PAN-OS: Root flaw lets malware slip through Palo Alto firewalls

When the conditions are right, attackers are exploiting a security vulnerability in PAN-OS and using it to target Palo Alto firewalls with malware. Security patches are available for download.

In an advisory, the developers explain that attackers must be authenticated and have network access to carry out an attack. If they meet those requirements, they can execute malicious code with root privileges. The vulnerability (CVE-2026-0322) is rated “ high ” severity.

According to the brief description, the vulnerability is in the PAN-OS management interface. PA- and VM-Series firewalls are affected, but Panorama, Cloud NGFW, and Prisma Access are not. It is currently unclear exactly how these attacks are carried out. Palo Alto says it has observed only very few attacks so far. Nevertheless, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities Catalog .

There are no workarounds. However, admins should restrict access to the management interface to trusted internal IP addresses. Customers with a Threat Prevention subscription can enable limited protection through Threat IDs 510046 and 510047; this requires SSL decryption. The developers say they have fixed the vulnerability in the following versions:

11.2.16 (announced for Oct. 15)

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.