By Thomas Anderson in Security News — 14 Oct 2026

Palo Alto Networks Ships an Emergency Fix for PAN-OS Zero-Day CVE-2026-0322 — Authenticated Attackers Get Root Code Execution on the Firewall Management Interface

Palo Alto Networks warned customers on Wednesday, October 14, that it has patched a PAN-OS zero-day under active exploitation. The flaw, CVE-2026-0322, is a high-severity remote code execution vulnerability in the management interface of PAN-OS: an authenticated attacker with network access to the interface can execute arbitrary code with root privileges on the targeted firewall. The company said "very limited exploitation has been observed targeting the Palo Alto Networks management interface," shared three IP addresses it has seen exploiting the flaw — 66.42.72[.]14, 208.83.239[.]114, and 149.248.47[.]234 — and rated its suggested urgency HIGHEST. The vulnerability was discovered internally by Suraj Siddharudh, a senior principal product security researcher at Palo Alto Networks.

The bug affects PAN-OS on PA-Series and VM-Series firewalls and on Panorama; Cloud NGFW is not affected. Two details make it more dangerous than the usual "authenticated RCE" label. First, no special configuration is required to exploit it — there is no risky feature to have enabled or misconfiguration to have made. Second, there are no known workarounds; customers with Threat Prevention subscriptions can enable signatures that provide limited protection against known attack patterns, but the fix is the fix. Fixes are available for PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 trains — 12.2.4, 12.1.4-h12, 12.1.7-h8, 12.1.10-h2, 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, and the 11.1 fixed builds — with the widely deployed 11.2.16 release ETA October 15. Customers on older, unsupported versions must upgrade to a supported release.

CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog the same day, requiring federal agencies to mitigate by October 17 — a three-day deadline that matches the urgency of a root-level bug on perimeter devices. The entry is the sixteenth Palo Alto Networks vulnerability in the KEV catalog, three of them added this year. Palo Alto's advisory notes the risk is highest when the management interface is reachable from external IP addresses, and recommends restricting access to a jump box as the only system allowed to manage the firewall. The same day, the company published a dozen other advisories covering PAN-OS, GlobalProtect, and Prisma Cloud products, including denial-of-service, command injection, identity hijacking, privilege escalation, XSS, and path traversal issues.

What Should You Do?

Patch to your train's fixed build immediately — if you are on 11.2 and waiting for 11.2.16, it lands October 15; federal agencies have until October 17, and everyone else should treat that as their deadline too.
Take the management interface off the internet — restrict it to a dedicated jump box on a trusted internal network. If it is routable from outside today, that is the emergency, not the patch.
Block and watch the attacker IPs — add 66.42.72[.]14, 208.83.239[.]114, and 149.248.47[.]234 to block and alert rules, and enable Threat Prevention signatures if you hold the subscription.
Audit credential hygiene on the firewall itself — the exploit needs valid credentials, so check for shared, stale, or leaked admin accounts, enforce MFA where supported, and hunt for logins from unusual sources.

The WAF Angle

"Authenticated RCE" sounds like a small blast radius until you remember how cheaply credentials are acquired: FortiBleed alone amassed 86,644 Fortinet credentials across 194 countries, and password spray against firewall admin accounts is a standing criminal industry. The uncomfortable lesson of this decade's edge-device attacks — from Cisco FMC management consoles under fire to Ivanti Connect Secure this very week — is that the firewall's own admin UI is an application, and it deserves the same treatment you give any internet-adjacent web app: authentication hardening, strict source restrictions, rate limiting, and monitoring. Root on a firewall means stolen policy, network maps, VPN configurations, and certificates — a compromise of the device that is supposed to be protecting you. The WAF-style rules apply one layer down: never expose the management plane, and assume credentials alone will eventually fail.

Palo Alto Networks Ships an Emergency Fix for PAN-OS Zero-Day CVE-2026-0322 — Authenticated Attackers Get Root Code Execution on the Firewall Management Interface