Palo Alto Networks patches an exploited PAN-OS zero-day
October 14, 2026
Palo Alto Networks released fixes on October 14 for CVE-2026-0322 (severity 8.6) and said it had seen very limited exploitation. The flaw is in the management interface and lets an authenticated attacker with network access run code as root on PA-Series and VM-Series firewalls and Panorama. Cloud NGFW and Prisma Access are not affected. CISA set a federal deadline of October 17. The same week brought a fix for an exploited Ivanti Connect Secure zero-day and a Cisco warning about an exploited Secure Email Gateway flaw.
Why it matters
A firewall is meant to protect the network, so root access on one gives an attacker a strong position. It is also the second exploited PAN-OS flaw in about five months.
What defenders can take from it
- Allow management interfaces only from trusted internal networks.
- Upgrade to a fixed version now, and review who has management accounts.