Security flaw·Major

Palo Alto firewalls: exploited flaw gives root access

Fix availableAttackers already use itAffects website owners

PAN-OS (PA-Series, VM-Series, Panorama)

What it changes for you

Nothing visible for you; companies must update their firewalls.

A flaw in Palo Alto Networks firewalls lets someone with access to the admin interface take full control, and it has been used in limited attacks. It matters to companies running these firewalls, not to individuals.

Started Oct 14, 2026Updated Oct 15, 2026

Post on X

What should I do?

You: Nothing to do.
If you run a website or an app: Upgrade PAN-OS to the fixed release for your branch and restrict the management interface to trusted internal IP addresses. There is no full workaround. Cloud NGFW and Prisma Access are not affected.

What is affected

PAN-OS (PA-Series, VM-Series, Panorama)Fixed in 12.2.4, 12.1.4-h12, 12.1.7-h8, 12.1.10-h2, 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16, 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3, 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12

CVE-2026-0322Severity score 8.6 out of 10

Timeline

Fix available · Oct 15, 2026
Advisory updated.
Palo Alto Networks
Fix available · Oct 14, 2026
CISA adds CVE-2026-0322 to its Known Exploited Vulnerabilities catalog.
CISA
Fix available · Oct 14, 2026
Palo Alto Networks publishes CVE-2026-0322, an authenticated code injection in the PAN-OS management interface, and reports very limited exploitation.
Palo Alto Networks

Palo Alto firewalls: exploited flaw gives root access

What should I do?

What is affected

Timeline

Sources