Overview
- Palo Alto disclosed a high-severity authenticated remote code execution bug, tracked as CVE-2026-0322, that lets an attacker with valid credentials and network access to the management interface run code as root on PA‑Series, VM‑Series and Panorama appliances.
- The company released fixes for most PAN-OS branches and said a patch for the remaining 11.2.16 build was expected on Oct. 15, while warning there are no known workarounds.
- Palo Alto reported very limited active exploitation and published three IP addresses it links to observed exploit attempts: 66.42.72[.]14, 208.83.239[.]114, and 149.248.47[.]234.
- Administrators are urged to restrict management-interface access to trusted internal IPs or a jump box because exploitation requires both network access to the management plane and valid credentials, and Threat Prevention signatures offer only limited coverage for variations.
- U.S. Cybersecurity and Infrastructure Security Agency added the vulnerability to its KEV catalog and directed Federal Civilian Executive Branch agencies to remediate by Oct. 17, raising the urgency for organizations that manage exposed or shared management interfaces.