# Palo Alto Patches PAN-OS Zero-Day CVE-2026-0322 as CISA Deadline Nears

- URL: https://usa-24.com/palo-alto-pan-os-zero-day/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-15T18:56:30.078Z
- Updated: 2026-10-15T18:56:30.085Z
- Topics: Palo Alto Networks, PAN-OS, Zero-Day Vulnerabilities, CISA KEV, Firewall Security

> Attackers with valid credentials can run code as root on Palo Alto PAN-OS firewalls through CVE-2026-0322, and the vendor says limited exploitation has already occurred.

## Key takeaways

- Palo Alto Networks disclosed CVE-2026-0322 on October 14, 2026, and rated the PAN-OS flaw 8.6 on the CVSS 4.0 scale, which it classes as high severity.
- Attackers need existing credentials and network access to the PAN-OS management interface, but a successful attack gives them code execution as root.
- Exposure is highest where the management interface can be reached from external IP addresses, particularly from the public internet.
- CISA set October 17, 2026 as the federal remediation deadline and requires forensic triage under BOD 26-04 for this entry.
- Fixed builds conflict for the PAN-OS 11.2 branch across sources, so confirm the target version against Palo Alto's official advisory before patching.

The Palo Alto PAN-OS zero-day tracked as CVE-2026-0322 lets an attacker who already holds valid credentials run code as root on a firewall, and the vendor says limited exploitation has already occurred. Palo Alto Networks disclosed the flaw and released patches on October 14, 2026. The same day, the Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog and set October 17 as the deadline for federal civilian agencies to fix it.

## Palo Alto PAN-OS zero-day disclosure and severity

Palo Alto's advisory classifies the bug as a code injection weakness, CWE-94, and scores it 8.6 on the CVSS 4.0 scale, which the company rates high severity. [BleepingComputer](https://www.bleepingcomputer.com/news/security/palo-alto-networks-warns-of-pan-os-rce-flaw-exploited-in-attacks/) reports that attackers need existing credentials and network access to the PAN-OS management interface before they can use it. That makes the flaw authenticated, so it is not a pre-login bug that anyone on the internet can trigger.

The vendor's description of activity is narrow. The advisory says "Very limited exploitation has been observed targeting the Palo Alto Networks management interface," as [SecurityWeek reported](https://www.securityweek.com/palo-alto-networks-patches-pan-os-zero-day-exploited-for-remote-code-execution/). Palo Alto also published indicators of compromise, which consist of a few IP addresses tied to the observed activity.

The disclosure landed on a Wednesday, and CISA's alert followed the same day. That compressed the window for administrators to three days before the federal deadline.

Some of the most important facts are still missing. Palo Alto has not identified the attackers, disclosed how many devices were compromised or confirmed when exploitation began. Whether attackers used the flaw before the patch shipped is unconfirmed.

## Which PAN-OS products and setups are exposed

The flaw affects PA-Series and VM-Series firewalls and Panorama appliances, including virtual and M-Series forms. [SOCPrime's analysis](https://socprime.com/blog/cve-2026-0322-analysis/) says Cloud NGFW and Prisma Access are not affected.

- PA-Series hardware firewalls
- VM-Series virtual firewalls
- Panorama appliances in virtual and M-Series form
- Not affected: Cloud NGFW and Prisma Access

A default configuration does not protect you. The advisory, as quoted by [CSO Online](https://www.csoonline.com/article/4235787/attackers-exploit-palo-alto-pan-os-flaw-for-root-access-as-cisa-orders-three-day-fix.html), states that "No special configuration is required to be affected by this issue." Exposure is highest when the management interface can be reached from external IP addresses, particularly from the public internet. Restricting that interface to internal addresses removes the most exposed path.

The pattern will look familiar to readers who followed other edge-device stories. USA 24 covered a [second Cisco Secure Email Gateway zero-day in a month that gave attackers root](https://usa-24.com/cisco-secure-email-gateway-zero-day/), as well as an [Ivanti Connect Secure zero-day that was exploited for 12 days before a patch](https://usa-24.com/ivanti-connect-secure-zero-day-patch/). Each involves a device at the network edge, where a compromise can reach everything behind it.

