Palo Alto Firewalls Face an Exploited Zero-Day in the Management Interface: What We Know, What We Don’t, and What to Do Today
Palo Alto Networks has patched CVE-2026-0322, a flaw in the PAN-OS management interface that lets a logged-in attacker run code as root, after seeing it used in attacks. Here is what is confirmed, what is still unclear, and the steps to take now.
Firewalls are supposed to be the part of the network nobody has to worry about. This week, Palo Alto Networks asked its customers to worry. The company released fixes on Wednesday for a PAN-OS flaw it says has already been used in a small number of attacks, and the U.S. government has set a deadline of this Saturday for federal agencies to deal with it.
This briefing is based on BleepingComputer’s report on the advisory, along with coverage from The Hacker News and SecurityWeek.
What we know
- The flaw: CVE-2026-0322, rated high severity with a score of 8.6, is a remote code execution bug in the PAN-OS management interface. An attacker who already has credentials and network access to that interface can run code with root privileges on the firewall.
- What is affected: PAN-OS on PA-Series and VM-Series firewalls, and Panorama in both its virtual and M-Series forms. Palo Alto says Cloud NGFW and Prisma Access are not affected.
- No special setup needed: The company says the issue can be exploited without any particular configuration in place.
- It is in use: Palo Alto says it has seen “very limited exploitation” aimed at the management interface, and it published three IP addresses tied to the activity: 66.42.72[.]14, 208.83.239[.]114 and 149.248.47[.]234.
- Fixes are out: Patched releases are available across the supported PAN-OS 10.2, 11.1, 11.2 and 12.1 lines, with BleepingComputer also listing 12.2. The fix for the 11.2.16 build was expected on October 15. Customers on older, unsupported versions need to move to a supported release.
- No workaround: There is no workaround that removes the risk. Customers with a Threat Prevention subscription can turn on signatures that block known attack patterns, but Palo Alto warns the coverage is limited and variations may slip past.
- Federal deadline: CISA added the flaw to its Known Exploited Vulnerabilities catalog on Wednesday and told federal civilian agencies to address it by October 17.
- Found in-house: The bug was discovered by Suraj Siddharudh, a senior principal product security researcher at Palo Alto Networks.
What we don’t know yet
- Who is behind the attacks, and when they started.
- Whether any firewalls were actually taken over, or used to reach the networks behind them.
- How the attackers obtained the credentials the flaw requires.
Palo Alto has not shared those details, and BleepingComputer says it has asked. SecurityWeek notes the company published about a dozen other advisories the same day, all rated medium or low severity.
What to do today
- Find out who can reach the management interface. Palo Alto’s own advice is to allow only trusted internal IP addresses, ideally a single jump box that is the only system permitted to connect. If the interface is reachable from the internet, close that off first.
- Schedule the upgrade. Check your PAN-OS version against the fixed releases in Palo Alto’s advisory and plan the update for firewalls and Panorama.
- Look for the published IP addresses. Search firewall and management logs for connections from the three addresses listed above.
- Review administrator accounts. Because the attacker needs a valid login, confirm who has admin access, remove stale accounts and change passwords that may have been shared or reused.
What this means for your company
Many small and mid-size businesses rely on a single firewall that an outside provider set up years ago, and nobody has looked at who can sign in to it since. This flaw is a reminder that the device protecting your network needs the same care as any server: limited admin access, unique strong passwords with multi-factor sign-in where the platform supports it, and patches applied on a schedule rather than when someone remembers. If your firewall is managed by a third party, ask them this week which version you are running and when the fix will be installed.
Need help locking down and patching the firewall at the edge of your network? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
