Palo Alto Networks on Wednesday informed customers that it has released patches for a PAN-OS zero-day vulnerability exploited in malicious attacks.
The high-severity flaw is tracked as CVE-2026-0322 and it allows remote code execution. It affects the management interface of PAN-OS and it can be exploited by an authenticated attacker with network access to execute arbitrary code with root privileges on the targeted firewall.
“Very limited exploitation has been observed targeting the Palo Alto Networks management interface,” Palo Alto Networks noted in its advisory.
The zero-day was discovered internally. It affects PAN-OS software on PA-Series and VM-Series firewalls and on Panorama. The security firm noted that no special configuration is needed to exploit CVE-2026-0322.
The cybersecurity giant has released indicators of compromise (IoCs) associated with the observed activity, specifically a few IP addresses.
No information has been shared on the attacks exploiting this new zero-day or the threat actor responsible.
CISA added CVE-2026-0322 to its KEV catalog on Wednesday, instructing federal agencies to address it by October 17.
CISA’s KEV catalog currently includes 16 Palo Alto Networks product vulnerabilities, including three added this year.
On Wednesday, Palo Alto published a dozen other advisories to inform customers about vulnerabilities found and fixed in PAN-OS, GlobalProtect, and Prisma Cloud products, including DoS, command injection, identity hijacking, local privilege escalation, XSS, and path traversal issues. All of these vulnerabilities have been rated medium or low severity.
In addition, the company updated its Prisma Browser to include the latest Chromium updates.
Related: Cisco Warns of Exploited Secure Email Gateway Vulnerability
Related: Palo Alto Networks Patches 13 Vulnerabilities
Related: Splunk, Palo Alto Networks Patch Severe Vulnerabilities
