Cybersecurity
Palo Alto fixes exploited PAN-OS RCE flaw
Palo Alto Networks released updates for a PAN-OS remote-code-execution flaw after saying it had seen limited exploitation, while CISA ordered federal agencies to mitigate the issue by 17 October.
- Palo Alto Networks said it released security updates for CVE-2026-0322, a PAN-OS remote-code-execution vulnerability.
- The company said the flaw affected the management interface and could let authenticated attackers with network access run code as root.
- Palo Alto Networks said it had seen limited exploitation of the issue and named three IP addresses it said were involved.
- CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities catalogue and set 17 October as the mitigation deadline for federal civilian agencies.
Palo Alto Networks said it had issued fixes for CVE-2026-0322 after identifying limited exploitation of the PAN-OS flaw. The company said authenticated attackers with network access to the management interface could use it to execute code as root.
The bug affected PA-Series and VM-Series firewalls, along with Panorama virtual and M-Series appliances, according to Palo Alto Networks. The company said Cloud NGFW and Prisma Access were not affected.
Palo Alto Networks said the flaw was discovered internally by Suraj Siddharudh, a senior principal product security researcher at the company. It also said that restricting management-interface access to trusted internal IP addresses was recommended.
The company said fixes were available for PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2, with a fix for PAN-OS 11.2.16 due on 15 October. It said older unsupported versions needed upgrading to a supported release.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue and required federal civilian agencies to mitigate it by 17 October. Palo Alto Networks said customers with Threat Prevention subscriptions could enable signatures that offered limited protection against known attack patterns.
Named in this story
People
- Suraj Siddharudh
- discovered the vulnerability internally
Companies
- Palo Alto Networks
- issued the fixes and security advisory
Governments and agencies
- U.S. Cybersecurity and Infrastructure Security Agency
- added the flaw to its exploited-vulnerabilities list and set a deadline
Products and systems
- PAN-OS
- the firewall operating system affected by the flaw
- CVE-2026-0322
- the tracked vulnerability identifier
- PA-Series
- firewall line affected by the vulnerability
- VM-Series
- firewall line affected by the vulnerability
- Panorama
- virtual and M-Series appliances were affected
- Cloud NGFW
- was said not to be affected
- Prisma Access
- was said not to be affected
- Threat Prevention
- subscriptions can enable signatures for limited protection
How the source tells it
The piece is a straightforward security report, with a mild sense of urgency created by exploitation reports and a federal mitigation deadline.
- urgency a fixed mitigation deadline and advice to upgrade immediately