Palo Alto Networks has warned customers about a high-severity vulnerability in its PAN-OS firewall software that attackers are already exploiting to gain root-level control of affected devices.
The flaw, tracked as CVE-2026-0322, affects the management interface used by administrators to control Palo Alto firewalls.
An attacker needs valid credentials and network access to that interface. But once inside, the vulnerability can allow arbitrary code to run with root privileges, giving the attacker the highest level of control over the firewall.
Palo Alto Networks says exploitation seen so far has been very limited.
FCRF Launches CP-FRM to Build India’s Next Generation of Fraud Risk Professionals
Flaw Targets the Firewall’s Management Interface
The vulnerability affects PAN-OS running on PA-Series and VM-Series firewalls, as well as Panorama virtual appliances and M-Series management devices.
Cloud NGFW and Prisma Access are not affected.
The flaw carries a CVSS severity score of 8.6 and has been given Palo Alto Networks’ highest urgency rating.
The company says no special configuration is required for a vulnerable system to be affected.
The main condition is that the attacker must already have authenticated access and be able to reach the management interface over the network.
That requirement lowers the attack surface compared with an unauthenticated internet-facing flaw, but it does not make the issue harmless.
Administrative credentials can be stolen through phishing, infostealer malware, password reuse or compromised internal accounts.
If the management interface is also exposed more widely than necessary, stolen credentials can become far more dangerous.
What Root-Level Access Actually Means
Root is the highest privilege level on Unix-like systems.
If attackers obtain root access on a firewall, they can potentially change security rules, inspect traffic, create persistence or weaken protections without ordinary users noticing.
That is especially serious because a firewall sits between an organisation’s internal network and outside traffic.
A compromised firewall can therefore become more than a single infected device.
It may give attackers a strategic position from which they can monitor or manipulate traffic and potentially move deeper into the network.
Palo Alto Networks says customers should restrict access to the management interface to trusted internal IP addresses only.
The company has also published three IP addresses linked to observed exploitation so security teams can search their logs for suspicious activity.
Patches Released, but No Full Workaround Exists
Palo Alto Networks has released fixes for affected PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 branches.
Customers running unsupported versions will need to upgrade to a supported release before they can apply the relevant fix.
The company says there is no complete workaround for the vulnerability.
Customers with Threat Prevention subscriptions can use detection signatures that provide some protection against known attack patterns.
However, Palo Alto has warned that this coverage is limited.
Variants of the exploit may exist that current signatures do not detect.
That means the signatures should not be treated as a substitute for patching.
Security teams are also being advised to review administrative login history and firewall configuration changes, especially if the management interface was reachable from untrusted networks.
CISA Orders US Agencies to Fix Flaw by October 17
The US Cybersecurity and Infrastructure Security Agency has added CVE-2026-0322 to its Known Exploited Vulnerabilities catalogue.
That move confirms that the flaw is being used in real attacks.
US federal civilian agencies have been ordered to mitigate the vulnerability by October 17.
For private companies, the deadline is not legally binding, but inclusion in the catalogue is a strong signal that patching should be treated as urgent.
The issue follows several serious PAN-OS vulnerabilities disclosed earlier this year.
In May, attackers exploited CVE-2026-0300, a critical PAN-OS vulnerability affecting the User-ID Authentication Portal.
Another flaw, CVE-2026-0257, affecting GlobalProtect authentication, was later abused in attacks linked to ransomware operations.
The repeated targeting shows why firewall and VPN appliances remain attractive targets.
They are always online, sit at the edge of corporate networks and often have privileged access to internal systems.
Perimeter Devices Remain High-Value Targets
Security teams often focus most heavily on laptops, servers and employee accounts.
But network appliances such as firewalls, VPN gateways and remote-access systems can be even more valuable to attackers.
They are designed to control who gets into a network.
If that control point itself is compromised, other security protections can become much easier to bypass.
The current PAN-OS flaw requires credentials, which means strong access controls remain important alongside patching.
Organisations should ensure management interfaces are not unnecessarily exposed to the internet and should limit access to dedicated trusted networks wherever possible.
The company has not publicly attributed the current exploitation to any specific hacking group.
It is also not yet clear whether attackers used compromised firewalls as an entry point into wider internal networks.
What this means for you:
Organisations running Palo Alto firewalls should patch affected PAN-OS versions immediately and restrict management access to trusted internal systems. Admin teams should also review recent login and configuration activity for signs of compromise.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
