Palo Alto Networks Patches Exploited RCE Flaw in PAN-OS Management Interface

A critical remote code execution flaw in Palo Alto Networks PAN-OS has prompted the vendor to release patches following confirmed exploitation in the wild. Tracked as CVE-2026-0322, the vulnerability resides in the management interface and permits authenticated users with network connectivity to run code with root privileges on affected systems.

Palo Alto Networks disclosed the issue in a security advisory released Wednesday, noting limited but active exploitation. The company stated: "Very limited exploitation has been observed targeting the Palo Alto Networks management interface."

The flaw carries a severity rating of 8.6 and impacts PA-Series and VM-Series firewalls alongside Panorama virtual and M-Series appliances. Cloud NGFW and Prisma Access deployments remain unaffected by this vulnerability.

Successful exploitation requires attackers to possess valid credentials and network reachability to the management interface. In response, Palo Alto Networks advises organizations to limit management interface access exclusively to trusted internal networks.

The vendor has delivered patches for PAN-OS versions 10.2, 11.1, 11.2, 12.1, and 12.2, with a fix for PAN-OS 11.2.16 scheduled for October 15. Organizations operating unsupported legacy versions must transition to a currently supported release.

No workarounds exist for the vulnerability, though customers with active Threat Prevention subscriptions can deploy signatures offering partial protection against recognized attack variants. Palo Alto Networks cautioned: "Limited coverage in Threat Prevention means that while known attack patterns can be identified using the current Threat ID, variations may exist that cannot currently be detected."

The company further advised: "If this CVE and Required Configuration for Exposure impact your environment, we recommend upgrading to an unaffected version."

Suraj Siddharudh, a senior principal product security researcher at Palo Alto Networks, identified the vulnerability through internal discovery. The organization has disclosed three IP addresses conducting exploitation attempts: 66.42.72[.]14, 208.83.239[.]114, and 149.248.47[.]234.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has cataloged CVE-2026-0322 in its Known Exploited Vulnerabilities registry, mandating that federal civilian agencies implement mitigation measures by October 17.