Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation.
The vulnerability, tracked as CVE-2026-0322 (CVSS score: 8.6), is a case of remote code execution in the management interface.
“A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall,” Palo Alto Networks said.
The issue impacts PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma Access are not affected by the vulnerability.
Palo Alto Networks said that no special configuration is required to exploit the issue, but said the security risk can be minimized by restricting access to the management interface to only trusted internal IP addresses.
“You can reduce the risk of exploitation by restricting access to a jump box that is the only system allowed to access the management interface,” it said.
Patches are available in the following versions –
- PAN-OS >= 12.2.4
- PAN-OS >= 12.1.4-h12, >= 12.1.7-h8, >= 12.1.10-h2
- PAN-OS >= 11.2.4-h22, >= 11.2.7-h21, >= 11.2.10-h15, >= 11.2.13-h3, >= 11.2.16 (ETA: October 15, 2026)
- PAN-OS >= 11.1.4-h37, >= 11.1.6-h39, >= 11.1.7-h11, >= 11.1.10-h35, >= 11.1.13-h15, >= 11.1.16-h3
- PAN-OS >= 10.2.7-h38, >= 10.2.10-h41, >= 10.2.13-h26, >= 10.2.16-h11, >= 10.2.18-h12
The network security company also acknowledged it has seen “very limited exploitation” targeting the Palo Alto Networks management interface, but did not elaborate on the nature of the malicious activity involved, who is behind the effort, or when it began.
The following IP addresses geolocated to the U.S. are assessed to be linked to the exploit attempts –
- 66.42.72[.]14
- 208.83.239[.]114
- 149.248.47[.]234
It credited Suraj Siddharudh, a senior principal product security researcher at Palo Alto Networks, with discovering and reporting the vulnerability.
The disclosure comes as Cisco warned that threat actors are exploiting a critical flaw in Cisco Secure Email Gateway (CVE-2026-76519, CVSS score: 9.8) that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
“This vulnerability is due to improper handling of email attachments when the file reputation service is enabled,” it said. “An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.”
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has since added both CVE-2026-0322 and CVE-2026-76519 to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to prioritize fixes by October 17, 2026.
