Palo Alto Networks Patches PAN-OS Flaw Giving Attackers Root Access, Exploitation Confirmed; CISA Sets Oct. 17 Deadline

Palo Alto Networks published an advisory on Wednesday, Oct. 14, for a high-severity flaw in PAN-OS, the software that runs its firewalls. The company says attackers are already using it.

The flaw is tracked as CVE-2026-0322 and carries a CVSS 4.0 score of 8.6. It sits in the management interface. An attacker with valid credentials and network access to that interface can execute arbitrary code with root privileges on the firewall, according to the advisory.

"Very limited exploitation has been observed targeting the Palo Alto Networks management interface," the company said.

What is affected

The bug hits PAN-OS on PA-Series and VM-Series firewalls, and on Panorama in both virtual and M-Series form. Cloud NGFW and Prisma Access are not affected.

The advisory says no special configuration is needed to be vulnerable. The company rated its suggested urgency as highest.

Palo Alto's own scoring marks the privileges required as high, meaning an attacker needs existing admin-level access. The company's guidance is that risk is minimized when the management interface is limited to trusted internal IP addresses, per its recommended deployment practices. The advisory also says risk is highest when that interface is reachable from external addresses on the internet.

A tighter option: restrict access to a single jump box that is the only system allowed to reach the interface. Palo Alto's scoring puts the risk at 8.5 under that setup, still in the high range.

Patches and gaps

Fixes are out for PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2, with hotfix releases listed for each maintenance line. The release for PAN-OS 11.2.16, the upgrade path for customers on 11.2.14 and 11.2.15, carries an estimated date of today, Oct. 15.

Customers on unsupported versions have to move to a supported fixed release.

Palo Alto says there are no known workarounds. Customers with Threat Prevention subscriptions can turn on signatures, but the company admits the coverage is limited. "While known attack patterns can be identified using the current Threat ID, variations may exist that cannot currently be detected," the advisory says.

The company published three IP addresses tied to exploit attempts: 66.42.72[.]14, 208.83.239[.]114 and 149.248.47[.]234. Palo Alto says the vulnerability was found internally by Suraj Siddharudh, a senior principal product security researcher at the company.

Federal deadline

The Cybersecurity and Infrastructure Security Agency added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog the same day, citing evidence of active exploitation. Federal civilian agencies have until Oct. 17, three days, to act.

The entry also triggers forensic triage under Binding Operational Directive 26-04. CISA says the directive "establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied." Agencies must apply vendor mitigations or stop using the product if mitigations are not available. CISA lists the flaw's use in ransomware campaigns as unknown.

Patching alone will not settle it, according to outside security practitioners. Yih Khai Wong, senior research manager for security services at IDC Asia/Pacific, said teams should trace who can reach the management interface from outside a trusted network and review admin login history for unusual activity. He added that firewall configurations should be checked for unexpected changes, "since a compromised device can be quietly reconfigured to remain compromised."

Vibhum Dubey, a cybersecurity researcher and red teamer, said teams should check Panorama and every managed firewall and preserve evidence before making changes.

Same-day Cisco warning

CISA's additions also included CVE-2026-76519, a CVSS 9.8 flaw in Cisco Secure Email Gateway. Cisco says it stems from improper handling of email attachments when the file reputation service is enabled in Advanced Malware Protection. A crafted attachment sent through an affected device could let an attacker write arbitrary files and run commands as root.

Cisco says its security response team became aware of active exploitation in October 2026. The company warns that attackers with root access may remove or hide evidence, and tells admins to check network and firewall logs outside the device for suspicious activity. Unlike the Palo Alto bug, this one does not need credentials.

What Palo Alto has not said

The company has not said when the exploitation began, who is behind it, or whether attackers took over firewalls or used them to move into internal networks. Palo Alto has not answered those questions publicly. Help Net Security reported that Ahsay products were also added to the CISA catalog in the same batch.

The next checkpoint is Saturday, Oct. 17, when federal agencies must show fixes and compromise checks. Whether any compromised firewalls turn up in those checks, and what the attackers did with root access, is still unanswered.