Palo Alto Networks shipped patches Wednesday for CVE-2026-0322, a high-severity remote code execution bug in the PAN-OS management interface that attackers are already using. The company rates it 8.6 and says "very limited exploitation has been observed" against that interface. CISA added the CVE to its Known Exploited Vulnerabilities catalog the same day and gave federal civilian agencies until October 17 to mitigate it.
The flaw needs credentials and network reach to the management plane, then it runs code as root. It hits PA-Series and VM-Series firewalls plus Panorama virtual and M-Series appliances. Cloud NGFW and Prisma Access are not affected. Fixes are out for PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2, with an 11.2.16 build due October 15. There is no real workaround beyond locking management access to trusted IPs. Threat Prevention IDs 510046 and 510047 only catch some known patterns, and Palo Alto says customers should upgrade anyway.
Palo Alto researcher Suraj Siddharudh found the bug internally. The advisory also lists three IP addresses tied to exploit attempts: 66.42.72.14, 208.83.239.114, and 149.248.47.234. If the management interface is still hanging off the open internet, that is the first thing to shut down.
— via BleepingComputer and Palo Alto Networks