## Which fixed PAN-OS builds to install

Fixed builds are where sources disagree, so verify before you roll out. [Hol.org](https://hol.org/blog/cve-2026-0322-pan-os-management-interface-rce-kev) lists these fixed builds:

- PAN-OS 12.2.4
- PAN-OS 12.1.10-h2
- PAN-OS 11.2.13-h3
- PAN-OS 11.1.16-h3
- PAN-OS 10.2.18-h12

The conflict sits in the 11.2 branch. A vulnerability database from [Strix](https://www.strix.ai/cve/CVE-2026-0322) lists affected ranges that stop below 11.2.16, and BleepingComputer reports that Palo Alto expected the PAN-OS 11.2.16 fix on October 15. If you run 11.2, treat 11.2.16 as the target until Palo Alto's official advisory confirms the correct build. The other four branches match across both lists.

Mitigation guidance also differs. [Mallory](https://mallory.ai/stories/01a13dc8-7a76-711e-a493-ec5b69815a40) says no workaround exists beyond restricting access, while [Pasquale Pillitteri's analysis](https://pasqualepillitteri.it/en/news/24168/palo-alto-pan-os-zero-day-cve-2026-0322-exploited) mentions enabling Threat Prevention signatures as an added measure. Restricting management access is the step the sources agree on. Treat signatures as a supplement to patching, not a replacement.

Severity labels vary too. [Vulners](https://vulners.com/vulnrichment/VULNRICHMENT:CVE-2026-0322) shows a 9.5 Critical label beside the 8.6 CVSS 4.0 score, and [TheHackerWire](https://www.thehackerwire.com/vulnerability/CVE-2026-0322/) lists the flaw as Info with a score of 0. The vendor's own rating is 8.6 High, and that is the figure to use in internal risk documents.

## What CISA's October 17 deadline requires

CISA's October 14 alert says the agency added four vulnerabilities to its KEV catalog, and CVE-2026-0322 is among them. [CISA's alert](https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog) sets the deadline for federal civilian agencies at October 17, 2026, three days after the addition. That date is a Saturday, so Friday, October 16, is the last working day before it.

The catalog entry requires forensic triage under BOD 26-04. That directive sets basic expectations for when agencies must check whether threat actors compromised a system before the patch was applied. It also requires agencies to act on KEV entries for publicly exposed assets that give full control after exploitation. Root access fits that description. The directive applies to federal civilian agencies, but CISA encourages all organizations to prioritize KEV items, so private companies have a clear reason to move quickly too.

A [CloudLink Tech write-up](https://www.cloudlinktech.com/news/palo-alto-patches-exploited-pan-os-zero-day-cve-2026-0322/) says the KEV catalog now lists 16 vulnerabilities affecting Palo Alto Networks products, including three added in 2026. That count is useful context, but it comes from a secondary source, so check it against CISA's catalog before citing it.

## How to check your firewalls for compromise

Admins should take these four steps. Step two should happen first on any appliance reachable from the internet:

1. Restrict management-interface access to trusted internal IP addresses.
2. Confirm your PAN-OS version against Palo Alto's advisory, then apply the fixed build for your release train.
3. Review logs against the indicators of compromise Palo Alto published.
4. Check for unexpected admin accounts or configuration changes, since the risk is root-level compromise that may leave changes behind.

Restricting access does not replace the patch. It closes the path that the exposure data points to while you schedule the upgrade. If a device was reachable from the internet and unpatched while exploitation was possible, treat it as potentially compromised until the logs show otherwise.

Panorama appliances are in scope too. If you manage firewalls centrally, check the management server as well as the firewalls it controls.

## Why an authenticated flaw still carries root-level risk

An authenticated bug is a smaller risk than a pre-login one, but it is not a minor one. Stolen, reused or phished credentials are a routine part of intrusions, so the login requirement lowers the bar instead of removing it. The exposure falls on organizations that run these appliances, including private companies, hospitals, banks and state and local governments, and the risk is highest for any that expose a management interface to the internet.

