Palo Alto Networks has released security updates to address a high-severity remote code execution (RCE) vulnerability in its PAN-OS software. Tracked as CVE-2026-0322, the flaw has a CVSS score of 8.6 out of 10. The company has reported limited exploitation targeting the firewall management interface, making this an important security concern for organizations using affected products.
The vulnerability affects the management interface of PAN-OS, the operating system used by Palo Alto Networks firewalls. An authenticated attacker with network access to a vulnerable interface could exploit the flaw to execute arbitrary code with root privileges. Root access provides the highest level of system control, potentially allowing an attacker to carry out serious actions on a compromised firewall.
The affected products include PA-Series and VM-Series firewalls, as well as Panorama virtual and M-Series appliances. However, Palo Alto Networks has stated that Cloud NGFW and Prisma Access are not affected by this vulnerability. Since exploitation requires authentication and network access, organizations should carefully review their management interface exposure and ensure that privileged accounts are properly secured.
To address the issue, Palo Alto Networks has released security fixes across several PAN-OS release branches, including versions 10.2, 11.1, 11.2, 12.1 and 12.2. Administrators should consult the official security advisory to identify the correct patched version for their systems. The company also recommends restricting management interface access to trusted internal IP addresses and using controlled administrative access.
The company credited security researcher Suraj Siddharudh with discovering and reporting the vulnerability. It also identified three IP addresses associated with the observed threat activity: 66.42.72[.]14, 208.83.239[.]114 and 149.248.47[.]234. Security teams can use these indicators during investigations, while reviewing relevant firewall logs and checking for suspicious activity that could indicate attempted or successful exploitation.
This incident highlights the importance of timely patch management and securing administrative interfaces across enterprise networks. Even when a vulnerability requires authentication, exposed management services and compromised credentials can increase the risk. Organizations using affected PAN-OS versions should prioritize applying the relevant security updates, restrict access to trusted sources and investigate unusual activity to reduce the possibility of further compromise.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
