Palo Alto Networks has disclosed an actively exploited PAN-OS vulnerability that can give a privileged attacker root-level code execution on affected firewalls. The flaw, tracked as CVE-2026-0322, targets the management interface and has received a CVSS 4.0 score of 8.6. The company describes observed exploitation as very limited, but has assigned its highest remediation urgency and advises customers to upgrade without delay.

The disclosure matters because a firewall is a central enforcement point for network traffic. Root access to the appliance can give an intruder exceptional visibility and control, potentially allowing configuration changes, persistence, or interference with security monitoring. Palo Alto Networks has not attributed the activity or said how many organizations were targeted.

How the PAN-OS flaw works

CVE-2026-0322 is a code-injection weakness classified as CWE-94. Exploitation requires network access to the PAN-OS management interface as well as an authenticated account with high privileges. A successful attacker can execute code as root without further user interaction.

Those prerequisites make this different from an unauthenticated internet-wide compromise. However, they do not make the issue harmless. Stolen administrator credentials, an insider, or an attacker who has already established a foothold could use the bug to turn limited access into full control of a security appliance. Internet-exposed management interfaces face the clearest risk.

Affected platforms include PA-Series hardware firewalls, VM-Series virtual firewalls, and Panorama on virtual systems or M-Series appliances. Palo Alto Networks says Cloud NGFW and Prisma Access are not affected. No unusual configuration is required for a vulnerable installation to be exposed to the weakness.

Fixed releases and affected branches

Customers should consult the vendor advisory for the exact upgrade path for their branch. Fixed releases identified by Palo Alto Networks include:

• PAN-OS 12.2.4;
• PAN-OS 12.1.10-h2;
• PAN-OS 11.1.16-h3;
• PAN-OS 10.2.18-h12;
• selected 11.2 hotfixes, including 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, and 11.2.13-h3.

The vendor says there is no workaround that eliminates the flaw. Restricting the management interface to trusted internal addresses and reaching it through a hardened jump host can reduce exposure, but those controls are not substitutes for installing a corrected build.

Before upgrading, operators should back up the current configuration and follow the normal high-availability sequence so paired devices do not lose protection at the same time. Afterward, verify the reported software version, confirm that policy synchronization and traffic processing are healthy, and record the change in the asset inventory. Any appliance that cannot be patched immediately should have management access reduced to the narrowest possible set of source addresses and monitored continuously until remediation is complete.

What defenders should investigate

Palo Alto Networks linked three IP addresses to threat activity and limited exploit attempts: 66[.]42[.]72[.]14, 208[.]83[.]239[.]114, and 149[.]248[.]47[.]234. Security teams should search firewall management and upstream network logs for connections involving those addresses, while remembering that attackers can change infrastructure and that an indicator match is not required for compromise.

Defenders should also review administrator logins, unexpected configuration changes, newly created accounts, unusual processes, and management traffic from hosts that do not normally administer the appliance. Where possible, compare local evidence with independent logging because an attacker operating as root may be able to alter records on the device.

Priorities for firewall owners

Organizations should inventory every physical firewall, virtual instance, and Panorama deployment, including disaster-recovery and lab systems that may still be reachable. Confirm the running version rather than relying on asset records, then apply the vendor-recommended fixed release. Management access should be limited to a small group of dedicated administrative systems protected with strong authentication.

Finally, teams should treat patching and compromise assessment as parallel tasks. Installing an update closes the known route but does not prove that earlier exploitation did not occur. Because the vulnerable component protects the network itself, any suspicious evidence deserves a broader incident-response review of credentials, configurations, and traffic that passed through the device.