PAN-OS has been targeted before. A separate buffer overflow, CVE-2026-0300, was exploited about five months before this flaw, according to the [Pillitteri analysis](https://pasqualepillitteri.it/en/news/24168/palo-alto-pan-os-zero-day-cve-2026-0322-exploited). Two exploited PAN-OS bugs in roughly five months make management-interface exposure a standing audit item rather than a one-time fix.

## What to watch next

Three developments will show how serious this gets. First, whether Palo Alto's advisory settles the 11.2 branch conflict. Second, whether agencies or vendors disclose compromises found during triage before the October 17 deadline. Third, whether researchers see exploitation that reaches beyond the management interface. For now, any PAN-OS appliance reachable from the internet deserves attention today, not after the weekend.

## Frequently asked questions

### Which Palo Alto products are affected by CVE-2026-0322?

PA-Series and VM-Series firewalls and Panorama appliances are affected, including virtual and M-Series forms. Cloud NGFW and Prisma Access are not affected. Exploitation requires existing credentials and network access to the PAN-OS management interface, and exposure is highest when that interface is reachable from the internet.

### What is the deadline to patch CVE-2026-0322?

CISA set October 17, 2026 as the remediation deadline for federal civilian agencies. That date falls on a Saturday, so Friday, October 16 is the last working day before it. CISA encourages all organizations to prioritize KEV entries, not only federal agencies.

### Which PAN-OS version fixes CVE-2026-0322?

Hol.org lists fixed builds including PAN-OS 12.2.4, 12.1.10-h2, 11.2.13-h3, 11.1.16-h3 and 10.2.18-h12. Strix and BleepingComputer point to 11.2.16 as the fix for the 11.2 branch, so confirm the correct build against Palo Alto's official advisory.

### Has CVE-2026-0322 been exploited in the wild?

Palo Alto says very limited exploitation has been observed against the management interface. The company has not identified the attackers or the number of compromised devices, and it has not confirmed when exploitation began.

## Sources

1. [Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks (BleepingComputer)](https://www.bleepingcomputer.com/news/security/palo-alto-networks-warns-of-pan-os-rce-flaw-exploited-in-attacks/)
2. [Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution (SecurityWeek)](https://www.securityweek.com/palo-alto-networks-patches-pan-os-zero-day-exploited-for-remote-code-execution/)
3. [Attackers exploit Palo Alto PAN-OS flaw for root access as CISA orders three-day fix (CSO Online)](https://www.csoonline.com/article/4235787/attackers-exploit-palo-alto-pan-os-flaw-for-root-access-as-cisa-orders-three-day-fix.html)
4. [CISA Adds Four Known Exploited Vulnerabilities to Catalog (CISA)](https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog)
5. [Palo Alto Patches Exploited PAN-OS Zero-Day CVE-2026-0322 (CloudLink Tech)](https://www.cloudlinktech.com/news/palo-alto-patches-exploited-pan-os-zero-day-cve-2026-0322/)
6. [CVE-2026-0322: PAN-OS RCE Flaw Exploited in the Wild (SOCPrime blog)](https://socprime.com/blog/cve-2026-0322-analysis/)
7. [PAN-OS CVE-2026-0322 exploited management interface RCE: how to fix (Hol.org blog)](https://hol.org/blog/cve-2026-0322-pan-os-management-interface-rce-kev)
8. [CVE-2026-0322: PAN-OS Code Injection (CVSS 8.6) - Fix & Details (Strix)](https://www.strix.ai/cve/CVE-2026-0322)
9. [CVE-2026-0322 PAN-OS: Authenticated Remote Code Execution (Vulners)](https://vulners.com/vulnrichment/VULNRICHMENT:CVE-2026-0322)
10. [CVE-2026-0322: Remote Code Execution (RCE) - Analysis & Fix (TheHackerWire)](https://www.thehackerwire.com/vulnerability/CVE-2026-0322/)
11. [Palo Alto PAN-OS zero-day CVE-2026-0322 exploited, patch now (Pasquale Pillitteri blog)](https://pasqualepillitteri.it/en/news/24168/palo-alto-pan-os-zero-day-cve-2026-0322-exploited)
12. [Palo Alto Patches PAN-OS Zero-Day Exploited for Root Code Execution (Mallory)](https://mallory.ai/stories/01a13dc8-7a76-711e-a493-ec5b69815a40)