Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks

Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls.

The vulnerability affects the PAN-OS management interface and lets authenticated attackers with network access execute code as root on vulnerable devices.

Palo Alto Networks confirmed in a security advisory published Wednesday that it has seen limited exploitation of the flaw in attacks.

"Very limited exploitation has been observed targeting the Palo Alto Networks management interface," the company said.

The vulnerability has a severity score of 8.6 and affects PA-Series and VM-Series firewalls, as well as Panorama virtual and M-Series appliances. Palo Alto says Cloud NGFW and Prisma Access are not affected.

To exploit the vulnerability, attackers need existing credentials and network access to the PAN-OS management interface.