Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation
Summary: Palo Alto Networks issued security updates on Wednesday for CVE-2026-0322, a high-severity (CVSS 8.6) remote code execution flaw in the PAN-OS management interface that lets an authenticated attacker with network access run arbitrary code with root privileges on PA-Series, VM-Series, and Panorama deployments. The company acknowledged 'very limited exploitation' of the management interface without detailing the actors or timing, and CISA added the flaw to its KEV catalog with a fix deadline of October 17, 2026 for Federal Civilian Executive Branch agencies.
Why it matters: Exploitation requires no special configuration, so any firewall management interface reachable from the network is a candidate - and the fix deadline CISA set for federal agencies is October 17, 2026, which is the clock your own patching schedule should be measured against.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-0322CVE-2026-76519
- Related
- ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More Cyber Risks ·CVE-2026-0322: Palo Alto Networks PAN-OS Code Injection Vulnerability Known Exploited Vulnerabilities · Oct 14, 2026CVE-2026-76519: Cisco Secure Email Gateway Relative Path Traversal Vulnerability Known Exploited Vulnerabilities · Oct 14, 2026