Overview
- Palo Alto Networks disclosed CVE-2026-0322 on Wednesday and released patched PAN-OS builds after an internally found management‑interface code injection that can execute arbitrary code as root.
- The U.S. Cybersecurity and Infrastructure Security Agency placed the flaw in its KEV catalog and directed federal civilian agencies to mitigate the issue by October 17.
- Palo Alto said it has observed very limited exploitation and published three IP addresses linked to exploit attempts: 66.42.72.14, 208.83.239.114, and 149.248.47.234.
- Exploitation requires valid credentials and network access to the PAN‑OS management interface, no reliable workaround exists, and the vendor advises restricting management access to trusted IPs or a jump box and applying the listed fixes.
- CISA added this vulnerability alongside actively exploited Cisco and Ahsay flaws, increasing urgency for cross‑vendor patching, forensic hunts, credential rotation, and external log checks that will add short‑term operational strain on IT teams.