# Palo Alto PAN-OS Zero-Day CVE-2026-0322 Is Being Exploited

- URL: https://usa-24.com/palo-alto-pan-os-zero-day-patch/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-18T13:37:17.273Z
- Updated: 2026-10-18T13:37:17.278Z
- Topics: Zero-Day Vulnerabilities, Palo Alto Networks, PAN-OS, Firewall Security, CISA

> Palo Alto Networks has patched CVE-2026-0322, a PAN-OS management-interface zero-day under limited attack. CISA's federal remediation deadline passed on October 17.

## Key takeaways

- Palo Alto Networks patched CVE-2026-0322, a PAN-OS management-interface zero-day, on October 14, 2026, after attackers had already used it.
- An authenticated attacker with network access can run arbitrary code with root privileges on affected PA-Series, VM-Series and Panorama devices.
- Palo Alto gave the flaw a CVSS 4.0 base score of 8.6 and assigned its highest remediation urgency.
- CISA set an October 17 remediation deadline for federal agencies, and that date has now passed.
- Palo Alto has not named the attacker, the number of affected customers, or when exploitation began.

Palo Alto Networks told customers on Wednesday, October 14, that it had released patches for a PAN-OS zero-day already exploited in malicious attacks. The flaw, tracked as CVE-2026-0322, sits in the PAN-OS management interface, the part of a firewall administrators use to configure it. [SecurityWeek](https://www.securityweek.com/palo-alto-networks-patches-pan-os-zero-day-exploited-for-remote-code-execution/) reports that an authenticated attacker with network access can execute arbitrary code with root privileges on the targeted device.

## How the Palo Alto PAN-OS zero-day works

Root access means an attacker can take full control of the appliance, not just read a log or crash a service. The authentication requirement narrows who can use the flaw, but the target still sits at the edge of a corporate network, where it sees traffic from many systems.

Palo Alto rated the flaw 8.6 on the CVSS 4.0 scale and assigned its highest remediation urgency, according to [Cybersecurity News](https://cybersecuritynews.com/pan-os-0-day-vulnerability/). The advisory went up on October 14 and was updated on October 15. The company says it found the bug internally and credits researcher Suraj Siddharudh with the discovery.

The vendor's wording on scope is measured. The advisory states: “Very limited exploitation has been observed targeting the Palo Alto Networks management interface.” That confirms active use, but it describes a narrow campaign so far. [BleepingComputer](https://www.bleepingcomputer.com/news/security/palo-alto-networks-warns-of-pan-os-rce-flaw-exploited-in-attacks/) also reported the exploitation warning.

Palo Alto published about a dozen other advisories the same day, covering other PAN-OS, GlobalProtect and Prisma Cloud issues that it rated medium or low. Those are less urgent, but they belong in the same patch cycle.

## Which Palo Alto products are affected

The exposure covers PAN-OS running on three product families:

- PA-Series hardware firewalls
- VM-Series virtual firewalls
- Panorama management appliances, both virtual and M-Series

Cloud NGFW and Prisma Access are not affected, according to [GBHackers](https://gbhackers.com/palo-alto-pan-os-zero-day/). That split matters for organizations with a mixed setup. A team that has moved some workloads to Prisma Access still needs to patch its on-premises PA-Series boxes.

This article does not list fixed PAN-OS release numbers. Check Palo Alto's advisory for the fixed version that applies to your branch, and confirm the running version on the device itself rather than relying on a change ticket.

## Why the management interface is the risk point

Edge devices keep drawing attention from state-linked and criminal groups because one compromised appliance can expose everything behind it. A firewall sees the traffic that passes through it, and a root shell on that device gives an attacker a view of the network and a way to tamper with it. Recent USA 24 coverage shows the same pattern. An [Ivanti VPN zero-day chain gave attackers root access](https://usa-24.com/ivanti-connect-secure-zero-day-root-access/), and a [Cisco email gateway zero-day](https://usa-24.com/cisco-secure-email-gateway-zero-day-2/) did the same on a different product line.

The management interface is where this risk concentrates. A device whose admin interface is reachable from the internet presents far more opportunity than one whose admin interface sits on a locked-down management network. Restricting that access is often the fastest way to shrink the exposure while patching is underway.

## How this differs from the May captive-portal flaw

Some readers may remember a different PAN-OS zero-day. On May 5, 2026, Palo Alto disclosed CVE-2026-0300, a critical flaw in the captive-portal service, according to [Field Effect](https://fieldeffect.com/blog/palo-alto-firewall-zero-day-unauthenticated-root-access). That bug was a buffer overflow in the Captive Portal service.

