Palo Alto Networks Patches Actively Exploited PAN-OS Zero-Day Flaw

Palo Alto Networks has issued security updates for an actively exploited remote code execution zero-day, tracked as CVE-2026-0322, affecting the PAN-OS management interface. The vulnerability carries an 8.6 severity score and allows authenticated attackers with existing network access to execute code as root on PA-Series, VM-Series, Panorama virtual, and M-Series appliances. The company confirmed very limited active exploitation in the wild, releasing three attacker IP addresses and noting that Cloud NGFW and Prisma Access remain unaffected. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalog, requiring federal civilian agencies to mitigate it by October 17. Palo Alto Networks warned that Threat Prevention signatures offer limited protection and recommended restricting management interface access to trusted internal IP addresses while applying the patches. "Very limited exploitation has been observed targeting the Palo Alto Networks management interface." — Palo Alto Networks