Palo Alto Networks on Wednesday informed customers that it has released patches for a PAN-OS zero-day vulnerability exploited in malicious attacks.
The high-severity flaw is tracked as CVE-2026-0322 and it allows remote code execution. It affects the management interface of PAN-OS and it can be exploited by an authenticated attacker with network access to execute arbitrary code with root privileges on the targeted firewall.
“Very limited exploitation has been observed targeting the Palo Alto Networks management interface,” Palo Alto Networks noted in its advisory.
The zero-day was discovered internally. It affects PAN-OS software on PA-Series and VM-Series firewalls and on Panorama. The security firm noted that no special configuration is needed to exploit CVE-2026-0322.
The cybersecurity giant has released indicators of compromise (IoCs) associated with the observed activity, specifically a few IP addresses.
No information has been shared on the attacks exploiting this new zero-day or the threat actor responsible.
CISA added CVE-2026-0322 to its KEV catalog on Wednesday, instructing federal agencies to address it by October 17.
CISA’s KEV catalog currently includes 16 Palo Alto Networks product vulnerabilities, including three added this year .
On Wednesday, Palo Alto published a dozen other advisories to inform customers vulnerabilities found and fixed in PAN-OS, GlobalProtect, and Prisma Cloud products, including DoS, command injection, identity hijacking, local privilege escalation, XSS, and path traversal issues. All of these vulnerabilities have been rated medium or low severity.
In addition, the company updated its Prisma Browser to include the latest Chromium updates.
Related : Cisco Warns of Exploited Secure Email Gateway Vulnerability
Related : Palo Alto Networks Patches 13 Vulnerabilities
Related : Splunk, Palo Alto Networks Patch Severe Vulnerabilities
Cisco Warns of Exploited Secure Email Gateway Vulnerability
Unauthenticated, remote attackers could write arbitrary files to the operating system and execute commands with root privileges.
Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day
The most important is CVE-2026-96951, a security feature bypass flaw in Windows that has been exploited in the wild.
Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN
CVE-2026-104935 affects Ivanti Connect Secure and it can be exploited for unauthenticated remote code execution with elevated privileges.
Bricksforge WordPress Plugin Vulnerability Exploited in the Wild
The vulnerability tracked as CVE-2026-85097 can allow threat actors to take control of the targeted WordPress websites.
Critical SonicWall Vulnerability Exploited Days After Disclosure
CVE-2026-102255 is a pre-authenticated SSRF flaw that could allow attackers to perform unauthorized operations.
Attackers Target Critical Atlassian Vulnerability Within Hours of PoC Publication
Threat actors have started targeting CVE-2026-21589, a critical vulnerability in Atlassian’s self-hosted Data Center products.
Exploitation Hits Rejetto HFS Vulnerability Discovered by AI
CVE-2026-61500 allows attackers to recover the session-cookie signing key and gain administrative access and RCE.
Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier
Citrix has confirmed that a new zero-day vulnerability, CVE-2026-88779, emerged just days after two other exploited flaws were patched.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
