palo Alto Networks has issued patches and advised affected customers to remediate promptly. In addition to CVE-2026-0322, the firm published a dozen other advisories addressing vulnerabilities across PAN-OS, GlobalProtect and Prisma Cloud products, noting that these were generally medium or low severity and involved issues such as DoS, command injection, identity hijacking, local privilege escalation, XSS and path traversal.
CISA added CVE-2026-0322 to its Known Explploited Vulnerabilities (KEV) catalog, with a 17 October deadline for federal agencies to address it. Practically, organisations should apply the PAN-OS updates, review the IoCs provided by Palo Alto Networks, and monitor for any related activity while ensuring other PAN-OS advisories are also addressed.