The Palo Alto PAN-OS zero-day tracked as CVE-2026-0322 lets an attacker who already holds valid credentials run code as root on a firewall, and the vendor says limited exploitation has already occurred. Palo Alto Networks disclosed the flaw and released patches on October 14, 2026. The same day, the Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog and set October 17 as the deadline for federal civilian agencies to fix it.
Palo Alto PAN-OS zero-day disclosure and severity
Palo Alto's advisory classifies the bug as a code injection weakness, CWE-94, and scores it 8.6 on the CVSS 4.0 scale, which the company rates high severity. BleepingComputer reports that attackers need existing credentials and network access to the PAN-OS management interface before they can use it. That makes the flaw authenticated, so it is not a pre-login bug that anyone on the internet can trigger.
The vendor's description of activity is narrow. The advisory says "Very limited exploitation has been observed targeting the Palo Alto Networks management interface," as SecurityWeek reported. Palo Alto also published indicators of compromise, which consist of a few IP addresses tied to the observed activity.
The disclosure landed on a Wednesday, and CISA's alert followed the same day. That compressed the window for administrators to three days before the federal deadline.
Some of the most important facts are still missing. Palo Alto has not identified the attackers, disclosed how many devices were compromised or confirmed when exploitation began. Whether attackers used the flaw before the patch shipped is unconfirmed.
Which PAN-OS products and setups are exposed
The flaw affects PA-Series and VM-Series firewalls and Panorama appliances, including virtual and M-Series forms. SOCPrime's analysis says Cloud NGFW and Prisma Access are not affected.
- PA-Series hardware firewalls
- VM-Series virtual firewalls
- Panorama appliances in virtual and M-Series form
- Not affected: Cloud NGFW and Prisma Access
A default configuration does not protect you. The advisory, as quoted by CSO Online, states that "No special configuration is required to be affected by this issue." Exposure is highest when the management interface can be reached from external IP addresses, particularly from the public internet. Restricting that interface to internal addresses removes the most exposed path.
The pattern will look familiar to readers who followed other edge-device stories. USA 24 covered a second Cisco Secure Email Gateway zero-day in a month that gave attackers root, as well as an Ivanti Connect Secure zero-day that was exploited for 12 days before a patch. Each involves a device at the network edge, where a compromise can reach everything behind it.
Which fixed PAN-OS builds to install
Fixed builds are where sources disagree, so verify before you roll out. Hol.org lists these fixed builds:
- PAN-OS 12.2.4
- PAN-OS 12.1.10-h2
- PAN-OS 11.2.13-h3
- PAN-OS 11.1.16-h3
- PAN-OS 10.2.18-h12
The conflict sits in the 11.2 branch. A vulnerability database from Strix lists affected ranges that stop below 11.2.16, and BleepingComputer reports that Palo Alto expected the PAN-OS 11.2.16 fix on October 15. If you run 11.2, treat 11.2.16 as the target until Palo Alto's official advisory confirms the correct build. The other four branches match across both lists.
Mitigation guidance also differs. Mallory says no workaround exists beyond restricting access, while Pasquale Pillitteri's analysis mentions enabling Threat Prevention signatures as an added measure. Restricting management access is the step the sources agree on. Treat signatures as a supplement to patching, not a replacement.
Severity labels vary too. Vulners shows a 9.5 Critical label beside the 8.6 CVSS 4.0 score, and TheHackerWire lists the flaw as Info with a score of 0. The vendor's own rating is 8.6 High, and that is the figure to use in internal risk documents.
What CISA's October 17 deadline requires
CISA's October 14 alert says the agency added four vulnerabilities to its KEV catalog, and CVE-2026-0322 is among them. CISA's alert sets the deadline for federal civilian agencies at October 17, 2026, three days after the addition. That date is a Saturday, so Friday, October 16, is the last working day before it.
The catalog entry requires forensic triage under BOD 26-04. That directive sets basic expectations for when agencies must check whether threat actors compromised a system before the patch was applied. It also requires agencies to act on KEV entries for publicly exposed assets that give full control after exploitation. Root access fits that description. The directive applies to federal civilian agencies, but CISA encourages all organizations to prioritize KEV items, so private companies have a clear reason to move quickly too.
A CloudLink Tech write-up says the KEV catalog now lists 16 vulnerabilities affecting Palo Alto Networks products, including three added in 2026. That count is useful context, but it comes from a secondary source, so check it against CISA's catalog before citing it.
How to check your firewalls for compromise
Admins should take these four steps. Step two should happen first on any appliance reachable from the internet:
- Restrict management-interface access to trusted internal IP addresses.
- Confirm your PAN-OS version against Palo Alto's advisory, then apply the fixed build for your release train.
- Review logs against the indicators of compromise Palo Alto published.
- Check for unexpected admin accounts or configuration changes, since the risk is root-level compromise that may leave changes behind.
Restricting access does not replace the patch. It closes the path that the exposure data points to while you schedule the upgrade. If a device was reachable from the internet and unpatched while exploitation was possible, treat it as potentially compromised until the logs show otherwise.
Panorama appliances are in scope too. If you manage firewalls centrally, check the management server as well as the firewalls it controls.
Why an authenticated flaw still carries root-level risk
An authenticated bug is a smaller risk than a pre-login one, but it is not a minor one. Stolen, reused or phished credentials are a routine part of intrusions, so the login requirement lowers the bar instead of removing it. The exposure falls on organizations that run these appliances, including private companies, hospitals, banks and state and local governments, and the risk is highest for any that expose a management interface to the internet.
PAN-OS has been targeted before. A separate buffer overflow, CVE-2026-0300, was exploited about five months before this flaw, according to the Pillitteri analysis. Two exploited PAN-OS bugs in roughly five months make management-interface exposure a standing audit item rather than a one-time fix.
What to watch next
Three developments will show how serious this gets. First, whether Palo Alto's advisory settles the 11.2 branch conflict. Second, whether agencies or vendors disclose compromises found during triage before the October 17 deadline. Third, whether researchers see exploitation that reaches beyond the management interface. For now, any PAN-OS appliance reachable from the internet deserves attention today, not after the weekend.
