Palo Alto Patches Exploited PAN-OS Zero-Day

Palo Alto Networks released patches Wednesday, Oct. 14, for CVE-2026-0322, a high-severity PAN-OS zero-day exploited in attacks. An authenticated attacker with network access to the management interface can execute arbitrary code with root privileges on an affected firewall. No special configuration is required.

The vulnerability affects PAN-OS on PA-Series and VM-Series firewalls and Panorama management systems. Palo Alto Networks discovered it internally and has not identified the attackers or disclosed details about the incidents involving the flaw.

“Very limited exploitation has been observed targeting the Palo Alto Networks management interface,” the company noted in its advisory.

Palo Alto Networks published indicators of compromise linked to the activity, including several IP addresses. Customers can use the information to check their networks for related connections.

The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog on Wednesday. Federal agencies must apply the available fixes by Oct. 17 under the catalog’s remediation requirements.

The catalog now lists 16 vulnerabilities affecting Palo Alto Networks products, including three added in 2026.

Palo Alto Networks also issued 12 advisories Wednesday covering vulnerabilities in PAN-OS, GlobalProtect and Prisma Cloud. The flaws were rated medium or low severity and included denial-of-service, command injection, identity hijacking, local privilege escalation, cross-site scripting and path traversal issues. The company also updated Prisma Browser with the latest Chromium security updates.