Attackers Exploit Palo Alto PAN-OS Flaw for Root Access as CISA Orders Federal Fix by October 17

Attackers are exploiting a newly disclosed flaw in Palo Alto Networks' PAN-OS firewall software to run code with root privileges.

Palo Alto Networks disclosed the vulnerability, tracked as CVE-2026-0322, in a security advisory published October 14. The advisory says the flaw lets an authenticated attacker with network access execute arbitrary code with root privileges on the firewall. The company said very limited exploitation has been observed targeting the management interface, and rated it 8.6 on the CVSS 4.0 scale.

The US Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalog the same day and requires federal agencies to fix it and check for compromise by October 17. CISA lists its use in ransomware campaigns as unknown.

Affected products

The flaw affects PAN-OS on PA-Series and VM-Series firewalls and on Panorama. Cloud NGFW and Prisma Access are not affected, and no special configuration is required to be affected. Fixed versions have been released for PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2.

Analysts quoted by CSO Online advise tracing who can reach the management interface from outside a trusted network, reviewing admin login history and checking firewall configurations for unexpected changes, since patching is only part of the response.