PAN-OS vulnerability exploited for root code execution
The PAN-OS vulnerability tracked as CVE-2026-0322 is being actively exploited, prompting security updates for affected firewall and Panorama systems. Palo Alto Networks rates the flaw high severity, with a Common Vulnerability Scoring System (CVSS) score of 8.6, and says exploitation can give an authenticated attacker root-level control of a device.
CVE-2026-0322 is a remote code execution (RCE) vulnerability in the PAN-OS management interface, the administrative system used to configure and control the product. An attacker must have valid authentication and network access to that interface. If those conditions are met, the flaw allows arbitrary code to run with root privileges, meaning the highest level of control over the underlying system. The vendor says no special product configuration is required for exploitation.
The vulnerability affects PAN-OS on PA-Series and VM-Series firewalls. It also affects Panorama deployments running as virtual systems or on M-Series appliances. Cloud NGFW and Prisma Access are not affected. Palo Alto Networks said it had observed “very limited exploitation” directed at the management interface, but it did not disclose what the attackers did, when the activity started or who was responsible.
The vendor associated three U.S.-geolocated IP addresses with the exploitation attempts: 66.42.72[.]14, 208.83.239[.]114 and 149.248.47[.]234. These details can help security teams review relevant network records alongside other evidence of suspicious access. The vulnerability was discovered and reported by a senior principal product security researcher within Palo Alto Networks.
Fixed PAN-OS releases are available across several supported branches. For PAN-OS 12.2, the fixed level is 12.2.4 or later. The PAN-OS 12.1 fixes are 12.1.4-h12, 12.1.7-h8, 12.1.10-h2 or later versions in those respective release lines. Administrators should match the update to the branch already deployed rather than treating the list as a single upgrade path.
For PAN-OS 11.2, the listed fixed builds are 11.2.4-h22, 11.2.7-h21, 11.2.10-h15 and 11.2.13-h3 or later. PAN-OS 11.2.16 is also listed, with availability expected on October 15, 2026. The PAN-OS 11.1 fixes are 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15 and 11.1.16-h3 or later in each corresponding line.
PAN-OS 10.2 users should move to 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11 or 10.2.18-h12 or later, depending on their current release line. Because exploitation has already been observed, organisations running an affected version should treat installation of the relevant security update as a priority. Website operators whose services depend on networks protected or administered through these systems should confirm with their internal IT team or hosting provider that affected management systems have been identified and updated.
Palo Alto Networks also recommends limiting access to the management interface to trusted internal IP addresses. Its more restrictive mitigation is to permit management access only through a jump box, a designated intermediary computer used to reach sensitive administrative systems. This does not replace the security update, but it reduces the number of systems that can connect to the vulnerable interface.
A separate actively exploited issue affects Cisco Secure Email Gateway. CVE-2026-76519 has a CVSS score of 9.8 and can be exploited remotely without authentication when the file reputation service is enabled. Cisco attributes the problem to incorrect handling of email attachments. An attacker can send a specially prepared attachment through an affected device, potentially writing arbitrary files and executing commands with root privileges on its operating system.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added both CVE-2026-0322 and CVE-2026-76519 to its Known Exploited Vulnerabilities (KEV) catalog. Federal Civilian Executive Branch agencies are required to prioritise the fixes by October 17, 2026. Inclusion in the catalog confirms that exploitation has been observed and makes prompt remediation particularly important for organisations using either affected product.
For businesses that need help assessing firewall administration within their broader technology environment, AEU-I provides security-first IT, infrastructure and consulting. Regardless of who manages the device, the immediate priorities are to identify affected PAN-OS installations, apply the correct fixed release and restrict management access to trusted systems.