**Palo Alto Networks** has released critical security updates to mitigate **CVE-2026-0322**, a high-severity remote code execution (RCE) zero-day vulnerability impacting its **PAN-OS** operating system. The flaw, with a severity score of 8.6, has been observed in limited, targeted attacks against **Palo Alto Networks** firewalls. ### Vulnerability Details The **CVE-2026-0322** vulnerability resides in the **PAN-OS** management interface. It allows authenticated attackers with existing credentials and network access to the management interface to execute arbitrary code as root on affected devices. **Palo Alto Networks** confirmed this limited exploitation in a security advisory published on Wednesday. Affected products include **PA-Series** and **VM-Series** firewalls, as well as **Panorama** virtual and **M-Series** appliances. Cloud NGFW and Prisma Access services are not impacted by this vulnerability. ### Mitigation and Recommendations To exploit **CVE-2026-0322**, attackers require both valid credentials and network access to the **PAN-OS** management interface. Consequently, **Palo Alto Networks** strongly advises restricting access to the management interface to only trusted internal IP addresses. Fixes have been released for **PAN-OS** versions 10.2, 11.1, 11.2, 12.1, and 12.2. A patch for **PAN-OS** 11.2.16 is anticipated by October 15. Customers running older, unsupported versions are urged to upgrade to a patched release immediately. While no direct workarounds exist, customers with **Threat Prevention** subscriptions can enable signatures that offer limited protection against known attack patterns. However, **Palo Alto Networks** cautions that these signatures may not detect all variations of the exploit. ### Discovery and Exploitation Indicators The vulnerability was internally discovered by **Suraj Siddharudh**, a senior principal product security researcher at **Palo Alto Networks**. The company has also shared three IP addresses associated with the exploitation of this flaw: 66.42.72[.]14, 208.83.239[.]114, and 149.248.47[.]234. ### CISA Mandate The **U.S. Cybersecurity and Infrastructure Security Agency (CISA)** has added **CVE-2026-0322** to its **Known Exploited Vulnerabilities Catalog**. Federal civilian agencies are now mandated to mitigate this vulnerability by October 17, underscoring the critical nature and active threat posed by this zero-day.