Palo Alto Networks patches PAN-OS zero-day that lets authenticated attackers run code as root on firewalls

TLDR

• Palo Alto released fixes for CVE-2026-0322 (CVSS 8.6), a PAN-OS flaw letting authenticated attackers run code as root.¹²
• Palo Alto reports very limited exploitation, and CISA added it to its Known Exploited Vulnerabilities catalogue on 14 October.¹²³
• Palo Alto recommends restricting management interface access to trusted internal IP addresses.¹²

The advisory, published on 14 October, says no special configuration is needed to be exposed, and that the risk is highest where the management interface is reachable from the internet.² Fixes cover PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2, with the 11.2.16 build expected on 15 October, and customers on unsupported versions must upgrade to a supported release.¹² Customers with a Threat Prevention subscription can enable signatures that give limited protection, though Palo Alto warns that variations of the attack may evade them.¹

Exploitation requires existing credentials, which is why the vendor scores it 8.6 rather than critical, but the advisory does not say how attackers obtained them.¹² The flaw was found internally by Suraj Siddharudh, a senior principal product security researcher at Palo Alto Networks.¹ BleepingComputer asked the company when exploitation began, who is responsible and whether firewalls were used to reach internal networks; those questions were unanswered at publication.¹

Why it matters: an authenticated flaw is easy to dismiss, but attackers are already using it against firewalls, and any organisation with a PAN-OS management interface reachable from the internet should treat the fix as urgent.