--- title: Palo Alto Networks warns of PAN-OS RCE flaw exploited in... description: Palo Alto Networks has patched a high-severity PAN-OS zero-day, CVE-2026-0322 (CVSS 8.6), that lets authenticated attackers with network access to the... canonical: https://daily.dev/posts/palo-alto-networks-warns-of-pan-os-rce-flaw-exploited-in-attacks-wjqp3kd6d twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks | daily.dev og:description: Palo Alto Networks has patched a high-severity PAN-OS zero-day, CVE-2026-0322 (CVSS 8.6), that lets authenticated attackers with network access to the... og:url: https://daily.dev/posts/palo-alto-networks-warns-of-pan-os-rce-flaw-exploited-in-attacks-wjqp3kd6d og:image: https://api.daily.dev/og/posts/wJQp3kd6d.png og:image:alt: Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary Palo Alto Networks has patched a high-severity PAN-OS zero-day, CVE-2026-0322 (CVSS 8.6), that lets authenticated attackers with network access to the management interface execute code as root. Limited active exploitation has been observed. Affected products include PA-Series and VM-Series firewalls plus Panorama appliances; Cloud NGFW and Prisma Access are unaffected. Fixes are out for PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2, with 11.2.16 due October 15. No workarounds exist beyond restricting management interface access and enabling Threat Prevention signatures. CISA added the flaw to its Known Exploited Vulnerabilities catalog, giving federal agencies until October 17 to mitigate. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-0322 and which Palo Alto Networks products does it affect? CVE-2026-0322 is a high-severity PAN-OS management interface vulnerability (CVSS 8.6) that lets authenticated attackers with network access execute code as root. It affects PA-Series and VM-Series firewalls and Panorama virtual and M-Series appliances. Cloud NGFW and Prisma Access are not affected. Palo Alto Networks has confirmed limited active exploitation of the flaw. _Teams tracking firewall vulnerabilities like this one can follow patch and advisory updates on daily.dev._ ### Which PAN-OS versions have fixes for CVE-2026-0322 and is there a workaround? Fixes have been released for PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2, with a patch for PAN-OS 11.2.16 expected October 15. There is no workaround; Palo Alto Networks recommends restricting management interface access to trusted internal IPs and enabling Threat Prevention signatures, though these only provide limited protection against known attack patterns. _Admins planning the PAN-OS upgrade can track rollout details and version fixes via daily.dev._ ### What is the deadline for federal agencies to mitigate CVE-2026-0322 under CISA's KEV catalog? CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog and requires federal civilian agencies to mitigate the vulnerability by October 17. The flaw is being actively exploited, with three attacker IP addresses identified: 66.42.72.14, 208.83.239.114, and 149.248.47.234. _Security teams racing compliance deadlines like this one can keep tabs on KEV catalog entries through daily.dev._ ## Similar posts on daily.dev - [Palo Alto Networks warns of firewall RCE zero-day exploited in attacks](https://daily.dev/posts/palo-alto-networks-warns-of-firewall-rce-zero-day-exploited-in-attacks-zo4m3vufc) · BleepingComputer · 3 upvotes · 0 comments - [Attackers exploit Palo Alto GlobalProtect flaw days after disclosure](https://daily.dev/posts/attackers-exploit-palo-alto-globalprotect-flaw-days-after-disclosure-7jl7oxcpm) · CSO Online · 0 upvotes · 0 comments - [Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy](https://daily.dev/posts/three-steps-to-the-terminal-a-siemens-rox-ii-zero-day-trilogy-sxvkk2j0g) · Unit 42 · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#firewall](https://daily.dev/tags/firewall) [View this post on daily.dev](https://daily.dev/posts/palo-alto-networks-warns-of-pan-os-rce-flaw-exploited-in-attacks-wjqp3kd6d) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks","url":"https://daily.dev/posts/palo-alto-networks-warns-of-pan-os-rce-flaw-exploited-in-attacks-wjqp3kd6d","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/palo-alto-networks-warns-of-pan-os-rce-flaw-exploited-in-attacks-wjqp3kd6d"},"datePublished":"2026-10-14T23:01:38.357Z","dateModified":"2026-10-14T23:02:11.888Z","description":"Palo Alto Networks has patched a high-severity PAN-OS zero-day, CVE-2026-0322 (CVSS 8.6), that lets authenticated attackers with network access to the...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/92c92819c5bc66d470174a31821dcefa?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/92c92819c5bc66d470174a31821dcefa?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/palo-alto-networks-warns-of-pan-os-rce-flaw-exploited-in-attacks-wjqp3kd6d","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,firewall","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/palo-alto-networks-warns-of-pan-os-rce-flaw-exploited-in-attacks-wjqp3kd6d#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-0322 and which Palo Alto Networks products does it affect?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-0322 is a high-severity PAN-OS management interface vulnerability (CVSS 8.6) that lets authenticated attackers with network access execute code as root. It affects PA-Series and VM-Series firewalls and Panorama virtual and M-Series appliances. Cloud NGFW and Prisma Access are not affected. Palo Alto Networks has confirmed limited active exploitation of the flaw. Teams tracking firewall vulnerabilities like this one can follow patch and advisory updates on daily.dev."}},{"@type":"Question","name":"Which PAN-OS versions have fixes for CVE-2026-0322 and is there a workaround?","acceptedAnswer":{"@type":"Answer","text":"Fixes have been released for PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2, with a patch for PAN-OS 11.2.16 expected October 15. There is no workaround; Palo Alto Networks recommends restricting management interface access to trusted internal IPs and enabling Threat Prevention signatures, though these only provide limited protection against known attack patterns. Admins planning the PAN-OS upgrade can track rollout details and version fixes via daily.dev."}},{"@type":"Question","name":"What is the deadline for federal agencies to mitigate CVE-2026-0322 under CISA's KEV catalog?","acceptedAnswer":{"@type":"Answer","text":"CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog and requires federal civilian agencies to mitigate the vulnerability by October 17. The flaw is being actively exploited, with three attacker IP addresses identified: 66.42.72.14, 208.83.239.114, and 149.248.47.234. Security teams racing compliance deadlines like this one can keep tabs on KEV catalog entries through daily.dev."}}]} ```