Palo Alto Networks Patches PAN-OS Zero

Palo Alto Networks on Wednesday informed customers that it has released patches for a PAN-OS zero-day vulnerability exploited in malicious attacks. The high-severity flaw is tracked as CVE-2026-0322 and it allows remote code execution. It affects the management interface of PAN-OS and it can be exploited by an authenticated attacker with network access to execute arbitrary code with root privileges on the targeted firewall. “Very limited exploitation has been observed targeting the Palo Alto Networks management interface,” Palo Alto Networks noted in its advisory. The zero-day was discovered internally. It affects PAN-OS software on PA-Series and VM-Series firewalls and on Panorama. The security firm noted that no special configuration is needed to exploit CVE-2026-0322. The cybersecurity giant has released indicators of compromise (IoCs) associated with the observed activity, specifically a few IP addresses. No information has been shared on the attacks exploiting this new zero-day or the threat actor responsible. CISA added CVE-2026-0322 to its KEV catalog on Wednesday, instructing federal agencies to address it by October 17. CISA’s KEV catalog currently includes 16 Palo Alto Networks product vulnerabilities, including three added this year . On Wednesday, Palo Alto published a dozen other advisories to inform customers vulnerabilities found and fixed in PAN-OS, GlobalProtect, and Prisma Cloud products, including DoS, command injection, identity hijacking, local privilege escalation, XSS, and path traversal issues. All of these vulnerabilities have been rated medium or low severity. In addition, the company updated its Prisma Browser to include the latest Chromium updates. Related : Cisco Warns of Exploited Secure Email Gateway Vulnerability Related : Palo Alto Networks Patches 13 Vulnerabilities Related : Splunk, Palo Alto Networks Patch Severe Vulnerabilities

The high-severity flaw is tracked as CVE-2026-0322 and it allows remote code execution. It affects the management interface of PAN-OS and it can be exploited by an authenticated attacker with network access to execute arbitrary code with root privileges on the targeted firewall. “Very limited exploitation has been observed targeting the Palo Alto Networks management interface,” Palo Alto Networks noted in its advisory. The zero-day was discovered internally. It affects PAN-OS software on PA-Series and VM-Series firewalls and on Panorama. The security firm noted that no special configuration is needed to exploit CVE-2026-0322. The cybersecurity giant has released indicators of compromise (IoCs) associated with the observed activity, specifically a few IP addresses. No information has been shared on the attacks exploiting this new zero-day or the threat actor responsible. CISA added CVE-2026-0322 to its KEV catalog on Wednesday, instructing federal agencies to address it by October 17. CISA’s KEV catalog currently includes 16 Palo Alto Networks product vulnerabilities, including three added this year . On Wednesday, Palo Alto published a dozen other advisories to inform customers vulnerabilities found and fixed in PAN-OS, GlobalProtect, and Prisma Cloud products, including DoS, command injection, identity hijacking, local privilege escalation, XSS, and path traversal issues. All of these vulnerabilities have been rated medium or low severity. In addition, the company updated its Prisma Browser to include the latest Chromium updates. Related : Cisco Warns of Exploited Secure Email Gateway Vulnerability Related : Palo Alto Networks Patches 13 Vulnerabilities Related : Splunk, Palo Alto Networks Patch Severe Vulnerabilities

