Palo Alto Networks has released security updates to address a high-severity vulnerability in its PAN-OS software after confirming that the flaw is being actively exploited in the wild.
Tracked as CVE-2026-0322 with a CVSS score of 8.6, the vulnerability affects the PAN-OS management interface and can allow authenticated attackers with network access to execute arbitrary code as root on affected devices. Successful exploitation grants attackers complete control over vulnerable firewalls, significantly increasing the risk of network compromise.
According to Palo Alto Networks, the flaw impacts PA-Series and VM-Series firewalls, as well as Panorama management platforms, including both virtual and M-Series deployments. However, the company confirmed that Cloud NGFW and Prisma Access environments are not affected.
The vendor noted that exploitation does not require any special configuration, making exposed management interfaces particularly attractive targets. Organizations are strongly encouraged to restrict management access to trusted internal networks and, where possible, route administrative access through a dedicated jump server. Limiting access to authorized systems can significantly reduce exposure while patches are being deployed.
Security fixes are now available across multiple supported PAN-OS branches, including versions 12.2, 12.1, 11.2, 11.1, and 10.2. Administrators are advised to upgrade to the latest patched release within their respective version tracks as soon as possible.
While Palo Alto Networks stated that observed exploitation has been "very limited," the company has not disclosed details regarding the threat actors involved, attack objectives, or the duration of the activity. Nevertheless, telemetry indicates that malicious attempts have already targeted exposed management interfaces.
The following U.S.-based IP addresses have been associated with suspected exploitation activity:
- 66.42.72[.]14
- 208.83.239[.]114
- 149.248.47[.]234
The vulnerability was identified and reported internally by Suraj Siddharudh, Senior Principal Product Security Researcher at Palo Alto Networks.
The disclosure comes amid a broader wave of critical network appliance vulnerabilities. Cisco recently warned that threat actors are also exploiting CVE-2026-76519, a critical 9.8 CVSS vulnerability affecting Cisco Secure Email Gateway. The flaw stems from improper handling of email attachments when the file reputation service is enabled and could allow a remote, unauthenticated attacker to write arbitrary files and execute commands with root-level privileges by sending specially crafted email attachments through a vulnerable device.
In response to active exploitation, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both CVE-2026-0322 and CVE-2026-76519 to its Known Exploited Vulnerabilities (KEV) catalog. Federal Civilian Executive Branch (FCEB) agencies have been directed to remediate the vulnerabilities on an accelerated timeline, with mitigation deadlines set for October 17, 2026.
The development highlights the continued focus of attackers on security infrastructure and management interfaces, reinforcing the need for organizations to prioritize timely patching, restrict administrative access, and continuously monitor for signs of compromise.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
