Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks
Information
PAN‑OS is the software that runs all Palo Alto Networks next-generation firewalls. By leveraging the key technologies that are built into PAN‑OS natively—App‑ID, Content‑ID, Device-ID, and User‑ID—you can have complete visibility and control of the applications in use across all users and devices in all locations all the time. And, because inline ML and the application and threat signatures automatically reprogram your firewall with the latest intelligence, you can be assured that all traffic you allow is free of known and unknown threats.
Incident
The U.S. Cybersecurity and Infrastructure Security Agency has added a high-severity Palo Alto Networks PAN-OS vulnerability to its Known Exploited Vulnerabilities catalog after confirming it is being used in real-world attacks.
Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls.
A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
The issue impacts PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma Access are not affected by the vulnerability.
Affected Products
•PAN-OS version 12.2
•PAN-OS version 12.1
•PAN-OS version 11.2
•PAN-OS version 11.1
•PAN-OS version 10.2
Recommendation
•Fixed Version 12.2.4 or later
•Fixed Version 12.1.4-h12, 12.1.7-h8, or 12.1.10-h2 or later
•Fixed Version 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, or 11.2.16 or later
•Fixed Version 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, or 11.1.16-h3 or later
•Fixed Version 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, or 10.2.18-h12 or later
References
•https://docs.paloaltonetworks.com/pan-os?utm
•https://security.paloaltonetworks.com/CVE-2026-0322
•https://thehackernews.com/2026/10/palo-alto-networks-patches-pan-os.html
•https://cybersecuritynews.com/pan-os-vulnerability-exploited-cisa-warns/