“Very limited exploitation has been observed targeting the Palo Alto Networks management interface,” Palo Alto Networks noted in its advisory. The zero-day was discovered internally. It affects PAN-OS software on PA-Series and VM-Series firewalls and on Panorama. The security firm noted that no special configuration is needed to exploit CVE-2026-0322. The cybersecurity giant has released indicators of compromise (IoCs) associated with the observed activity, specifically a few IP addresses. No information has been shared on the attacks exploiting this new zero-day or the threat actor responsible. CISA added CVE-2026-0322 to its KEV catalog on Wednesday, instructing federal agencies to address it by October 17. CISA’s KEV catalog currently includes 16 Palo Alto Networks product vulnerabilities, including three added this year . On Wednesday, Palo Alto published a dozen other advisories to inform customers vulnerabilities found and fixed in PAN-OS, GlobalProtect, and Prisma Cloud products, including DoS, command injection, identity hijacking, local privilege escalation, XSS, and path traversal issues. All of these vulnerabilities have been rated medium or low severity. In addition, the company updated its Prisma Browser to include the latest Chromium updates. Related : Cisco Warns of Exploited Secure Email Gateway Vulnerability Related : Palo Alto Networks Patches 13 Vulnerabilities Related : Splunk, Palo Alto Networks Patch Severe Vulnerabilities

The zero-day was discovered internally. It affects PAN-OS software on PA-Series and VM-Series firewalls and on Panorama. The security firm noted that no special configuration is needed to exploit CVE-2026-0322. The cybersecurity giant has released indicators of compromise (IoCs) associated with the observed activity, specifically a few IP addresses. No information has been shared on the attacks exploiting this new zero-day or the threat actor responsible. CISA added CVE-2026-0322 to its KEV catalog on Wednesday, instructing federal agencies to address it by October 17. CISA’s KEV catalog currently includes 16 Palo Alto Networks product vulnerabilities, including three added this year . On Wednesday, Palo Alto published a dozen other advisories to inform customers vulnerabilities found and fixed in PAN-OS, GlobalProtect, and Prisma Cloud products, including DoS, command injection, identity hijacking, local privilege escalation, XSS, and path traversal issues. All of these vulnerabilities have been rated medium or low severity. In addition, the company updated its Prisma Browser to include the latest Chromium updates. Related : Cisco Warns of Exploited Secure Email Gateway Vulnerability Related : Palo Alto Networks Patches 13 Vulnerabilities Related : Splunk, Palo Alto Networks Patch Severe Vulnerabilities

The cybersecurity giant has released indicators of compromise (IoCs) associated with the observed activity, specifically a few IP addresses. No information has been shared on the attacks exploiting this new zero-day or the threat actor responsible. CISA added CVE-2026-0322 to its KEV catalog on Wednesday, instructing federal agencies to address it by October 17. CISA’s KEV catalog currently includes 16 Palo Alto Networks product vulnerabilities, including three added this year . On Wednesday, Palo Alto published a dozen other advisories to inform customers vulnerabilities found and fixed in PAN-OS, GlobalProtect, and Prisma Cloud products, including DoS, command injection, identity hijacking, local privilege escalation, XSS, and path traversal issues. All of these vulnerabilities have been rated medium or low severity. In addition, the company updated its Prisma Browser to include the latest Chromium updates. Related : Cisco Warns of Exploited Secure Email Gateway Vulnerability Related : Palo Alto Networks Patches 13 Vulnerabilities Related : Splunk, Palo Alto Networks Patch Severe Vulnerabilities

No information has been shared on the attacks exploiting this new zero-day or the threat actor responsible. CISA added CVE-2026-0322 to its KEV catalog on Wednesday, instructing federal agencies to address it by October 17. CISA’s KEV catalog currently includes 16 Palo Alto Networks product vulnerabilities, including three added this year . On Wednesday, Palo Alto published a dozen other advisories to inform customers vulnerabilities found and fixed in PAN-OS, GlobalProtect, and Prisma Cloud products, including DoS, command injection, identity hijacking, local privilege escalation, XSS, and path traversal issues. All of these vulnerabilities have been rated medium or low severity. In addition, the company updated its Prisma Browser to include the latest Chromium updates. Related : Cisco Warns of Exploited Secure Email Gateway Vulnerability Related : Palo Alto Networks Patches 13 Vulnerabilities Related : Splunk, Palo Alto Networks Patch Severe Vulnerabilities

