Palo Alto Networks disclosed CVE-2026-0322 on October 14, a remote code execution flaw in the PAN-OS management interface. It was already being exploited when the advisory went out. Full disclosure: I work at Zscaler, which competes with Palo Alto Networks, so weigh my opinions accordingly. The facts below come straight from the advisory and public reporting.
What Happened
Per Palo Alto's advisory, the bug lets an authenticated attacker with network access to the management interface execute arbitrary code with root privileges on the firewall. It's rated High, CVSS 8.6, and classified as a code injection flaw (CWE-94).
Affected products include PA-Series and VM-Series firewalls and Panorama, across PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2. Cloud NGFW and Prisma Access are not affected. Fixes are available, and Palo Alto is clear that no workaround eliminates the vulnerability. Upgrading is required.
On exploitation, the advisory says "very limited exploitation has been observed" against management interfaces. CISA added it to the Known Exploited Vulnerabilities catalog and gave federal civilian agencies until October 17 to fix it. Three days.
"Authenticated" Is Doing a Lot of Work
The bug requires valid credentials, which sounds reassuring right up until you remember how attackers actually get in. Credentials get phished, reused, and dumped. And once someone has root on a firewall, the rest of the network is negotiable.
"Once they can execute code as root on a firewall, they have control over a device that enforces security across the network."
— Vibhum Dubey, cybersecurity researcher, via CSO Online
IDC's Yih Khai Wong also told CSO Online that teams should check firewall configurations for unexpected changes, because a compromised device can be quietly reconfigured to stay compromised. In other words, patching closes the door, but it doesn't tell you whether someone already walked through it.
If You Run PAN-OS, Do This Now
Straight from Palo Alto's own guidance:
- Upgrade to a fixed PAN-OS version. This is the only full fix.
- Restrict management interface access to trusted internal IP addresses only.
- Use a jump box as the single access point to management.
- If you have Threat Prevention with SSL decryption, enable Threat IDs 510046 and 510047.
- Audit your configs for changes you didn't make.
If your management interface is reachable from the internet, stop reading and go fix that first.
The Bigger Pattern
This isn't a knock on the people at Palo Alto who found, fixed, and disclosed this quickly. Every vendor ships bugs, Zscaler included. The architectural question is what happens when a bug lands.
Firewalls and VPN concentrators are boxes with IP addresses and management planes that live on, or next to, your network. That makes the security stack itself part of your attack surface. Every one of those boxes has to be patched, hardened, monitored, and kept off the internet, on the attacker's timeline, not yours. CISA's three-day deadline tells you exactly how much time you get.
Bottom Line
Patch, lock down the management interface, and check your configs. Then ask the harder question I keep coming back to:
How much of your security architecture do you still have to secure before it can secure you?
Sources: Palo Alto Networks advisory for CVE-2026-0322, CSO Online, BleepingComputer