Palo Alto Networks patches PAN-OS RCE flaw amid active exploitation

Palo Alto Networks has released fixes for a high-severity remote-code-execution flaw in the PAN-OS management interface, while warning that it has seen very limited exploitation targeting the product. CVE-2026-0322 carries a CVSS score of 8.6 and requires an authenticated attacker with network access to execute arbitrary code with root privileges.¹

The flaw affects PAN-OS on PA-Series and VM-Series firewalls, as well as Panorama virtual and M-Series appliances. Palo Alto Networks says Cloud NGFW and Prisma Access are not affected. Its advisory rates the issue as high urgency and describes its exploitation maturity as “attacked”.¹

Which PAN-OS versions are affected

The advisory lists multiple affected branches and fixed builds. Customers on PAN-OS 12.2 should move to 12.2.4 or later. The fixed builds for 12.1 include 12.1.4-h12, 12.1.7-h8 and 12.1.10-h2, depending on the installed branch. PAN-OS 11.2 customers should use 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3 or 11.2.16, according to their current version.¹

The list continues through the 11.1 and 10.2 branches. For PAN-OS 11.1, fixed versions include 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15 and 11.1.16-h3. On 10.2, customers should move to 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11 or 10.2.18-h12, depending on the version they run.¹

Palo Alto Networks says no special configuration is required for a device to be affected. It recommends restricting management-interface access to trusted internal IP addresses, ideally through a jump box, while administrators apply the relevant update. The vendor also lists three US-geolocated IP addresses associated with exploit attempts, but says it has not elaborated on the attackers or the wider campaign.¹

The Hacker News reports that the U.S. Cybersecurity and Infrastructure Security Agency has added CVE-2026-0322 to its Known Exploited Vulnerabilities catalogue. The same catalogue entry also includes a separate Cisco Secure Email Gateway flaw, so organisations should avoid treating the two issues as one vulnerability.²

Our opinion

This is the sort of security update where the version matrix matters more than the headline. “Patch PAN-OS” is not precise enough: administrators need to identify the branch in use, apply the corresponding fixed build and confirm that the management interface is not broadly exposed while the work is being scheduled. The limited exploitation note is not a reason to wait; it is a reason to treat the vendor’s highest-urgency guidance as operationally relevant.

The hero image is an abstract server-rack photograph by panumas nikhomkhai on Pexels, not a photograph of a Palo Alto Networks firewall. It illustrates the enterprise-security context without presenting unrelated hardware as the affected product.³