PAN-OS RCE vulnerability exploited, patches available

Palo Alto Networks released updates for a high-severity PAN-OS RCE vulnerability after seeing it used in limited attacks, according to BleepingComputer. The flaw lets an authenticated attacker with network access to the PAN-OS management interface execute code with root privileges on affected devices.

PAN-OS RCE vulnerability, what is affected and how it works

According to BleepingComputer, the issue impacts the management interface on PA-Series and VM-Series firewalls, and on Panorama virtual and M-Series appliances. Palo Alto Networks said Cloud NGFW and Prisma Access are not affected. The company reported a severity score of 8.6 and confirmed it has observed "Very limited exploitation has been observed targeting the Palo Alto Networks management interface," in its advisory, as reported by BleepingComputer.

To succeed, an attacker needs valid credentials and network access to the management interface. That dependency means the flaw is not a purely unauthenticated internet-facing hole, but it still allows full root execution if an attacker can reach the management plane with credentials.

The vulnerability was discovered by a Palo Alto researcher, Suraj Siddharudh, and Palo Alto published indicators of compromise including three IP addresses tied to exploit activity: 66.42.72[.]14, 208.83.239[.]114, and 149.248.47[.]234, according to BleepingComputer.

What we know about the response and official guidance

Palo Alto has released fixes for PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 releases, and the company said a fix for PAN-OS 11.2.16 was expected on October 15, according to BleepingComputer. The vendor advises customers running older, unsupported versions to upgrade to a supported release.

There are no full workarounds listed by Palo Alto, but customers with Threat Prevention subscriptions can enable signatures that offer limited detection for known patterns. Palo Alto cautioned that those signatures provide partial coverage and may not catch variations of the attack, according to the advisory reported by BleepingComputer.

The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog, and requires federal civilian agencies to mitigate the issue by October 17, BleepingComputer reports.

Who should be worried and where risk comes from

Any organization that runs the affected PA-Series, VM-Series, or Panorama appliances should treat this as high priority because a successful exploit yields root execution on the device. Because exploitation requires credentials and network access, environments that expose the management interface beyond a small set of trusted internal hosts are at higher risk. If your firewall management plane is reachable from broad internal networks, jump hosts, or vendor connections, you should assume exposure until mitigations are applied.

What to do now (practical steps)

• Apply vendor updates: install the PAN-OS fixes Palo Alto has released for your PAN-OS release line as soon as you can.
• Restrict management access: limit the management interface to trusted internal IP addresses only, or to a single jump box, following Palo Alto's recommendation reported by BleepingComputer.
• Review credentials: rotate and audit any accounts that can access the management interface and force multi-factor authentication where supported.
• Use Threat Prevention signatures as temporary layers: enable the relevant Threat Prevention signatures to gain partial detection while you patch, but do not treat them as a full replacement for updates.
• Monitor and hunt: add the IoCs and the three IP addresses published by Palo Alto to your monitoring and block lists, and look for unusual activity on management interfaces.
• If you run unsupported releases: plan immediate upgrades to supported PAN-OS versions, since vendor fixes are provided only for supported releases.

If you cannot patch immediately, reduce exposure

If you cannot install updates right away, take steps to reduce who and what can reach the management plane. Move management interfaces behind a tightly controlled jump host, restrict access with firewall rules, and remove any direct internet exposure. Review remote vendor access processes and any VPN or jump box that provides a route to the management interface.

Why this matters to small organizations and public sector teams

Even though exploitation requires credentials, management interfaces are often trusted by administrators and by automation tools, and a compromise there can let attackers alter firewall rules, install backdoors, or pivot into internal networks. CISA placing the CVE on the Known Exploited Vulnerabilities list and requiring mitigation by October 17 underscores that federal agencies must prioritize this patch, which is a useful signal for other organizations to follow.

If you want to check how exposed your external footprint is, start with a free external scan. For more hands-on help with patch prioritization, access control on management planes, or penetration testing for firewall appliances, see our security services and scans at Want to know how exposed your own site is? Start with a free external scan.

For technical details and the vendor advisory, see the report at BleepingComputer and the vendor advisory it cites.