PAN-OS CVE-2026-0322 Zero-Day Exploited in Attacks
Palo Alto Networks recently disclosed a critical zero-day vulnerability actively exploited against enterprise firewalls. The security flaw allows authenticated adversaries to execute arbitrary commands with root privileges. Consequently, an attacker can seize total operational control over the perimeter defense appliance. The vendor promptly released security patches, assigning the flaw a high-severity CVSS score of 8.6.
Root Execution via Management Interface
According to the official PAN-OS CVE-2026-0322 security advisory, the flaw resides within the web management interface. Exploiting this vulnerability requires two specific prerequisites. First, the threat actor must possess valid administrative credentials. Second, the adversary must have direct network access to the web interface. Once attackers satisfy both conditions, they can run arbitrary code with root authority. Therefore, remote unauthenticated attackers cannot compromise exposed firewalls arbitrarily.
Code Injection Classification and Mechanics
Security analysts classified the defect as CWE-94, which represents improper control of code generation. Although Palo Alto Networks withheld intricate technical exploit details, the attack mechanism remains straightforward. The exploit demands no user interaction or unusual device settings. However, possessing valid account credentials remains a mandatory prerequisite for successful compromise.
Affected Hardware Models and Software Branches
This critical vulnerability threatens a wide spectrum of corporate security hardware and virtual deployments. Specifically, the flaw impacts physical PA-Series firewalls and virtual VM-Series appliances. Furthermore, it affects Panorama management servers on virtual platforms and M-Series devices. The vulnerability spans PAN-OS versions 10.2, 11.1, 11.2, 12.1, and 12.2. Fortunately, Cloud NGFW and Prisma Access environments remain completely unaffected.
Targeted Exploitation in the Wild
Palo Alto Networks confirmed observing an extremely limited number of active exploitation attempts. While the vendor did not disclose victim identities, telemetry linked attacks to three specific IP addresses: 66.42.72.14, 208.83.239.114, and 149.248.47.234. Consequently, administrators must inspect firewall audit logs immediately for connection attempts from these origins. Moreover, teams should strictly isolate management interfaces to trusted internal subnets.
Patch Deployment and Interim Mitigations
Palo Alto Networks published immediate patches across all impacted release branches. For PAN-OS 12.2, organizations must upgrade to version 12.2.4 or later. In the 12.1 branch, administrators should deploy builds 12.1.4-h12, 12.1.7-h8, or 12.1.10-h2. For branches 10.2, 11.1, and 11.2, administrators should consult official vendor tables to select appropriate hotfixes. Merely restricting network access cannot fully eliminate the vulnerability.
Notably, no comprehensive workaround exists without applying the software updates. Security signatures Threat Prevention 510046 and 510047 offer protection against known exploit variants. However, these signatures require active SSL decryption on management traffic. Because successful exploitation grants root access on core gateway devices, organizations must deploy the vendor patches urgently.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
