Palo Alto PAN-OS Flaw CVE-2026-0322 Exploited in the Wild Despite Requiring Credentials

Palo Alto Networks disclosed CVE-2026-0322, a management interface vulnerability in PAN-OS that lets an authenticated attacker with network access execute code as root on the firewall. CISA added the flaw to its Known Exploited Vulnerabilities catalog and gave federal civilian agencies until October 17 to remediate after limited in-the-wild exploitation was observed. The flaw is rated CVSS 8.6 and classified as a code injection weakness, and Palo Alto says upgrading or restricting access are the only remedies. Researchers warn that stolen administrator credentials from infostealer logs or credential reuse could effectively remove the authentication barrier. Palo Alto has published three attacker IP addresses tied to the observed activity and recommends patching to the listed fixed builds.