Palo Alto Networks Warns of PAN-OS RCE Flaw Exploited in Attacks

Palo Alto Networks Patches PAN-OS RCE Already Under Attack

Palo Alto Networks has released security updates for CVE-2026-0322, a high-severity remote code execution flaw in the PAN-OS management interface that the company confirms has already been exploited in limited attacks. The vulnerability, carrying a CVSS score of 8.6, allows an authenticated attacker with network access to the management interface to execute arbitrary code with root privileges on affected firewalls and Panorama appliances. The vendor disclosed the flaw and shipped fixes on October 14, 2026, and the Cybersecurity and Infrastructure Security Agency (CISA) has added it to the Known Exploited Vulnerabilities (KEV) catalog, giving U.S. federal civilian agencies until October 17, 2026 to remediate.

Palo Alto Networks described the in-the-wild activity as "very limited exploitation," and noted that "the risk is highest when you allow access to the management interface from external IP addresses on the internet." Researchers tracking the campaign have tied the attacks to three IP addresses: 66.42.72[.]14, 208.83.239[.]114, and 149.248.47[.]234.

Vulnerability Details

How the Flaw Works

Authenticated Code Injection to Root

CVE-2026-0322 is a code injection vulnerability (CWE-94) in the PAN-OS management interface. An attacker who already holds valid administrator credentials, and who has network reachability to the management plane, can supply crafted input that PAN-OS fails to properly neutralize before using it to construct executable code. Because the vulnerable process runs with elevated privileges, successful exploitation hands the attacker root-level code execution on the device — full control of the firewall or Panorama appliance, not just the management application.

The PR:H (privileges required: high) component of the CVSS vector is the key detail: this is not an unauthenticated, internet-wide "patch today or get owned" scenario like some prior PAN-OS management-interface bugs. An attacker needs a working admin login first. That said, Palo Alto Networks' own advisory language — warning that risk is "highest" when the interface is reachable from the public internet — makes clear that credential compromise plus internet-exposed management access is the realistic attack chain security teams should assume is already being tested.

Who Is Exploiting It

Palo Alto Networks has not attributed the activity to a named threat actor, describing it only as "very limited exploitation." Independent researchers tracking the campaign have published three source IP addresses observed probing or attacking the management interface: 66.42.72[.]14, 208.83.239[.]114, and 149.248.47[.]234. No public proof-of-concept exploit code has been confirmed as of this writing, which may be part of why exploitation volume has stayed low — but KEV listing and the compressed federal remediation window signal that CISA considers active, ongoing risk rather than a one-off incident.

Affected Versions and Fixes

Fixes are available across every supported branch, though the exact fixed build varies by branch and hotfix lineage:

Organizations running versions no longer receiving hotfixes for their branch must upgrade to a supported, fixed release — there is no backport for end-of-life trains.

Impact Assessment

Recommendations

For PAN-OS Administrators

• Patch immediately to the fixed version for your branch listed above; where 11.2.16 is the target fix and not yet available, apply the nearest available hotfix and monitor for the October 15, 2026 release.
• Restrict management interface access to trusted internal IP addresses only — do not expose the PAN-OS management interface directly to the internet.
• Route management traffic through a dedicated jump box that serves as the sole access point, rather than allowing broad network reachability to the interface.
• Treat this as a priority even though exploitation requires authentication: compromised or weak admin credentials combined with internet-facing management access is a realistic, already-observed attack path.

For Security Teams / Incident Responders

• Enable Threat Prevention signatures 510046 and 510047, which provide limited protection against known attack patterns (requires SSL decryption and Applications/Threats content version 9159-10287 or later).
• Review management-interface access logs for connections from the known malicious IPs — 66.42.72[.]14, 208.83.239[.]114, and 149.248.47[.]234 — and treat any match as a likely compromise requiring full incident response.
• Audit administrator accounts on internet-reachable PAN-OS management interfaces for weak, reused, or unrotated credentials, since authenticated access is a prerequisite for exploitation.
• Replace certificates used for inbound management traffic and ensure SSL decryption is configured where Threat Prevention signatures are relied upon for detection.
• Confirm there is no workaround beyond patching — plan the upgrade window now rather than relying on mitigations alone.

For Organizations Running Panorama

• Apply the same fixed-version guidance to Panorama virtual and M-Series appliances, which are affected alongside PA-Series and VM-Series firewalls.
• Verify Panorama's own management access is similarly restricted, since a compromised Panorama instance can affect policy pushed to every managed firewall.

Key Takeaways

1. CVE-2026-0322 is a CVSS 8.6 authenticated RCE in the PAN-OS management interface, allowing root-level code execution on PA-Series, VM-Series, and Panorama appliances.
2. Exploitation requires existing administrator credentials — this is not an unauthenticated, internet-wide exposure, but Palo Alto Networks warns risk is highest on internet-facing management interfaces.
3. Limited exploitation is already confirmed, tied to three identified attacker IP addresses, prompting CISA to add the flaw to its KEV catalog with an October 17, 2026 federal deadline.
4. Fixes are available now across all affected branches (10.2, 11.1, 11.2, 12.1, 12.2), though exact fixed builds vary by hotfix lineage — check the specific version table before upgrading.
5. No workaround exists. Restricting management-interface exposure and enabling Threat Prevention signatures 510046/510047 reduce risk but do not replace patching.
6. Cloud NGFW and Prisma Access are unaffected, limiting exposure to on-premises and appliance-based PAN-OS deployments.

Sources

• BleepingComputer — Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks
• Palo Alto Networks Security Advisories — CVE-2026-0322
• CISA Known Exploited Vulnerabilities Catalog