CVE-2026-0322 is a separate bug in a different component, disclosed in October. Patching after the May advisory does not cover it, so administrators need to check both.

## What the CISA deadline means for federal agencies

CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog on October 14 and told federal agencies to remediate it by October 17, as stated in [CISA's alert](https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog). That deadline passed yesterday. Agencies that have not patched should treat their firewalls as possibly compromised and look for signs of intrusion, not just install the update.

The KEV catalog now lists 16 vulnerabilities in Palo Alto Networks products, three of them added in 2026, according to [CloudLink Tech](https://www.cloudlinktech.com/news/palo-alto-patches-exploited-pan-os-zero-day-cve-2026-0322/). PAN-OS firewalls are common at US companies, agencies and hospitals, so the exposure reaches well beyond federal networks. A patch a federal agency has not yet installed may be sitting unscheduled at a regional hospital too.

## What to do now

Work through these steps in order, and record what you find at each one:

1. Inventory every PA-Series, VM-Series and Panorama device, and record the PAN-OS version on each.
2. Compare each version with the fixed release in Palo Alto's advisory, and install the fix wherever you are behind.
3. Restrict management-interface access to trusted internal networks, and remove any public exposure.
4. Compare firewall traffic and logs against the IP addresses Palo Alto published as indicators of compromise.
5. Review administrator accounts and recent configuration changes for anything you did not make.
6. If a device was exposed and unpatched during the exploitation window, run a compromise assessment, not only the patch.

## What remains unknown

Several basic facts are still missing. Palo Alto has not named the attacker or group behind the campaign, and no independent security firm has published its own attribution yet. The company has also not said how many customers were affected, when exploitation began, or whether public exploit code is in circulation.

One report says no known workarounds exist for the flaw. That claim has not been confirmed in the vendor advisory, so treat it as unverified and check the advisory before relying on it, especially if you cannot patch on short notice.

## What comes next

The most useful next signal will be whether security firms can tie the published IP addresses to a known group. Palo Alto could also revise its advisory with a count of affected customers or a timeline of exploitation. If either happens, the scope of this story will change quickly.

For now, the work is the same for every team: find the devices, confirm the version, close the management interface and look for signs of intrusion.

## Frequently asked questions

### Is CVE-2026-0322 the same as CVE-2026-0300?

No. CVE-2026-0300 is a separate captive-portal flaw that Palo Alto disclosed on May 5, 2026, and it was a buffer overflow in the Captive Portal service. CVE-2026-0322 affects the PAN-OS management interface and was patched on October 14, so administrators need to check for both.

### Which Palo Alto firewalls are affected by CVE-2026-0322?

PAN-OS running on PA-Series and VM-Series firewalls and on Panorama, both virtual and M-Series, is affected. Cloud NGFW and Prisma Access are not affected, according to GBHackers. Compare each device's PAN-OS version against the fixed release in Palo Alto's advisory.

### How do I know if my Palo Alto firewall is vulnerable?

Check the PAN-OS version on each device against the fixed release in Palo Alto's advisory. Then check whether the management interface is reachable from the internet or from untrusted networks, since that raises the risk. Compare logs against the published IP addresses as well.

### Has Palo Alto said who is exploiting the flaw?

No. Palo Alto has not named the attacker or group, and no independent security vendor has published attribution yet. The company has also not said how many customers were affected or when exploitation began.

## Sources

1. [Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution — SecurityWeek](https://www.securityweek.com/palo-alto-networks-patches-pan-os-zero-day-exploited-for-remote-code-execution/)
2. [Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks — BleepingComputer](https://www.bleepingcomputer.com/news/security/palo-alto-networks-warns-of-pan-os-rce-flaw-exploited-in-attacks/)
3. [Palo Alto Networks PAN-OS zero-day coverage — Cybersecurity News](https://cybersecuritynews.com/pan-os-0-day-vulnerability/)
4. [Palo Alto Warns of PAN-OS 0-day Flaw Actively Exploited in Attacks — GBHackers](https://gbhackers.com/palo-alto-pan-os-zero-day/)
5. [Palo Alto Patches Exploited PAN-OS Zero-Day CVE-2026-0322 — CloudLink Tech](https://www.cloudlinktech.com/news/palo-alto-patches-exploited-pan-os-zero-day-cve-2026-0322/)
6. [CISA Adds Four Known Exploited Vulnerabilities to Catalog (October 14, 2026) — CISA](https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog)
7. [Palo Alto firewall zero-day allows unauthenticated root access — Field Effect](https://fieldeffect.com/blog/palo-alto-firewall-zero-day-unauthenticated-root-access)