"Very limited exploitation has been observed targeting the Palo Alto Networks management interface," the company said.
CVE-2026-0322: what the flaw does and who it affects
Palo Alto Networks has published security updates for a high‑severity remote code execution zero‑day tracked as CVE‑2026‑0322. According to the vendor, the vulnerability affects the PAN‑OS management interface and permits authenticated attackers with network access to execute code as root on vulnerable devices. The company assigned the flaw a severity score of 8.6.
Affected appliances and software versions
The vendor says the flaw impacts PA‑Series and VM‑Series firewalls, Panorama virtual and M‑Series appliances. Cloud NGFW and Prisma Access are explicitly not affected. Palo Alto Networks released fixes for affected PAN‑OS 10.2, 11.1, 11.2, 12.1, and 12.2 releases; a fix for PAN‑OS 11.2.16 was expected on October 15. Customers running older, unsupported PAN‑OS versions were told they must upgrade to a supported release.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildObserved exploitation and technical indicators
Palo Alto Networks confirmed in its advisory that it has seen limited exploitation of CVE‑2026‑0322. The company provided three IP addresses linked to exploitation activity: 66.42.72[.]14, 208.83.239[.]114, and 149.248.47[.]234. The vulnerability requires attackers to possess existing credentials and network access to the PAN‑OS management interface, which narrows but does not eliminate the operational risk to exposed management endpoints.
Available mitigations and their limits
Palo Alto Networks advised restricting access to the PAN‑OS management interface to trusted internal IP addresses only. The company also said there are no known workarounds for the vulnerability. Customers with Threat Prevention subscriptions can enable signatures that supply limited protection against known attack patterns, but Palo Alto warned: "Limited coverage in Threat Prevention means that while known attack patterns can be identified using the current Threat ID, variations may exist that cannot currently be detected." The firm further recommended: "If this CVE and Required Configuration for Exposure impact your environment, we recommend upgrading to an unaffected version."
CISA listing and the federal mitigation deadline
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE‑2026‑0322 to its Known Exploited Vulnerabilities catalog and set a mitigation requirement for federal civilian agencies by October 17. That schedule places an immediate compliance window around the vendor’s patch cadence, including the pending 11.2.16 fix noted for October 15.
What this means for technologists, federal agencies, and network operators
- Technologists and security teams: prioritize installation of the released PAN‑OS updates for 10.2, 11.1, 11.2, 12.1, and 12.2 where applicable, enable Threat Prevention signatures as an interim measure, and enforce strict access controls on the management interface.
- Federal civilian agencies: meet the CISA mitigation requirement by October 17, coordinating patch deployment schedules with the available fixes and the expected 11.2.16 release on October 15 where relevant.
- Enterprise network operators: treat management‑interface exposure as the immediate operational risk vector—restrict management IP access to trusted internal addresses and move unsupported PAN‑OS instances to supported releases.
The advisory also notes the vulnerability was discovered internally by Suraj Siddharudh, senior principal product security researcher at Palo Alto Networks. BleepingComputer contacted the vendor to ask when exploitation began, who is behind the attacks, and whether attackers have used the flaw to compromise firewalls or pivot into internal networks; those questions were raised in reporting but not answered in the advisory itself.
The record published by Palo Alto Networks contains concrete fixes and indicators, a tight federal mitigation deadline, and a short list of attacker IPs tied to observed exploitation. The remaining open particulars — timing, attribution, and operational impact inside affected environments — are the facts the advisory and follow‑up reporting leave on the table for organizations that must decide how rapidly to act.
