Palo Alto Networks has released patches for CVE-2026-0322, a high-severity zero-day vulnerability in PAN-OS that has been actively exploited. The flaw is a remote code execution vulnerability in the software’s management interface. An authenticated attacker with network access can execute arbitrary code with root privileges on an affected firewall.
The company said it has observed “very limited exploitation” and released indicators of compromise (IoCs) to help customers identify potential threats. The vulnerability affects PAN-OS on PA-Series and VM-Series firewalls, as well as Panorama.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog. Federal agencies must apply the patch by October 17.