Palo Alto Networks Patches Actively Exploited PAN-OS RCE Flaw

Firewall RCE patched after limited exploitation

Palo Alto Networks on Oct. 15, 2026 issued security updates for CVE-2026-0322, a high severity remote code execution vulnerability in the PAN-OS management interface with a CVSS score of 8.6. The company said an authenticated attacker with network access can execute arbitrary code with root privileges on the firewall.

The vendor reported very limited exploitation targeting the Palo Alto Networks management interface. It did not describe the activity, identify the actors, or say when it began. Three IP addresses geolocated to the United States were assessed as linked to the attempts: 66.42.72.14, 208.83.239.114, and 149.248.47.234.

Affected platforms and patch versions

The flaw impacts PAN-OS on PA-Series and VM-Series firewalls and on Panorama in virtual and M-Series deployments. Cloud NGFW and Prisma Access are not affected. Palo Alto Networks said no special configuration is required to exploit the issue.

Patches are available in PAN-OS 12.2.4 or later; 12.1.4-h12, 12.1.7-h8, 12.1.10-h2 or later; 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, and 11.2.16 or later, with 11.2.16 estimated for Oct. 15, 2026; 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, and 11.1.16-h3 or later; and 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, and 10.2.18-h12 or later.

To reduce risk, the company recommended restricting access to the management interface to trusted internal IP addresses, or to a jump box that is the only system allowed to reach it. Suraj Siddharudh, a senior principal product security researcher at Palo Alto Networks, discovered and reported the vulnerability.

CISA adds PAN-OS and Cisco email flaws to KEV

Cisco separately warned that threat actors are exploiting CVE-2026-76519, a critical flaw in Cisco Secure Email Gateway with a CVSS score of 9.8. The company said improper handling of email attachments when the file reputation service is enabled could let an unauthenticated remote attacker send a crafted attachment, write arbitrary files on the underlying operating system, and execute commands with root privileges.

CISA has added CVE-2026-0322 and CVE-2026-76519 to its Known Exploited Vulnerabilities catalog, requiring Federal Civilian Executive Branch agencies to prioritize fixes by Oct. 17, 2026.

Sources: The Hacker News