A root flaw on the firewall's own door

Palo Alto Networks said on Wednesday that attackers have exploited CVE-2026-0322, a remote code execution flaw in the management interface of its PAN-OS firewall software. "Very limited exploitation has been observed targeting the Palo Alto Networks management interface," the company said in its security advisory. The US Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalogue the same day and gave federal civilian agencies until 17 October to act.

The advisory scores the flaw 8.6 on the CVSS 4.0 scale, rated high, with a suggested urgency of "highest". An attacker needs high-privilege credentials and network access to the management interface, and can then run code as root on the firewall. The advisory says no special configuration is needed for a device to be affected, and that the risk is highest where the management interface is reachable from the internet. It credits an internal researcher, Suraj Siddharudh, with finding the issue.

Affected products are the PA-Series and VM-Series firewalls and Panorama, in both virtual and M-Series forms. Cloud NGFW and Prisma Access are not affected. The advisory lists fixed releases for the 10.2, 11.1, 11.2, 12.1 and 12.2 branches and tells users of older, unsupported versions to move to a supported fixed release. BleepingComputer reported on Wednesday that a fix for 11.2.16 was expected on Thursday; the advisory, updated on Thursday, now lists 11.2.16 among the fixed versions.

The company says there are no known workarounds. Restricting management access to trusted internal IP addresses, or to a single jump box, reduces the risk. Customers with a Threat Prevention subscription get what the company calls limited coverage from Threat IDs 510046 and 510047, in content version 9159-10287 or later, but only if they route management traffic through a data-plane interface, replace the certificate for inbound management traffic, decrypt that traffic so the firewall can inspect it, and enable threat prevention on it.

Several basic facts are not public. Neither the advisory nor BleepingComputer's report says when exploitation began or who is behind it. BleepingComputer said it had asked Palo Alto Networks those questions and whether attackers had compromised firewalls or used them to reach internal networks. The advisory lists three IP addresses associated with the activity.

The credential requirement narrows the risk but does not remove it. A flaw that needs a login is still a route to root for anyone who has stolen or guessed a management password, and the advisory's own first advice, keeping the interface off untrusted networks, is a reminder that management ports are often reachable from places they should not be. "Very limited" is the company's own assessment and has not been independently verified.

CISA's catalogue entry sets the deadline under its Binding Operational Directive 26-04 and marks the flaw for forensic triage. The deadline binds only US federal civilian agencies, but private operators often treat the catalogue as a priority list.

Edge devices have supplied a steady run of exploited flaws this year. Komposite reported on a fully patched VPN that attackers could still take to root and on a third NetScaler patch in eleven days. The PAN-OS case differs in that the entry point is the management plane, the part of the device that administrators are told to isolate.