Palo Alto Networks PAN-OS Zero-Day Patched After Remote Code Execution Exploit

Post Views: 16

Palo Alto Networks addressed a critical zero-day vulnerability in its PAN-OS platform, issuing patches after confirming its exploitation in targeted attacks.

Critical Zero-Day Vulnerability in PAN-OS

Vulnerability Details

The flaw, designated CVE-2026-0322, enables remote code execution through the management interface of PAN-OS.

Exploitation Requirements

Attackers require authentication and network access to exploit the issue, allowing them to execute arbitrary code with root privileges on affected firewalls.

Impact on Devices

The vulnerability impacts PA-Series and VM-Series devices, as well as Panorama management systems.

Internal Discovery and Exploitation

Palo Alto Networks reported that the flaw was identified internally and does not require specific configurations to exploit.

Indicators of Compromise

Indicators of compromise, including several IP addresses, were disclosed alongside the patch.

Attack Details

No details about the attackers or specific incidents leveraging the vulnerability have been publicly shared.

CISA’s Action and KEV Inclusion

CISA’s Mandate

The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-0322 to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to resolve the issue by October 17.

KEV List Context

This marks the 16th Palo Alto Networks-related vulnerability in CISA’s KEV list, with three added this year.

Additional Advisories and Updates

Additional Advisories

In parallel, Palo Alto Networks released 12 additional advisories for PAN-OS, GlobalProtect, and Prisma Cloud, addressing medium- and low-severity issues such as denial-of-service attacks, command injection, identity hijacking, privilege escalation, cross-site scripting, and path traversal.