Palo Alto Networks patches a PAN-OS zero-day that attackers are using to run code as root on firewalls

Palo Alto Networks has released fixes for CVE-2026-0322, a high-severity flaw in the PAN-OS management interface that attackers are already exploiting. A logged-in attacker with network access to the interface can run arbitrary code with root privileges. The flaw has a severity score of 8.6. It affects PA-Series and VM-Series firewalls as well as Panorama virtual and M-Series appliances. Cloud NGFW and Prisma Access are not affected. The company says it has seen "very limited exploitation." It found the bug internally and has published indicators of compromise, mainly IP addresses, but has not said who is behind the attacks. SecurityWeek reports that no special configuration is needed for exploitation. Fixes are out for PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2, and a fix for 11.2.16 was expected on October 15. Customers on unsupported versions must upgrade. There is no workaround, so Palo Alto recommends allowing access to the management interface only from trusted internal IP addresses. CISA added the flaw to its Known Exploited Vulnerabilities catalog on Wednesday and gave federal agencies until October 17 to fix it. That short deadline shows how serious attacks on perimeter devices are.