CISA added CVE-2026-0322 to its KEV catalog on Wednesday, instructing federal agencies to address it by October 17. CISA’s KEV catalog currently includes 16 Palo Alto Networks product vulnerabilities, including three added this year . On Wednesday, Palo Alto published a dozen other advisories to inform customers vulnerabilities found and fixed in PAN-OS, GlobalProtect, and Prisma Cloud products, including DoS, command injection, identity hijacking, local privilege escalation, XSS, and path traversal issues. All of these vulnerabilities have been rated medium or low severity. In addition, the company updated its Prisma Browser to include the latest Chromium updates. Related : Cisco Warns of Exploited Secure Email Gateway Vulnerability Related : Palo Alto Networks Patches 13 Vulnerabilities Related : Splunk, Palo Alto Networks Patch Severe Vulnerabilities

CISA’s KEV catalog currently includes 16 Palo Alto Networks product vulnerabilities, including three added this year . On Wednesday, Palo Alto published a dozen other advisories to inform customers vulnerabilities found and fixed in PAN-OS, GlobalProtect, and Prisma Cloud products, including DoS, command injection, identity hijacking, local privilege escalation, XSS, and path traversal issues. All of these vulnerabilities have been rated medium or low severity. In addition, the company updated its Prisma Browser to include the latest Chromium updates. Related : Cisco Warns of Exploited Secure Email Gateway Vulnerability Related : Palo Alto Networks Patches 13 Vulnerabilities Related : Splunk, Palo Alto Networks Patch Severe Vulnerabilities

On Wednesday, Palo Alto published a dozen other advisories to inform customers vulnerabilities found and fixed in PAN-OS, GlobalProtect, and Prisma Cloud products, including DoS, command injection, identity hijacking, local privilege escalation, XSS, and path traversal issues. All of these vulnerabilities have been rated medium or low severity. In addition, the company updated its Prisma Browser to include the latest Chromium updates. Related : Cisco Warns of Exploited Secure Email Gateway Vulnerability Related : Palo Alto Networks Patches 13 Vulnerabilities Related : Splunk, Palo Alto Networks Patch Severe Vulnerabilities

In addition, the company updated its Prisma Browser to include the latest Chromium updates. Related : Cisco Warns of Exploited Secure Email Gateway Vulnerability Related : Palo Alto Networks Patches 13 Vulnerabilities Related : Splunk, Palo Alto Networks Patch Severe Vulnerabilities

Related : Cisco Warns of Exploited Secure Email Gateway Vulnerability Related : Palo Alto Networks Patches 13 Vulnerabilities Related : Splunk, Palo Alto Networks Patch Severe Vulnerabilities

Related : Palo Alto Networks Patches 13 Vulnerabilities Related : Splunk, Palo Alto Networks Patch Severe Vulnerabilities

Related : Splunk, Palo Alto Networks Patch Severe Vulnerabilities

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

More from Eduard Kovacs

Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day

Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN

Adobe Patches 176 Vulnerabilities Across 11 Products

Google Partially Reverses Chrome Bug Bounty Cuts

Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach

Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns

Bricksforge WordPress Plugin Vulnerability Exploited in the Wild

Canonical Websites Disrupted in Second DDoS Attack This Year

Cisco Warns of Exploited Secure Email Gateway Vulnerability

AI Agents Navigate Unfamiliar OT Systems and Move Equipment in Minutes, Booz Allen Finds

ICS Patch Tuesday: Siemens Issues 17 Advisories, Rockwell Fixes ArmorBlock Takeover Flaw

Harmonic Security Raises $50 Million for Workforce AI Protection

Virtual Event Today: Zero Trust Strategies Summit

Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages

US Arrests Two in Crackdown on North Korean IT Worker Laptop Farms

Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise

Webinar: The AI Access Risk Already in Your Google Workspace

AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.

Virtual Event: Zero Trust & Identity Strategies Summit 2026

Join as we decipher the world of zero trust and war stories on securing an organization by eliminating implicit trust and continuously validating every stage of a digital interaction.

Flipboard Whatsapp Whatsapp Email