PALO Alto Networks has released security updates for PAN-OS after a high‑severity remote code execution flaw, tracked as CVE-2026-0322 (CVSS 8.6), was observed being exploited in the wild. The vulnerability affects PAN-OS running on PA‑Series and VM‑Series firewalls, as well as Panorama (virtual and M‑Series). The flaw enables an authenticated attacker with network access to run arbitrary code with root privileges via the management interface. Cloud NGFW and Prisma Access are not affected.
Palo Alto Networks notes that no special configuration is required to exploit the issue, but the risk can be reduced by restricting management access to trusted internal IPs, such as via a jump box that is the only system permitted to reach the management interface.
The vendor lists patches in multiple PAN-OS versions, including PAN-OS >= 12.2.4; PAN-OS >= 12.1.4-h12, >= 12.1.7-h8, >= 12.1.10-h2; and a range of older 11.x and 10.x builds (with ETA dates noted for some). Observed exploitation was described as very limited, with three US geolocated IP addresses linked to exploit attempts. The U.S.
Cybersecurity and Infrastructure Security Agency has added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog, underscoring the urgency of applying fixes by 17 October 2026 for Federal Civilian Executive Branch agencies. Suraj Siddharudh of Palo Alto Networks is credited with discovering and reporting the vulnerability.