Cybersecurity

Palo Alto Networks Warns of Exploited PAN-OS RCE Zero-Day

Palo Alto Networks has released crucial security updates to address a high-severity remote code execution zero-day vulnerability in its PAN-OS software that is currently being exploited in real-world attacks targeting corporate and enterprise firewalls.

Radwan AbdulhadiEditor and technology writer

Published: October 15, 2026 · Updated: October 15, 2026 · 4 min read

Palo Alto Networks Warns of Exploited PAN-OS RCE Zero-Day — Image: BleepingComputer

Overview of the PAN-OS Zero-Day Vulnerability

Palo Alto Networks has officially released security updates designed to mitigate a high-severity remote code execution (RCE) zero-day vulnerability affecting its PAN-OS software platform. Tracked officially under the identifier CVE-2026-0322, the security flaw has already been actively exploited in real-world attacks targeting enterprise firewall hardware and virtual appliances. Comprehensive details regarding the nature of the vulnerability and the extent of the impact were detailed thoroughly by <a href="https://www.bleepingcomputer.com/news/security/palo-alto-networks-warns-of-pan-os-rce-flaw-exploited-in-attacks/">BleepingComputer</a> in their initial coverage of the security advisory.

The vulnerability resides directly within the core PAN-OS management interface. When successfully leveraged, it grants authenticated attackers who possess necessary network access the ability to execute arbitrary code with root privileges on vulnerable underlying devices. Because root-level access compromises the entire appliance, organizations must act swiftly to understand their exposure risk, review access logs, and implement recommended administrative patches or configuration changes to prevent potential system takeovers across their deployed perimeter infrastructure. Further details are available from Lawrence Abrams in the original source material.

Severity Score, Affected Models, and Attack Requirements

Assigned a high severity score of 8.6 out of a possible 10.0, the security flaw impacts a wide array of Palo Alto Networks hardware and virtualized infrastructure. Specifically, the vulnerability affects PA-Series and VM-Series firewalls, in addition to both Panorama virtual appliances and M-Series management appliances. Conversely, the company has explicitly stated that Cloud NGFW and Prisma Access instances remain entirely unaffected by this specific security issue.

To successfully exploit this security defect, malicious actors must meet two strict preliminary criteria: they require existing administrative credentials and direct network access to the PAN-OS management interface. Because unauthorized external exposure of management interfaces has historically been a significant vector for enterprise compromise, Palo Alto Networks strongly advises network administrators to strictly restrict access to the management interface so that it is accessible exclusively through trusted internal IP addresses.

Observed Exploitation and Threat Intelligence Data

Palo Alto Networks <a href="https://security.paloaltonetworks.com/CVE-2026-0322">confirmed in a security advisory</a> published on Wednesday that its threat intelligence teams have observed limited active exploitation targeting the management interface of its products. While the overall volume of attacks observed thus far remains relatively constrained, the capability of threat actors to leverage root-level execution means that any compromise carries severe operational risks for corporate networks relying on these firewalls.

As part of its ongoing effort to assist defenders and security operations centers globally, the vendor proactively shared specific indicators of compromise. Specifically, the company published three distinct IP addresses associated with malicious activity attempting to exploit the zero-day flaw: 66.42.72[.]14, 208.83.239[.]114, and 149.248.47[.]234. Organizations are strongly encouraged to inspect their perimeter logs for any historical or ongoing connection attempts originating from these malicious IP addresses.

Available Patches and Vendor Recommendations

In response to the active exploitation campaigns, Palo Alto Networks has rolled out official software fixes for multiple supported software branches, including PAN-OS versions 10.2, 11.1, 11.2, 12.1, and 12.2. Furthermore, a dedicated fix for the specific PAN-OS version 11.2.16 was scheduled for release on October 15. Customers running older, unsupported software iterations must immediately plan and execute upgrades to a fully supported product release to regain compliance and security.

For environments where immediate upgrades are temporarily impractical, the vendor notes that no true native workarounds exist. However, customers maintaining active Threat Prevention subscriptions can enable specific predefined signatures designed to offer limited protection against known attack patterns. The company cautions that while Threat Prevention signatures can successfully spot known variations, novel threat variations might bypass detection until full patching is achieved.

Internal Discovery and Federal Agency Compliance

The security flaw itself was discovered internally through proactive research conducted by Suraj Siddharudh, a senior principal product security researcher at Palo Alto Networks. Internal discovery highlights the ongoing commitment of vendor research teams to identify high-risk vulnerabilities before malicious syndicates can weaponize them at scale across the broader digital landscape.

Following the public disclosure and confirmation of active attacks, the U.S. Cybersecurity and Infrastructure Security Agency took swift regulatory action. CISA added CVE-2026-0322 directly to its <a href="http://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities catalog</a>, establishing a mandatory compliance deadline requiring all federal civilian executive branch agencies to fully remediate and patch the vulnerability by October 17.