Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution

Palo Alto Networks released security updates on Wednesday to address a critical vulnerability in their PAN-OS software. The flaw, identified as CVE-2026-0322 with a CVSS score of 8.6, allows remote code execution within the management interface of the software. This means an attacker who has legitimate network access could potentially execute arbitrary code with root privileges on the firewall.

The vulnerability impacts PAN-OS software on PA-Series and VM-Series firewalls, and on Panorama (both virtual and M-Series) firewalls. However, Cloud NGFW and Prisma Access are not affected. The company noted that no special configuration is required to exploit this issue, but they suggested restricting access to the management interface to only trusted internal IP addresses to mitigate the risk.

Palo Alto Networks has observed minimal exploitation of this vulnerability, but they did not provide further details on the nature of the attacks, the origin of the attackers, or when the exploitation began. The issue is geolocated to the U.S., with specific IP addresses assessed to be involved in the exploit attempts.

Senior Principal Product Security Researcher Suraj Siddharudh was credited for discovering and reporting the vulnerability. Cisco also recently warned of a critical flaw in their Secure Email Gateway, CVE-2026-76519, which could allow unauthenticated remote attackers to write arbitrary files and execute commands on the underlying operating system.

Both vulnerabilities have been added to the Known Exploited Vulnerabilities (KEV) catalog by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), requiring Federal Civilian Executive Branch agencies to prioritize fixes by October 17, 2026.