Palo Alto Networks told customers on Wednesday, October 14, that it had released patches for a PAN-OS zero-day already exploited in malicious attacks. The flaw, tracked as CVE-2026-0322, sits in the PAN-OS management interface, the part of a firewall administrators use to configure it. SecurityWeek reports that an authenticated attacker with network access can execute arbitrary code with root privileges on the targeted device.
How the Palo Alto PAN-OS zero-day works
Root access means an attacker can take full control of the appliance, not just read a log or crash a service. The authentication requirement narrows who can use the flaw, but the target still sits at the edge of a corporate network, where it sees traffic from many systems.
Palo Alto rated the flaw 8.6 on the CVSS 4.0 scale and assigned its highest remediation urgency, according to Cybersecurity News. The advisory went up on October 14 and was updated on October 15. The company says it found the bug internally and credits researcher Suraj Siddharudh with the discovery.
The vendor's wording on scope is measured. The advisory states: “Very limited exploitation has been observed targeting the Palo Alto Networks management interface.” That confirms active use, but it describes a narrow campaign so far. BleepingComputer also reported the exploitation warning.
Palo Alto published about a dozen other advisories the same day, covering other PAN-OS, GlobalProtect and Prisma Cloud issues that it rated medium or low. Those are less urgent, but they belong in the same patch cycle.
Which Palo Alto products are affected
The exposure covers PAN-OS running on three product families:
- PA-Series hardware firewalls
- VM-Series virtual firewalls
- Panorama management appliances, both virtual and M-Series
Cloud NGFW and Prisma Access are not affected, according to GBHackers. That split matters for organizations with a mixed setup. A team that has moved some workloads to Prisma Access still needs to patch its on-premises PA-Series boxes.
This article does not list fixed PAN-OS release numbers. Check Palo Alto's advisory for the fixed version that applies to your branch, and confirm the running version on the device itself rather than relying on a change ticket.
Why the management interface is the risk point
Edge devices keep drawing attention from state-linked and criminal groups because one compromised appliance can expose everything behind it. A firewall sees the traffic that passes through it, and a root shell on that device gives an attacker a view of the network and a way to tamper with it. Recent USA 24 coverage shows the same pattern. An Ivanti VPN zero-day chain gave attackers root access, and a Cisco email gateway zero-day did the same on a different product line.
The management interface is where this risk concentrates. A device whose admin interface is reachable from the internet presents far more opportunity than one whose admin interface sits on a locked-down management network. Restricting that access is often the fastest way to shrink the exposure while patching is underway.
How this differs from the May captive-portal flaw
Some readers may remember a different PAN-OS zero-day. On May 5, 2026, Palo Alto disclosed CVE-2026-0300, a critical flaw in the captive-portal service, according to Field Effect. That bug was a buffer overflow in the Captive Portal service.
CVE-2026-0322 is a separate bug in a different component, disclosed in October. Patching after the May advisory does not cover it, so administrators need to check both.
What the CISA deadline means for federal agencies
CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog on October 14 and told federal agencies to remediate it by October 17, as stated in CISA's alert. That deadline passed yesterday. Agencies that have not patched should treat their firewalls as possibly compromised and look for signs of intrusion, not just install the update.
The KEV catalog now lists 16 vulnerabilities in Palo Alto Networks products, three of them added in 2026, according to CloudLink Tech. PAN-OS firewalls are common at US companies, agencies and hospitals, so the exposure reaches well beyond federal networks. A patch a federal agency has not yet installed may be sitting unscheduled at a regional hospital too.
What to do now
Work through these steps in order, and record what you find at each one:
- Inventory every PA-Series, VM-Series and Panorama device, and record the PAN-OS version on each.
- Compare each version with the fixed release in Palo Alto's advisory, and install the fix wherever you are behind.
- Restrict management-interface access to trusted internal networks, and remove any public exposure.
- Compare firewall traffic and logs against the IP addresses Palo Alto published as indicators of compromise.
- Review administrator accounts and recent configuration changes for anything you did not make.
- If a device was exposed and unpatched during the exploitation window, run a compromise assessment, not only the patch.
What remains unknown
Several basic facts are still missing. Palo Alto has not named the attacker or group behind the campaign, and no independent security firm has published its own attribution yet. The company has also not said how many customers were affected, when exploitation began, or whether public exploit code is in circulation.
One report says no known workarounds exist for the flaw. That claim has not been confirmed in the vendor advisory, so treat it as unverified and check the advisory before relying on it, especially if you cannot patch on short notice.
What comes next
The most useful next signal will be whether security firms can tie the published IP addresses to a known group. Palo Alto could also revise its advisory with a count of affected customers or a timeline of exploitation. If either happens, the scope of this story will change quickly.
For now, the work is the same for every team: find the devices, confirm the version, close the management interface and look for signs of intrusion.
